Edit tour

Windows Analysis Report
Leside-.exe

Overview

General Information

Sample name:	Leside-.exe
Analysis ID:	1581494
MD5:	54bb85bce47c855c509a16b32970c38b
SHA1:	23c1819fbc72cf7d645c036324d85208df6c77f3
SHA256:	3ccd2f2337a264971fed13bf7b3e4ca076afde84ba7b6c681f467b5021c0923e
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Leside-.exe (PID: 2120 cmdline: "C:\Users\user\Desktop\Leside-.exe" MD5: 54BB85BCE47C855C509A16B32970C38B)

conhost.exe (PID: 2492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

aspnet_regiis.exe (PID: 480 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" MD5: 5D1D74198D75640E889F0A577BBF31FC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["ingreem-eilish.biz", "scentniej.buzz", "screwamusresz.buzz", "hummskitnj.buzz", "rebuildeso.buzz", "appliacnesot.buzz", "inherineau.buzz", "cashfuzysao.buzz", "prisonyfork.buzz"], "Build id": "HpOoIh--c8a131f8922d"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.binstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:29:58.577963+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	92.122.104.90	443	TCP
2024-12-27T22:30:01.088185+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-27T22:30:02.792004+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:30:01.877190+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:30:01.877190+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49731	104.21.66.86	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:29:59.375510+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	92.122.104.90	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/apip	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apiQqrB	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com//	Avira URL Cloud: Label: malware

Found malware configuration

Source: Leside-.exe

Malware Configuration Extractor: LummaC {"C2 url": ["ingreem-eilish.biz", "scentniej.buzz", "screwamusresz.buzz", "hummskitnj.buzz", "rebuildeso.buzz", "appliacnesot.buzz", "inherineau.buzz", "cashfuzysao.buzz", "prisonyfork.buzz"], "Build id": "HpOoIh--c8a131f8922d"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\gdi32.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Leside-.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: Leside-.exe	String decryptor: hummskitnj.buzz
Source: Leside-.exe	String decryptor: cashfuzysao.buzz
Source: Leside-.exe	String decryptor: appliacnesot.buzz
Source: Leside-.exe	String decryptor: screwamusresz.buzz
Source: Leside-.exe	String decryptor: inherineau.buzz
Source: Leside-.exe	String decryptor: scentniej.buzz
Source: Leside-.exe	String decryptor: rebuildeso.buzz
Source: Leside-.exe	String decryptor: prisonyfork.buzz
Source: Leside-.exe	String decryptor: ingreem-eilish.biz
Source: Leside-.exe	String decryptor: lid=%s&j=%s&ver=4.0
Source: Leside-.exe	String decryptor: TeslaBrowser/5.5
Source: Leside-.exe	String decryptor: - Screen Resoluton:
Source: Leside-.exe	String decryptor: - Physical Installed Memory:
Source: Leside-.exe	String decryptor: Workgroup: -
Source: Leside-.exe	String decryptor: HpOoIh--c8a131f8922d

Source: Leside-.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 92.122.104.90:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: Leside-.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Leside-.exe

Code function: 0_2_6CE40B60 FindFirstFileExW,

0_2_6CE40B60

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then lea esi, dword ptr [eax+00000270h]	2_2_72C48A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ebx	2_2_72C48600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_72C6AAC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 385488F2h	2_2_72C7CA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_72C61A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_72C76210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	2_2_72C7FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	2_2_72C473D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_72C473D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_72C683D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-6E2DD57Fh]	2_2_72C5EB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+0Ah]	2_2_72C4AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	2_2_72C80340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_72C6D34A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_72C5C300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	2_2_72C58B15
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	2_2_72C7FB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	2_2_72C7FB2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	2_2_72C7FB28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov esi, ecx	2_2_72C690D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_72C6E0DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_72C5D8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_72C5D8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_72C6C0E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	2_2_72C5B8F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	2_2_72C5B8F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_72C6C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, ebx	2_2_72C5C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-000000BEh]	2_2_72C5C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+0Ah]	2_2_72C5C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-2E3D7ACEh]	2_2_72C5C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_72C5D8AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_72C5D8AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_72C6C850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then push esi	2_2_72C4C805
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_72C62830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+04h]	2_2_72C7C830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_72C681CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_72C689E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_72C6B980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	2_2_72C7C990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp edx	2_2_72C639B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	2_2_72C639B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_72C6C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-16h]	2_2_72C81160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [72C86130h]	2_2_72C58169
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	2_2_72C6B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_72C6D17D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_72C6D116
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	2_2_72C806F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	2_2_72C69E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h]	2_2_72C42EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_72C62E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp edx	2_2_72C62E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	2_2_72C62E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_72C6DE07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	2_2_72C7FE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp edx	2_2_72C637D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov dword ptr [esp+20h], eax	2_2_72C49780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+20h]	2_2_72C67740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_72C56F52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_72C6BF13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edi, dword ptr [esp+28h]	2_2_72C65F1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	2_2_72C81720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp eax	2_2_72C69739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_72C54CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, ebx	2_2_72C67440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+09AD4080h]	2_2_72C67440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [eax+edi-74D5A7FEh]	2_2_72C6C465
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_72C6C465
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_72C5747D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [edx], di	2_2_72C5747D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edi, dword ptr [esi+30h]	2_2_72C4CC7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+eax-46h]	2_2_72C7EDC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	2_2_72C7CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-3ECB279Fh]	2_2_72C7CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	2_2_72C7CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 7F7BECC6h	2_2_72C7CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_72C6DDFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edi, ecx	2_2_72C6A5B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	2_2_72C7FD70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+61765397h]	2_2_72C5B57D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-16h]	2_2_72C80D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	2_2_72C66D2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_72C68528

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 92.122.104.90:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.66.86:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: ingreem-eilish.biz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz

Source: Joe Sandbox View	IP Address: 104.21.66.86 104.21.66.86
Source: Joe Sandbox View	IP Address: 92.122.104.90 92.122.104.90

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 92.122.104.90:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ htt` equals www.youtube.com (Youtube)
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcast equals www.youtube.com (Youtube)
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: chat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: chat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=4b81e9edead33889589ee890; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveFri, 27 Dec 2024 21:29:59 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control% equals www.youtube.com (Youtube)
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcast equals www.youtube.com (Youtube)
Source: aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: om/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://play equals www.youtube.com (Youtube)
Source: aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-sr equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: ingreem-eilish.biz
Source: global traffic	DNS traffic detected: DNS query: prisonyfork.buzz
Source: global traffic	DNS traffic detected: DNS query: rebuildeso.buzz
Source: global traffic	DNS traffic detected: DNS query: scentniej.buzz
Source: global traffic	DNS traffic detected: DNS query: inherineau.buzz
Source: global traffic	DNS traffic detected: DNS query: screwamusresz.buzz
Source: global traffic	DNS traffic detected: DNS query: appliacnesot.buzz
Source: global traffic	DNS traffic detected: DNS query: cashfuzysao.buzz
Source: global traffic	DNS traffic detected: DNS query: hummskitnj.buzz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.00000000035C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampow
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstat
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.00000000035C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.00000000035C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.00000000035C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.00000000035C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.stP
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: aspnet_regiis.exe, 00000002.00000003.1738790297.00000000035E9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003615000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003615000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.00000000035E9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.00000000035E7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739593291.00000000035EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: aspnet_regiis.exe, 00000002.00000003.1729032076.00000000035E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com//
Source: aspnet_regiis.exe, 00000002.00000003.1738790297.00000000035E9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.00000000035F1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739605444.00000000035F2000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.00000000035E7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiQqrB
Source: aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apip
Source: aspnet_regiis.exe, 00000002.00000003.1729032076.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739552128.00000000035D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steamp
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaizedp
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/lstu
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.00000000035C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptc
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown	HTTPS traffic detected: 92.122.104.90:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 2_2_72C73E30 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_72C73E30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 2_2_72C73E30 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_72C73E30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 2_2_72C748C2 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

2_2_72C748C2

System Summary

.NET source code contains very large array initializations

Source: Leside-.exe, GetWin.cs

Large array initialization: GetWindowsOS: array initializer size 639488

Source: C:\Users\user\Desktop\Leside-.exe

Memory allocated: 72C40000 page execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE143C0 WindowsHandle,GetConsoleWindow,ShowWindow,VirtualAlloc,CreateProcessW,NtGetContextThread,NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx,NtSetContextThread,NtResumeThread,CloseHandle,CloseHandle,VirtualAlloc,NtAllocateVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,NtSetContextThread,NtResumeThread,CloseHandle,NtWriteVirtualMemory,NtCreateThreadEx,NtSetContextThread,NtResumeThread,		0_2_6CE143C0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE12B10 GetModuleHandleW,NtQueryInformationProcess,GetModuleHandleW,GetModuleHandleW,		0_2_6CE12B10

Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE0D910	0_2_6CE0D910
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE143C0	0_2_6CE143C0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE12B10	0_2_6CE12B10
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE22CC0	0_2_6CE22CC0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE2C0A0	0_2_6CE2C0A0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE1F470	0_2_6CE1F470
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE10440	0_2_6CE10440
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE2C440	0_2_6CE2C440
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE14050	0_2_6CE14050
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE2B450	0_2_6CE2B450
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE37C50	0_2_6CE37C50
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE01020	0_2_6CE01020
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE39420	0_2_6CE39420
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE31C00	0_2_6CE31C00
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE2CC10	0_2_6CE2CC10
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE231C0	0_2_6CE231C0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE20DB0	0_2_6CE20DB0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE2A9B0	0_2_6CE2A9B0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE38580	0_2_6CE38580
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE32D80	0_2_6CE32D80
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE20190	0_2_6CE20190
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE21190	0_2_6CE21190
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE1F970	0_2_6CE1F970
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE25540	0_2_6CE25540
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE3B540	0_2_6CE3B540
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE33150	0_2_6CE33150
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE21920	0_2_6CE21920
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE22920	0_2_6CE22920
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE26D00	0_2_6CE26D00
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE1FEF0	0_2_6CE1FEF0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE38EF0	0_2_6CE38EF0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE2A2D0	0_2_6CE2A2D0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE1EAB0	0_2_6CE1EAB0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE2FA80	0_2_6CE2FA80
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE28A80	0_2_6CE28A80
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE0C260	0_2_6CE0C260
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE24660	0_2_6CE24660
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE38260	0_2_6CE38260
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE2F650	0_2_6CE2F650
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE46A51	0_2_6CE46A51
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE27620	0_2_6CE27620
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE1CE10	0_2_6CE1CE10
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE2D610	0_2_6CE2D610
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE283E0	0_2_6CE283E0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE2BBF0	0_2_6CE2BBF0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE31FF0	0_2_6CE31FF0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE3A3F0	0_2_6CE3A3F0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE1E3B0	0_2_6CE1E3B0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE24BB0	0_2_6CE24BB0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE237B0	0_2_6CE237B0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE2EBB0	0_2_6CE2EBB0
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE26780	0_2_6CE26780
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE33F80	0_2_6CE33F80
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE29F90	0_2_6CE29F90
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE24F60	0_2_6CE24F60
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE0D370	0_2_6CE0D370
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE37740	0_2_6CE37740
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE1C350	0_2_6CE1C350
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE1D750	0_2_6CE1D750
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE35F50	0_2_6CE35F50
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE2AF30	0_2_6CE2AF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C4B100	2_2_72C4B100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C48600	2_2_72C48600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C59AD0	2_2_72C59AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C642D0	2_2_72C642D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C79280	2_2_72C79280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C79A80	2_2_72C79A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C68ABC	2_2_72C68ABC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C7CA40	2_2_72C7CA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C75A4F	2_2_72C75A4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C7DA4D	2_2_72C7DA4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C44270	2_2_72C44270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C51227	2_2_72C51227
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C5E220	2_2_72C5E220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C7FA20	2_2_72C7FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C4F3C0	2_2_72C4F3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C473D0	2_2_72C473D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C683D8	2_2_72C683D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C5EB80	2_2_72C5EB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C44BA0	2_2_72C44BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C4AB40	2_2_72C4AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C61340	2_2_72C61340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C6D34A	2_2_72C6D34A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C6F377	2_2_72C6F377
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C58B15	2_2_72C58B15
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C49310	2_2_72C49310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C7FB10	2_2_72C7FB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C7FB2A	2_2_72C7FB2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C7FB28	2_2_72C7FB28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C438C0	2_2_72C438C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C6A0CA	2_2_72C6A0CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C738D0	2_2_72C738D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C6C0E6	2_2_72C6C0E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C560E9	2_2_72C560E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C5B8F6	2_2_72C5B8F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C6C09E	2_2_72C6C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C5C8A0	2_2_72C5C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C788B0	2_2_72C788B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C4C840	2_2_72C4C840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C5D003	2_2_72C5D003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C4D021	2_2_72C4D021
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C4D83C	2_2_72C4D83C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C681CC	2_2_72C681CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C809E0	2_2_72C809E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C6C9EB	2_2_72C6C9EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C6E180	2_2_72C6E180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C7F18B	2_2_72C7F18B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C691AE	2_2_72C691AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C639B9	2_2_72C639B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C6C09E	2_2_72C6C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C46160	2_2_72C46160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C5E960	2_2_72C5E960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C58169	2_2_72C58169
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C45900	2_2_72C45900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C66910	2_2_72C66910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C646D0	2_2_72C646D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C806F0	2_2_72C806F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C4E687	2_2_72C4E687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C78EA0	2_2_72C78EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C42EB0	2_2_72C42EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C5AEB0	2_2_72C5AEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C4CE45	2_2_72C4CE45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C78650	2_2_72C78650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C6EE63	2_2_72C6EE63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C60E6C	2_2_72C60E6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C62E6D	2_2_72C62E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C6FE74	2_2_72C6FE74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C7FE00	2_2_72C7FE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C4F60D	2_2_72C4F60D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C5961B	2_2_72C5961B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C5E630	2_2_72C5E630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C557C0	2_2_72C557C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C49780	2_2_72C49780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C67740	2_2_72C67740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C52750	2_2_72C52750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C5DF50	2_2_72C5DF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C56F52	2_2_72C56F52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C65F1B	2_2_72C65F1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C69739	2_2_72C69739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C604C6	2_2_72C604C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C624E0	2_2_72C624E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C4D4F3	2_2_72C4D4F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C71CF0	2_2_72C71CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C54CA0	2_2_72C54CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C67440	2_2_72C67440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C7A440	2_2_72C7A440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C80460	2_2_72C80460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C5747D	2_2_72C5747D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C73C10	2_2_72C73C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C7A5D4	2_2_72C7A5D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C465F0	2_2_72C465F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C7CDF0	2_2_72C7CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C7C5A0	2_2_72C7C5A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C77DA9	2_2_72C77DA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C6CD4C	2_2_72C6CD4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C6CD5E	2_2_72C6CD5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C64560	2_2_72C64560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C7FD70	2_2_72C7FD70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C61D00	2_2_72C61D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C80D20	2_2_72C80D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C66D2E	2_2_72C66D2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C51D2B	2_2_72C51D2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C79D30	2_2_72C79D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C6C53C	2_2_72C6C53C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 72C54C90 appears 77 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 72C47F60 appears 40 times

Source: Leside-.exe, 00000000.00000000.1652383379.00000000008D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNathanPatrickNathan.exeZHET vs Leside-.exe
Source: Leside-.exe, 00000000.00000002.1657817197.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Leside-.exe
Source: Leside-.exe	Binary or memory string: OriginalFilenameNathanPatrickNathan.exeZHET vs Leside-.exe

Source: Leside-.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/2@11/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 2_2_72C79280 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,

2_2_72C79280

Source: C:\Users\user\Desktop\Leside-.exe

File created: C:\Users\user\AppData\Roaming\gdi32.dll

Jump to behavior

Source: C:\Users\user\Desktop\Leside-.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2492:120:WilError_03

Source: Leside-.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Leside-.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Leside-.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Leside-.exe "C:\Users\user\Desktop\Leside-.exe"
Source: C:\Users\user\Desktop\Leside-.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Leside-.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Users\user\Desktop\Leside-.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Leside-.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Leside-.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Leside-.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C5B324 push F3B972C8h; retf	2_2_72C5B32A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C77069 push es; retf	2_2_72C77074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_72C7C990 push eax; mov dword ptr [esp], 5C5D5E5Fh	2_2_72C7C99E

Source: Leside-.exe

Static PE information: section name: .text entropy: 7.114694614150449

Source: C:\Users\user\Desktop\Leside-.exe

File created: C:\Users\user\AppData\Roaming\gdi32.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Leside-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Leside-.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Memory allocated: 2D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Memory allocated: 2B50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Leside-.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Leside-.exe TID: 3180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe TID: 2084	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe TID: 2084	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Leside-.exe

Code function: 0_2_6CE40B60 FindFirstFileExW,

0_2_6CE40B60

Source: C:\Users\user\Desktop\Leside-.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C0000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035BF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739038911.00000000035BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003615000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003615000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003615000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003615000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003615000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWY
Source: aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003615000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003615000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003615000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003615000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003615000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 2_2_72C7E110 LdrInitializeThunk,

2_2_72C7E110

Source: C:\Users\user\Desktop\Leside-.exe

Code function: 0_2_6CE3C892 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CE3C892

Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE3F462 mov eax, dword ptr fs:[00000030h]		0_2_6CE3F462
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE406A1 mov eax, dword ptr fs:[00000030h]		0_2_6CE406A1

Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE3C892 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CE3C892
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE3ED7C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CE3ED7C
Source: C:\Users\user\Desktop\Leside-.exe	Code function: 0_2_6CE3C367 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CE3C367

Source: C:\Users\user\Desktop\Leside-.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Leside-.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C40000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Leside-.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C40000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Leside-.exe, 00000000.00000000.1652312652.0000000000832000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: hummskitnj.buzz
Source: Leside-.exe, 00000000.00000000.1652312652.0000000000832000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: Leside-.exe, 00000000.00000000.1652312652.0000000000832000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: appliacnesot.buzz
Source: Leside-.exe, 00000000.00000000.1652312652.0000000000832000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: screwamusresz.buzz
Source: Leside-.exe, 00000000.00000000.1652312652.0000000000832000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: inherineau.buzz
Source: Leside-.exe, 00000000.00000000.1652312652.0000000000832000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: scentniej.buzz
Source: Leside-.exe, 00000000.00000000.1652312652.0000000000832000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: rebuildeso.buzz
Source: Leside-.exe, 00000000.00000000.1652312652.0000000000832000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: prisonyfork.buzz

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Leside-.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C40000	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C41000	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C82000	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C85000	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C93000	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C41000	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C82000	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C85000	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C93000	Jump to behavior
Source: C:\Users\user\Desktop\Leside-.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 313B008	Jump to behavior

Source: C:\Users\user\Desktop\Leside-.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Leside-.exe

Code function: 0_2_6CE3CA58 cpuid

0_2_6CE3CA58

Source: C:\Users\user\Desktop\Leside-.exe

Queries volume information: C:\Users\user\Desktop\Leside-.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Leside-.exe

Code function: 0_2_6CE3C4DB GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CE3C4DB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.binstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.binstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	311 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	23 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Leside-.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\gdi32.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
ingreem-eilish.biz	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apip	100%	Avira URL Cloud	malware
https://login.steamp	0%	Avira URL Cloud	safe
https://checkout.steampow	0%	Avira URL Cloud	safe
https://help.stP	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apiQqrB	100%	Avira URL Cloud	malware
https://community.fastly.steamstat	0%	Avira URL Cloud	safe
https://cdn.fastly.	0%	Avira URL Cloud	safe
https://steambroadcast-test.akamaizedp	0%	Avira URL Cloud	safe
https://lev-tolstoi.com//	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	92.122.104.90	true	false	high
lev-tolstoi.com	104.21.66.86	true	false	high
cashfuzysao.buzz	unknown	unknown	true	unknown
scentniej.buzz	unknown	unknown	true	unknown
inherineau.buzz	unknown	unknown	true	unknown
prisonyfork.buzz	unknown	unknown	true	unknown
ingreem-eilish.biz	unknown	unknown	true	unknown
rebuildeso.buzz	unknown	unknown	true	unknown
appliacnesot.buzz	unknown	unknown	true	unknown
hummskitnj.buzz	unknown	unknown	true	unknown
screwamusresz.buzz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
scentniej.buzz	false		high
https://steamcommunity.com/profiles/76561199724331900	false		high
rebuildeso.buzz	false		high
appliacnesot.buzz	false		high
screwamusresz.buzz	false		high
cashfuzysao.buzz	false		high
inherineau.buzz	false		high
https://lev-tolstoi.com/api	false		high
hummskitnj.buzz	false		high
prisonyfork.buzz	false		high
ingreem-eilish.biz	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://player.vimeo.com	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.	aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com	aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptc	aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.00000000035C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.00000000035C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/	aspnet_regiis.exe, 00000002.00000003.1738790297.00000000035E9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003615000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003615000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.00000000035E9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.00000000035E7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739593291.00000000035EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003615000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiQqrB	aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampow	aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apip	aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://store.steampowered.com/subscriber_agreement/	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steamp	aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/discussions/	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstat	aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/stats/	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.stP	aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/workshop/	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739120749.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1739527863.00000000035C7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/lstu	aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com//	aspnet_regiis.exe, 00000002.00000003.1729032076.00000000035E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://recaptcha.net	aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com	aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:27060	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706150176.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.00000000035C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.00000000035C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steambroadcast-test.akamaizedp	aspnet_regiis.exe, 00000002.00000002.1739605444.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729032076.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738368582.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729150438.0000000003624000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1739196469.0000000003624000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	aspnet_regiis.exe, 00000002.00000003.1706112196.0000000003656000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729002687.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1729136674.0000000003662000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1706112196.000000000365C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.66.86	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
92.122.104.90	steamcommunity.com	European Union		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581494
Start date and time:	2024-12-27 22:29:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Leside-.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/2@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 20 Number of non-executed functions: 138
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Leside-.exe

Simulations

Behavior and APIs

Time	Type	Description
16:29:53	API Interceptor	11x Sleep call for process: aspnet_regiis.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.66.86	MV ROCKET_PDA.exe	Get hash	malicious	FormBook	Browse	www.ayushigangwar.com/nqn4/?CJBlp=0Brh6Vr8UbBX&T2MpwT=59bmqUDXor7TXV4b71NCQ0d0nCVif23i1yH5+9ZmJc5hgCU7y+ZN9z0btTsWzGv6OrGw
92.122.104.90	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	UMrFwHyjUi.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse
	http://sneamcomnnumnlty.com/fact/actual/get	Get hash	malicious	Unknown	Browse
	https://u.to/xjPiIA	Get hash	malicious	Unknown	Browse
	https://sueamcoommunnlty.com/geting/active	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	AD3SI7tuzs.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	MaZjv5XeQi.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	jT7sgjdTea.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
steamcommunity.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.121.10.34
	Setup.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	23.55.153.106
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	Setup.exe	Get hash	malicious	Unknown	Browse	104.121.10.34
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	23.57.90.162
	grand-theft-auto-5-theme-1-installer_qb8W-j1.exe	Get hash	malicious	Unknown	Browse	95.100.135.104
	db0fa4b8db0333367e9bda3ab68b8042.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	104.73.204.126
	db0fa4b8db0333367e9bda3ab68b8042.spc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	104.120.124.62
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	RUUSfr6dVm.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
CLOUDFLARENETUS	solara-executor.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.2.114
	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.2.114
	http://proxyium.com	Get hash	malicious	Unknown	Browse	104.21.80.92
	https://cbhc9.anguatiab.ru/RpweC/	Get hash	malicious	Unknown	Browse	1.1.1.1
	setup.msi	Get hash	malicious	Unknown	Browse	172.67.148.171
	search.hta	Get hash	malicious	Unknown	Browse	172.67.153.170
	http://bitstampweb.0532tg.com	Get hash	malicious	Unknown	Browse	172.67.133.12
	https://fin.hiringplatform.ca/processes/197662-tax-legislation-officer-ec-06-ec-07?locale=en	Get hash	malicious	Unknown	Browse	172.66.0.145
	SET_UP.exe	Get hash	malicious	LummaC	Browse	172.67.152.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	search.hta	Get hash	malicious	Unknown	Browse	104.21.66.86 92.122.104.90
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 92.122.104.90
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86 92.122.104.90
	@Setup.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 92.122.104.90
	Full_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86 92.122.104.90
	Solara.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 92.122.104.90
	0x001f00000004676d-1858.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 92.122.104.90
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 92.122.104.90
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 92.122.104.90
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.66.86 92.122.104.90

Process:	C:\Users\user\Desktop\Leside-.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Roaming\gdi32.dll

Download File

Process:	C:\Users\user\Desktop\Leside-.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	639488
Entropy (8bit):	7.115559609311837
Encrypted:	false
SSDEEP:	12288:3gF7Se1JDl5LVaL8kZIOWhbN4ddlannT5EbJ+vMvb4Yw8kU0khJ7x:3gF7Se1JQL8ekmd+TiF
MD5:	F58AFB7B8EFFFB002935D17D85765FB4
SHA1:	2506433DC55B8B42F94B70557EF444E8D05A17DC
SHA-256:	8FC9F09B3F2424D918B5E8DDCEDE5980B6E6B356BB2E50873CF6EDA804C01886
SHA-512:	870FC5FB7AD167ABB87645D43715C6642379948CB638C7EFAD19AA5D36EE251A0B54949EF5598E30A36E6D3BCB8D6027CF27DC60EFCBEB8BC6164B2A9CDD1880
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........b.....................A..................{w....................................................Rich...........................PE..L...#.ng...........!.....d...f......D.....................................................@.............................\|...\|...P................................)..l...................................@...............T............................text...Hb.......d.................. ..`.rdata..Re.......f...h..............@..@.data...............................@....reloc...).......*..................@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.108163235877968
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Leside-.exe
File size:	651'264 bytes
MD5:	54bb85bce47c855c509a16b32970c38b
SHA1:	23c1819fbc72cf7d645c036324d85208df6c77f3
SHA256:	3ccd2f2337a264971fed13bf7b3e4ca076afde84ba7b6c681f467b5021c0923e
SHA512:	e2ba5e48db5f4a2c0d37e3d1eba259e9055bab7026c9087dd0bfe950381446bf7a213fb11334c3d975bf9cf1266e8705405f1f98fb413ae69b991d3dc371b85a
SSDEEP:	12288:4TdteaOF2UoQBsjSNtXEcVyiBFAMyhZVUEz4Pjt/ax7t2e:4ptdOG6UcVy+yhZVUEz4PAx73
TLSH:	F1D44B1F527BE209F54A007095AA327B5DB4EE69E503CCF207C4E96B6066C71EBECD12
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.ng..............0.............n@... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40406e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x676E8824 [Fri Dec 27 10:57:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
jnl 00007F6CC480DF52h
cmp cl, dl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x401c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa2000	0x664	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9e278	0x9e400	ee3ee09ff4e574e9b8bb0847fb4b05af	False	0.46996877468404424	data	7.114694614150449	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa2000	0x664	0x800	afe3080c873fefe5b82f32d13e83ea8d	False	0.35107421875	data	3.6105756444135118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa4000	0xc	0x200	5dbda4a38bd7d993b0957a10cb682415	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa2090	0x3d4	data			0.42142857142857143
RT_MANIFEST	0xa2474	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T22:29:58.577963+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	92.122.104.90	443	TCP
2024-12-27T22:29:59.375510+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49730	92.122.104.90	443	TCP
2024-12-27T22:30:01.088185+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-27T22:30:01.877190+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-27T22:30:01.877190+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-27T22:30:02.792004+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.66.86	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 22:29:57.186171055 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:57.186203957 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:57.186273098 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:57.189615965 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:57.189630985 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:58.577841043 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:58.577963114 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:58.582371950 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:58.582381964 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:58.582675934 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:58.626105070 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:58.671345949 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.375539064 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.375560999 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.375598907 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.375612020 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.375614882 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:59.375626087 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:59.375632048 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.375646114 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.375653982 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:59.375669003 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:59.375693083 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:59.553158045 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.553201914 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.553263903 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:59.553272009 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.553313971 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:59.583898067 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.583939075 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.583970070 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.584012985 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:59.584072113 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:59.587548018 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:59.587560892 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.587572098 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:29:59.587578058 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:29:59.824908018 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:29:59.824981928 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:29:59.825081110 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:29:59.825407982 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:29:59.825426102 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:30:01.088103056 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:30:01.088185072 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:30:01.090945005 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:30:01.090955019 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:30:01.091151953 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:30:01.092597961 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:30:01.092611074 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:30:01.092663050 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:30:01.877202034 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:30:01.877278090 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:30:01.877337933 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:30:01.877572060 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:30:01.877587080 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:30:01.877597094 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:30:01.877602100 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:30:01.905158997 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:30:01.905249119 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:30:01.905337095 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:30:01.905586958 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:30:01.905621052 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:30:02.792004108 CET	49732	443	192.168.2.4	104.21.66.86

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 22:29:54.827877998 CET	57470	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:29:55.065226078 CET	53	57470	1.1.1.1	192.168.2.4
Dec 27, 2024 22:29:55.068157911 CET	60883	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:29:55.297163963 CET	53	60883	1.1.1.1	192.168.2.4
Dec 27, 2024 22:29:55.301680088 CET	62493	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:29:55.652703047 CET	53	62493	1.1.1.1	192.168.2.4
Dec 27, 2024 22:29:55.655431986 CET	58107	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:29:55.882030010 CET	53	58107	1.1.1.1	192.168.2.4
Dec 27, 2024 22:29:55.883470058 CET	61243	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:29:56.113459110 CET	53	61243	1.1.1.1	192.168.2.4
Dec 27, 2024 22:29:56.116529942 CET	54120	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:29:56.332871914 CET	53	54120	1.1.1.1	192.168.2.4
Dec 27, 2024 22:29:56.336253881 CET	63012	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:29:56.569648027 CET	53	63012	1.1.1.1	192.168.2.4
Dec 27, 2024 22:29:56.572582960 CET	58760	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:29:56.785001040 CET	53	58760	1.1.1.1	192.168.2.4
Dec 27, 2024 22:29:56.787342072 CET	64110	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:29:57.015932083 CET	53	64110	1.1.1.1	192.168.2.4
Dec 27, 2024 22:29:57.018794060 CET	58477	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:29:57.165505886 CET	53	58477	1.1.1.1	192.168.2.4
Dec 27, 2024 22:29:59.597748041 CET	61164	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:29:59.824106932 CET	53	61164	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 22:29:54.827877998 CET	192.168.2.4	1.1.1.1	0x78ea	Standard query (0)	ingreem-eilish.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:55.068157911 CET	192.168.2.4	1.1.1.1	0x929e	Standard query (0)	prisonyfork.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:55.301680088 CET	192.168.2.4	1.1.1.1	0xce97	Standard query (0)	rebuildeso.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:55.655431986 CET	192.168.2.4	1.1.1.1	0x4274	Standard query (0)	scentniej.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:55.883470058 CET	192.168.2.4	1.1.1.1	0xea87	Standard query (0)	inherineau.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:56.116529942 CET	192.168.2.4	1.1.1.1	0x9ca2	Standard query (0)	screwamusresz.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:56.336253881 CET	192.168.2.4	1.1.1.1	0x40dc	Standard query (0)	appliacnesot.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:56.572582960 CET	192.168.2.4	1.1.1.1	0xa2f7	Standard query (0)	cashfuzysao.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:56.787342072 CET	192.168.2.4	1.1.1.1	0x329	Standard query (0)	hummskitnj.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:57.018794060 CET	192.168.2.4	1.1.1.1	0x88b9	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:59.597748041 CET	192.168.2.4	1.1.1.1	0xae0	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 22:29:55.065226078 CET	1.1.1.1	192.168.2.4	0x78ea	Name error (3)	ingreem-eilish.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:55.297163963 CET	1.1.1.1	192.168.2.4	0x929e	Name error (3)	prisonyfork.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:55.652703047 CET	1.1.1.1	192.168.2.4	0xce97	Name error (3)	rebuildeso.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:55.882030010 CET	1.1.1.1	192.168.2.4	0x4274	Name error (3)	scentniej.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:56.113459110 CET	1.1.1.1	192.168.2.4	0xea87	Name error (3)	inherineau.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:56.332871914 CET	1.1.1.1	192.168.2.4	0x9ca2	Name error (3)	screwamusresz.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:56.569648027 CET	1.1.1.1	192.168.2.4	0x40dc	Name error (3)	appliacnesot.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:56.785001040 CET	1.1.1.1	192.168.2.4	0xa2f7	Name error (3)	cashfuzysao.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:57.015932083 CET	1.1.1.1	192.168.2.4	0x329	Name error (3)	hummskitnj.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:57.165505886 CET	1.1.1.1	192.168.2.4	0x88b9	No error (0)	steamcommunity.com		92.122.104.90	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:59.824106932 CET	1.1.1.1	192.168.2.4	0xae0	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:29:59.824106932 CET	1.1.1.1	192.168.2.4	0xae0	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	92.122.104.90	443	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:29:58 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-27 21:29:59 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 27 Dec 2024 21:29:59 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=4b81e9edead33889589ee890; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-27 21:29:59 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-27 21:29:59 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-27 21:29:59 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.66.86	443	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:30:01 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-27 21:30:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 21:30:01 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:30:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v2rjublua6etunj0ga8ao61ced; expires=Tue, 22 Apr 2025 15:16:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EzLVikU889ILweIPlbEUVoS8nltgXKFn43wZvDqBfER%2Fb25vKfEU0OVwNm0HNZdo5bCvDSWXQwVAjhz3wNb4lTFd5buqK2xEW%2FrvihgiKEjLEuZEonPi9vU66UnKLd8IaTE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c68ce8c806a56-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1614&min_rtt=1606&rtt_var=619&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1743283&cwnd=224&unsent_bytes=0&cid=d78ab9dca999f6de&ts=800&x=0"
2024-12-27 21:30:01 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 21:30:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:29:52
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\Leside-.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Leside-.exe"
Imagebase:	0x830000
File size:	651'264 bytes
MD5 hash:	54BB85BCE47C855C509A16B32970C38B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:29:52
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:29:53
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Imagebase:	0x660000
File size:	43'016 bytes
MD5 hash:	5D1D74198D75640E889F0A577BBF31FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.4%
Total number of Nodes:	1516
Total number of Limit Nodes:	11

Executed Functions

Function 6CE143C0 Relevance: 96.0, APIs: 29, Strings: 22, Instructions: 6798nativethreadmemoryCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE(?,?,?,?,?,?,?), ref: 6CE15F99
ShowWindow.USER32 ref: 6CE15FAF
VirtualAlloc.KERNELBASE ref: 6CE167A5
CreateProcessW.KERNELBASE ref: 6CE16ED2
NtGetContextThread.NTDLL ref: 6CE16F21
NtAllocateVirtualMemory.NTDLL ref: 6CE17182
NtAllocateVirtualMemory.NTDLL ref: 6CE1751D
NtWriteVirtualMemory.NTDLL ref: 6CE17703
NtWriteVirtualMemory.NTDLL ref: 6CE17F29
NtReadVirtualMemory.NTDLL ref: 6CE18F00
NtWriteVirtualMemory.NTDLL ref: 6CE1901A
NtWriteVirtualMemory.NTDLL ref: 6CE19483
NtCreateThreadEx.NTDLL ref: 6CE197A3
NtSetContextThread.NTDLL ref: 6CE19986
NtResumeThread.NTDLL ref: 6CE1999E
CloseHandle.KERNEL32 ref: 6CE19BEB
CloseHandle.KERNEL32 ref: 6CE19C87
VirtualAlloc.KERNEL32 ref: 6CE1A001
NtAllocateVirtualMemory.NTDLL ref: 6CE1A28A
NtReadVirtualMemory.NTDLL ref: 6CE1A6B6
NtWriteVirtualMemory.NTDLL ref: 6CE1A724
NtSetContextThread.NTDLL ref: 6CE1A7DF
NtResumeThread.NTDLL ref: 6CE1A7F7
CloseHandle.KERNEL32 ref: 6CE1A876
NtWriteVirtualMemory.NTDLL ref: 6CE1A9F0
NtCreateThreadEx.NTDLL ref: 6CE1ACF3
NtSetContextThread.NTDLL ref: 6CE1AE58
NtResumeThread.NTDLL ref: 6CE1AE70

Strings

n{s, xrefs: 6CE143E0
E``r, xrefs: 6CE16EF3
ntdll.dll, xrefs: 6CE15FC9
;fV, xrefs: 6CE1938D
O|, xrefs: 6CE18194
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6CE16DD0, 6CE1A216
;fV, xrefs: 6CE1933C
8wV&, xrefs: 6CE189AE
1JYB, xrefs: 6CE1738F
`D'^, xrefs: 6CE1A1F1
+K9, xrefs: 6CE188E7
n{s, xrefs: 6CE15E38
O|, xrefs: 6CE18120
D, xrefs: 6CE1ADA1
@, xrefs: 6CE1A282
cMI., xrefs: 6CE194E9
#q1, xrefs: 6CE19882
kernel32.dll, xrefs: 6CE15FB5
3Ar, xrefs: 6CE18352
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6CE16E54
Z<:T, xrefs: 6CE18828
MZx, xrefs: 6CE15FDD, 6CE15FF9

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: Virtual$Memory$Thread$Write$Context$AllocateCloseCreateHandleResume$AllocReadWindow$ConsoleProcessShow
String ID: #q1$+K9$1JYB$3Ar$8wV&$;fV$;fV$@$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$D$E``r$MZx$O|$O|$Z<:T$`D'^$cMI.$kernel32.dll$ntdll.dll$n{s$n{s
API String ID: 3246816769-1326680750
Opcode ID: da7d8ec627540317e26ee1c4a592d11688819b117496f8077d3c6eed0cb98c6f
Instruction ID: c311da6d9f8471c61b47d233761e3d1fddb22465732d11b38dac491a37885d0b
Opcode Fuzzy Hash: da7d8ec627540317e26ee1c4a592d11688819b117496f8077d3c6eed0cb98c6f
Instruction Fuzzy Hash: C4C30632B482118FDB14DE3CC9A57E97BF2AB47354F204299D519DBB94D7398A8ACF00

Function 6CE0D910 Relevance: 57.1, APIs: 21, Strings: 10, Instructions: 2857memoryfileCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 6CE0E679
GetModuleHandleA.KERNEL32 ref: 6CE0E6BD
MapViewOfFile.KERNELBASE ref: 6CE0EF4C
VirtualProtect.KERNELBASE ref: 6CE0F475
VirtualProtect.KERNELBASE ref: 6CE0F957
CloseHandle.KERNELBASE ref: 6CE0FAC3
CloseHandle.KERNEL32 ref: 6CE0FC6E
CloseHandle.KERNEL32 ref: 6CE0FC82
CloseHandle.KERNEL32 ref: 6CE0FE48
VirtualProtect.KERNEL32 ref: 6CE0FF4E
CloseHandle.KERNEL32 ref: 6CE1023B
CloseHandle.KERNEL32 ref: 6CE1035B
CloseHandle.KERNEL32 ref: 6CE1036F
CloseHandle.KERNEL32 ref: 6CE1038D
VirtualProtect.KERNEL32 ref: 6CE103E7

Strings

7'F}, xrefs: 6CE0E724
,\*, xrefs: 6CE0FCE0
$r: , xrefs: 6CE0E7FA
`P*, xrefs: 6CE0F7EC
!R, xrefs: 6CE101B6
@, xrefs: 6CE103DB
$r: , xrefs: 6CE0E87B
CW@, xrefs: 6CE0F5E4
`P*, xrefs: 6CE0F741
7'F}, xrefs: 6CE0E79A

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: Handle$Close$ProtectVirtual$CurrentFileModuleProcessView
String ID: !R$$r: $$r: $,\*$7'F}$7'F}$@$CW@$`P*$`P*
API String ID: 2333136242-1908103862
Opcode ID: 7c6591845d91765d7fe8c1b195f25895ec2ee54e1ef775363375ca138cb52f49
Instruction ID: 852a47e7d5de276215e3ef4095e725008afbf212f033098f120ee7930632b11c
Opcode Fuzzy Hash: 7c6591845d91765d7fe8c1b195f25895ec2ee54e1ef775363375ca138cb52f49
Instruction Fuzzy Hash: D0231C36B042188FCB04CE7CD9C53DE7BF2AB47314F209169D449DBB95C63A8A9ACB45

Function 6CE12B10 Relevance: 17.3, APIs: 4, Strings: 5, Instructions: 1535COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?), ref: 6CE1320A
GetModuleHandleW.KERNEL32 ref: 6CE13CD6

Strings

!', xrefs: 6CE13FFF
bgq\, xrefs: 6CE1351A
!', xrefs: 6CE139DE
ntdll.dll, xrefs: 6CE131FE, 6CE13CCA, 6CE13F91
NtQueryInformationProcess, xrefs: 6CE13212, 6CE13CDE, 6CE13FA5

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: HandleModule
String ID: !'$!'$NtQueryInformationProcess$bgq\$ntdll.dll
API String ID: 4139908857-2990651319
Opcode ID: d97321eb497f3e8ee9a3358e8accaaf424abe337e77a85c0ce7f2b9091e30025
Instruction ID: fd17d136c74cffa2f5c2586a1acc1febad6e16ca1e90a7368a111c237997ea7c
Opcode Fuzzy Hash: d97321eb497f3e8ee9a3358e8accaaf424abe337e77a85c0ce7f2b9091e30025
Instruction Fuzzy Hash: 47B2F136B481058FCF08DE7CD5D53CE7BF2AB87358F25951AD421DBB94C62A8A0E8B41

Function 6CE3C15E Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CE3C1A5
___scrt_uninitialize_crt.LIBCMT ref: 6CE3C1BF

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 0a4ec3420e419eeecbb6019dc91c86e51c76a1df266d656982f16a0a9ca96fc0
Instruction ID: bf7ac00fa2cd7214002f6b802760937fc041e975e0819cabe85c827e07e7bf00
Opcode Fuzzy Hash: 0a4ec3420e419eeecbb6019dc91c86e51c76a1df266d656982f16a0a9ca96fc0
Instruction Fuzzy Hash: 8541C372F01634EADB10AF95CC40BAE3A74EF456A8F30535AE81DA7B40C730E945DB94

Function 6CE3C20E Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6CE3C24B
dllmain_crt_dispatch.LIBCMT ref: 6CE3C262
dllmain_raw.LIBCMT ref: 6CE3C2AA
dllmain_crt_dispatch.LIBCMT ref: 6CE3C2BD
dllmain_raw.LIBCMT ref: 6CE3C2D0

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 8f0e7a90c88d582a2df1d3482f2c18908ab2fca5040313b6182983b232bfa6ea
Instruction ID: d78ca74b0bbfa3139a1267c5760f6b5507699d647227b4f182949d3862022590
Opcode Fuzzy Hash: 8f0e7a90c88d582a2df1d3482f2c18908ab2fca5040313b6182983b232bfa6ea
Instruction Fuzzy Hash: FA218272F01635EACB21AE95CC40AAE3A79EB8579CB315359F81D5BB10C330ED41CB94

Function 6CE3C057 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CE3C0A4

Part of subcall function 6CE3C573: InitializeSListHead.KERNEL32(6CE9BC50,6CE3C0AE,6CE4D8C0,00000010,6CE3C03F,?,?,?,6CE3C267,?,00000001,?,?,00000001,?,6CE4D908), ref: 6CE3C578

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CE3C10E

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: e215b8e3734d52f67f0b1274002137c2053cc50ad7d880d654f27d2186478812
Instruction ID: c47b27de15db57729bc8cd2895ca4ce970a01e057dd8240f27118735f9438d1f
Opcode Fuzzy Hash: e215b8e3734d52f67f0b1274002137c2053cc50ad7d880d654f27d2186478812
Instruction Fuzzy Hash: 6221CF327042719EDB107BB898007D937719F0636CF30664FD49967B82CB26B188D6A5

Function 6CE4075E Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6CE404C9,00000001,00000364,FFFFFFFF,000000FF,?,00000001,6CE40750,6CE4068D,?,?,6CE3FB79), ref: 6CE4079F

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: deb0401446ca4138d27dafcaf3466e23af74e0cb587ae0fe2f49720afa388feb
Instruction ID: 2b5cb2b41a894982b68e7a684c4c1b8b9659782e650aacc7f5351c8b2c03f763
Opcode Fuzzy Hash: deb0401446ca4138d27dafcaf3466e23af74e0cb587ae0fe2f49720afa388feb
Instruction Fuzzy Hash: C2F0BB3164176456BB117A26AC4CE4B3F749F5277DF34C135E818D7E80CB24D4018DA2

Non-executed Functions

Function 6CE0C260 Relevance: 12.3, Strings: 9, Instructions: 1058
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`v@, xrefs: 6CE0D18E
ocdxlonrhtobxzbmmppsktncfvbqheqvmuejpgo, xrefs: 6CE0CA0E
ppzlpxpapvbtobg, xrefs: 6CE0C316
uyepcskxzkmblyhryyxanwlmrjrrk, xrefs: 6CE0C773, 6CE0CD69, 6CE0D047, 6CE0D328
iblaixcqzyyfwfwsdkbrquxethcjibvfcosihbjyemckfoeqatmfsktjmjaiznspbxg, xrefs: 6CE0C32A
argpgaiejngngggrjecearrbcrarkev, xrefs: 6CE0C8E5, 6CE0D0AA
qejqyjepcouskwewghglymcuckfthzk, xrefs: 6CE0C2FF
laqxkqcpfyvpakmoyctaiwbatatssaylldhvrbchranhq, xrefs: 6CE0C9F7
gswg, xrefs: 6CE0C8FC, 6CE0D0C4

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: `v@$argpgaiejngngggrjecearrbcrarkev$gswg$iblaixcqzyyfwfwsdkbrquxethcjibvfcosihbjyemckfoeqatmfsktjmjaiznspbxg$laqxkqcpfyvpakmoyctaiwbatatssaylldhvrbchranhq$ocdxlonrhtobxzbmmppsktncfvbqheqvmuejpgo$ppzlpxpapvbtobg$qejqyjepcouskwewghglymcuckfthzk$uyepcskxzkmblyhryyxanwlmrjrrk
API String ID: 0-1589591847
Opcode ID: 5b874f38eff1c985e1465bdbdf8798653018fd708ceeee2ca5f846d62727a81d
Instruction ID: 48569bdba6a7469b407e333e3a3ecefd4f6cae502c6aae7543babef2e50d1200
Opcode Fuzzy Hash: 5b874f38eff1c985e1465bdbdf8798653018fd708ceeee2ca5f846d62727a81d
Instruction Fuzzy Hash: B2A29BB0A102448FEB04EF68C999B9EBBF1BB06308F158198C4199F762D7759C59CFD2

Function 6CE33150 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 498
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@wl`Ql, xrefs: 6CE335F3, 6CE337BD, 6CE3380F
,uH/, xrefs: 6CE3356A
,uH/, xrefs: 6CE337E8
tj'}, xrefs: 6CE336C3
tj'}, xrefs: 6CE33565

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: ,uH/$,uH/$@wl`Ql$tj'}$tj'}
API String ID: 0-3315678848
Opcode ID: 8864e22e5bb9581ed41ab36cfe6d77c1cdf5aa78d05e00b194bbbb9148019c25
Instruction ID: 3f7d8653119978d75f9671bcd6f36b87e05561df8ca22b4ee86a0132793afeb4
Opcode Fuzzy Hash: 8864e22e5bb9581ed41ab36cfe6d77c1cdf5aa78d05e00b194bbbb9148019c25
Instruction Fuzzy Hash: 4CF10472B441218FDF04CE7CD5957DE77F2AB47358F20621AD919EB784C22AA90BCB05

Function 6CE10440 Relevance: 9.0, Strings: 5, Instructions: 2701COMMON

Download Yara Rule

Strings

sO(&, xrefs: 6CE11FA6
i`+-, xrefs: 6CE119C8
i`+-, xrefs: 6CE12934
sO(&, xrefs: 6CE1208C
+j-v, xrefs: 6CE12626

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: +j-v$i`+-$i`+-$sO(&$sO(&
API String ID: 0-4217193815
Opcode ID: 6346de9e5d38ceab044fb8f687fce0f8cfbaab55f134e29d7315d32e89381a68
Instruction ID: 08f881086a895872b52dfff9d4ec81d70e96b54943b1dbaa0051fef43ed6155e
Opcode Fuzzy Hash: 6346de9e5d38ceab044fb8f687fce0f8cfbaab55f134e29d7315d32e89381a68
Instruction Fuzzy Hash: AA13CD36A482428FDB18CE7CC9D57CD7BF2AB57324F30911AD412DBB95C63A995A8F00

Function 6CE37C50 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 442COMMON

Download Yara Rule

Strings

d"D`, xrefs: 6CE38145
@wl`Ql, xrefs: 6CE38094, 6CE38218
d"D`, xrefs: 6CE381B8

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: @wl`Ql$d"D`$d"D`
API String ID: 0-2129895665
Opcode ID: a59fc45cd1ae2ddc2e2c0326697c6d1c12bf3b398faf4087e07fc03d163cf323
Instruction ID: 502e14313d486772619a035b6750b107711b06a0dddc38703d71e381b7a7eb01
Opcode Fuzzy Hash: a59fc45cd1ae2ddc2e2c0326697c6d1c12bf3b398faf4087e07fc03d163cf323
Instruction Fuzzy Hash: 57E10472B406218FDF04CD7CC5953EE77F2AB87324F30661B9929EBB94C22A954AC740

Function 6CE2FA80 Relevance: 7.3, Strings: 4, Instructions: 2283COMMON

Download Yara Rule

Strings

eS6{, xrefs: 6CE3079F
o~$p, xrefs: 6CE3048F
D<, xrefs: 6CE3037D
OtqW, xrefs: 6CE3151B

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: D<$OtqW$eS6{$o~$p
API String ID: 0-2376022101
Opcode ID: bcb91609f3c4c6161261bf05c2af6d7b9ef30dae2c61c09d7fc335ba683fa09e
Instruction ID: d6624dd74c1b4b6e1f65ae95ee79023d354df56da0f09e92f8c4b8b3aa81f8a3
Opcode Fuzzy Hash: bcb91609f3c4c6161261bf05c2af6d7b9ef30dae2c61c09d7fc335ba683fa09e
Instruction Fuzzy Hash: 05F2E436B541218FDB089EBCD9E53DE77F2AB47365F30621AD815DBB94C12A980BCB01

Function 6CE3ED7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6CE3EE74
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CE3EE7E
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6CE3EE8B

Strings

,(l, xrefs: 6CE3ED7E

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: ,(l
API String ID: 3906539128-2418728688
Opcode ID: 33fd09247d84080e56209ad2888bc5a69edd478a83c5f0ae1765161fc2a45a15
Instruction ID: 6b48da007c299e9f9588b9660f8466fe61e2e42ade3f7fbfcc165bdb9570d67b
Opcode Fuzzy Hash: 33fd09247d84080e56209ad2888bc5a69edd478a83c5f0ae1765161fc2a45a15
Instruction Fuzzy Hash: C231B37591122C9BCB21DF65D9887CDBBB8BF08714F6052DAE41CA7290E770AB85CF84

Function 6CE28A80 Relevance: 6.6, Strings: 4, Instructions: 1551COMMON

Download Yara Rule

Strings

p%l, xrefs: 6CE29E99
Fbl[, xrefs: 6CE2901C
p%l, xrefs: 6CE2999A
Fbl[, xrefs: 6CE28FBC

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: Fbl[$Fbl[$p%l$p%l
API String ID: 0-1171640109
Opcode ID: 145d6f647a6ac4821e9e6986c2baf714b6e1d74f5eaa8a220af7c5062765c940
Instruction ID: 53c205939e44cd5a64910bc22803e1bf06247a3e3283bb171b9989529870ff44
Opcode Fuzzy Hash: 145d6f647a6ac4821e9e6986c2baf714b6e1d74f5eaa8a220af7c5062765c940
Instruction Fuzzy Hash: 6FC2FF36B412048FDF08DEBCC5917DD7BF2AB87358F20511AE811EB798C63E990A8B01

Function 6CE3A3F0 Relevance: 6.3, Strings: 4, Instructions: 1259COMMON

Download Yara Rule

Strings

+i, xrefs: 6CE3AD51
+i, xrefs: 6CE3ADCA
'n?!, xrefs: 6CE3B0EE
'n?!, xrefs: 6CE3B50F

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: +i$+i$'n?!$'n?!
API String ID: 0-1444486995
Opcode ID: d44eccc6cdaf40f3aec2b43ddea3adcb914a2b417a5337fccdbaf512a6a6a058
Instruction ID: bbd6fbb97f914f25588b935d1a7641175d846bc51e52735ee4de9e6db0e34ae3
Opcode Fuzzy Hash: d44eccc6cdaf40f3aec2b43ddea3adcb914a2b417a5337fccdbaf512a6a6a058
Instruction Fuzzy Hash: B792D036B805209FCF08DD7CE5E53DD37F3AB43369F20A615D819DBB94D22A990ACA11

Function 6CE3C892 Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6CE3C89E
IsDebuggerPresent.KERNEL32 ref: 6CE3C96A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CE3C98A
UnhandledExceptionFilter.KERNEL32(?), ref: 6CE3C994

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 4ac392d0bdc026926186e3b8cda77752e3db3cfea0f2481e7b984d4937f2d47f
Instruction ID: 6faef713bdf915cef8dab59cc1cb2929fe95a6acbfe3d312b04ac9a91afe3466
Opcode Fuzzy Hash: 4ac392d0bdc026926186e3b8cda77752e3db3cfea0f2481e7b984d4937f2d47f
Instruction Fuzzy Hash: F4313C75E0522CDBDB21EFA0D9497CDBBB8BF04308F10519AE40DA7240EB709A85CF45

Function 6CE3B540 Relevance: 5.7, Strings: 4, Instructions: 746COMMON

Download Yara Rule

Strings

o:2, xrefs: 6CE3BB28
o:2, xrefs: 6CE3BF6A
OKV9, xrefs: 6CE3B893
OKV9, xrefs: 6CE3B81A

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: OKV9$OKV9$o:2$o:2
API String ID: 0-212562071
Opcode ID: 772c625f2a720189c0d93cb535c2265f95ec3b18cb699c2cc46aceba79ec09c3
Instruction ID: ba093edf4f40d3158b1fcc29a3ff6f2ea5bd078cf21963c36cbd48bc052d6897
Opcode Fuzzy Hash: 772c625f2a720189c0d93cb535c2265f95ec3b18cb699c2cc46aceba79ec09c3
Instruction Fuzzy Hash: 4B42D236F446118FCB08CE7CD9963DD37F2AB46355F20B116E42AD7B94C62AA90ACF14

Function 6CE1CE10 Relevance: 5.7, Strings: 4, Instructions: 673COMMON

Download Yara Rule

Strings

'Eah, xrefs: 6CE1D5CB
'Eah, xrefs: 6CE1D565
T\g9, xrefs: 6CE1D662
T\g9, xrefs: 6CE1D73A

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: 'Eah$'Eah$T\g9$T\g9
API String ID: 0-1666356655
Opcode ID: d04f7a20e575649c113968032acb6bc3d0a45e8315cebc3c4a7350c0a47b8eae
Instruction ID: 6ae58af9bb4a8b3b1033bfd01e57a45113d358e72fecef1321500f6a0195a0b8
Opcode Fuzzy Hash: d04f7a20e575649c113968032acb6bc3d0a45e8315cebc3c4a7350c0a47b8eae
Instruction Fuzzy Hash: 0C22297AB482018FCF06DE7CD5957DE7BF2AB87314F30551AD911DBF94C22A8A0A8B14

Function 6CE26D00 Relevance: 5.2, APIs: 3, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ccd646e335032556c31733cff3ff4c790017c76238295c45f36782d7402769
Instruction ID: 1a7ee2f6dc12b9e308dea3be37df38674075983df96dfa8cb75a2f118ef37b46
Opcode Fuzzy Hash: e4ccd646e335032556c31733cff3ff4c790017c76238295c45f36782d7402769
Instruction Fuzzy Hash: EC223632B502158FCF089E7CC9E53DD7BF2AB87368F306219D411EB795D62E890A8B54

Function 6CE25540 Relevance: 5.1, Strings: 3, Instructions: 1301COMMON

Download Yara Rule

Strings

o:}0, xrefs: 6CE26551
o:}0, xrefs: 6CE26503
H5Y, xrefs: 6CE26492

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: o:}0$o:}0$H5Y
API String ID: 0-3873439405
Opcode ID: 6161b07c9b01c59bcb3327a68535ae6f3491d01bd84712d4203f1ced28fad357
Instruction ID: ac757af055253840512601408646bbfde1f0d3eb2c027144148c440e383b4640
Opcode Fuzzy Hash: 6161b07c9b01c59bcb3327a68535ae6f3491d01bd84712d4203f1ced28fad357
Instruction Fuzzy Hash: 01A22536B452558FDF08CEBCD9943DD7BF6FB4B358F209619D415DBB68C22A880A8B01

Function 6CE35F50 Relevance: 4.7, Strings: 3, Instructions: 921COMMON

Download Yara Rule

Strings

h4/, xrefs: 6CE36987
@wl`Ql, xrefs: 6CE365EA
h4/, xrefs: 6CE36941

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: @wl`Ql$h4/$h4/
API String ID: 0-1029419929
Opcode ID: 0e2e56d6f0edd6d9b1badb071dc80dae7c5fd2d28d4747c8925a2394c03d2938
Instruction ID: 57e66e2bb59d0353f2249a2c7758c1c32a6f64666bc70b53c5cee3190677de3f
Opcode Fuzzy Hash: 0e2e56d6f0edd6d9b1badb071dc80dae7c5fd2d28d4747c8925a2394c03d2938
Instruction Fuzzy Hash: 1D62F032B402218FDF088E7CD5953DD37FABB47359F20A119D429DBB94C62AA90ACF15

Function 6CE3F462 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6CE3F461,?,00000001,?,?), ref: 6CE3F484
TerminateProcess.KERNEL32(00000000,?,6CE3F461,?,00000001,?,?), ref: 6CE3F48B
ExitProcess.KERNEL32 ref: 6CE3F49D

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c726f6a13ee49adfb2b2f2dc778a93c81abc3eea66c0b7a114b8119b423d4551
Instruction ID: 01e1c7020ee4ebe6f629f7173894f66e9dada034134a7c6878219328a2371db9
Opcode Fuzzy Hash: c726f6a13ee49adfb2b2f2dc778a93c81abc3eea66c0b7a114b8119b423d4551
Instruction Fuzzy Hash: C5E08631110194AFCF317F50C908A893B39EF8135AF208459F959C6A20CB39E942DF90

Function 6CE33F80 Relevance: 4.0, Strings: 3, Instructions: 295COMMON

Download Yara Rule

Strings

3#l, xrefs: 6CE34375
R<C, xrefs: 6CE340FF
R<C, xrefs: 6CE343A0

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: 3#l$R<C$R<C
API String ID: 0-522363035
Opcode ID: 122484c9c704e51bc8dba1d058ee213d9bb5616fc78226f65210aab8ecfc2353
Instruction ID: 5d44caada3c452d29dd9a5b07ec0394b3a71eac19119ec6d677841cfe0bcd830
Opcode Fuzzy Hash: 122484c9c704e51bc8dba1d058ee213d9bb5616fc78226f65210aab8ecfc2353
Instruction Fuzzy Hash: D2A1BF76B442158FCF04CE7CC8916DD7BF2BB4A318F20A51AD419EBB54C33AA905CB16

Function 6CE27620 Relevance: 3.5, Strings: 2, Instructions: 982COMMON

Download Yara Rule

Strings

O#4,, xrefs: 6CE28337
'J-B, xrefs: 6CE27EA2

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: 'J-B$O#4,
API String ID: 0-284258520
Opcode ID: 8dbc76d9df9d3b33dd2b968afbd1ea462e2d2012276e4dc9864c92c8f31376fe
Instruction ID: c360765478d52211a4d6e0a216ed3a9fa89cc31aaec8f8741ac83631b43aff65
Opcode Fuzzy Hash: 8dbc76d9df9d3b33dd2b968afbd1ea462e2d2012276e4dc9864c92c8f31376fe
Instruction Fuzzy Hash: FE621337B502058FDB088E7CD9D57DE7BF2AB47364F20561AD811EBB94C23E994A8B01

Function 6CE237B0 Relevance: 3.4, Strings: 2, Instructions: 906COMMON

Download Yara Rule

Strings

E_=H, xrefs: 6CE23BB0
E_=H, xrefs: 6CE24322

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: E_=H$E_=H
API String ID: 0-959526469
Opcode ID: a1d31a0dd8d3c1e1abf063f22fea6fcae8fecd4917a4751bcf514c899f885d11
Instruction ID: 5015dd65715668876615e149adbbd646591777ca72f252e66323e3267afe3795
Opcode Fuzzy Hash: a1d31a0dd8d3c1e1abf063f22fea6fcae8fecd4917a4751bcf514c899f885d11
Instruction Fuzzy Hash: AF521676B402018FCF08DE7CC5D53DE77F69B4B325F20961AC522DB795C22E890A8B55

Function 6CE2EBB0 Relevance: 3.3, Strings: 2, Instructions: 763COMMON

Download Yara Rule

Strings

,eq, xrefs: 6CE2F381
i/', xrefs: 6CE2F1FC

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: ,eq$i/'
API String ID: 0-874911227
Opcode ID: 17ee42644fa396b40650703f2fd9d85b98e9c3748fc16fd634365f9022eeb572
Instruction ID: 234ffdab6f0e60955f58977443435b0e2c5399f2827ff63c8f57dd0d877fa63a
Opcode Fuzzy Hash: 17ee42644fa396b40650703f2fd9d85b98e9c3748fc16fd634365f9022eeb572
Instruction Fuzzy Hash: 9842F132E446258FDF08DE7CD5957CD77F2EB07319F345215D421ABBA0CA2E990A8B81

Function 6CE20190 Relevance: 3.2, Strings: 2, Instructions: 730COMMON

Download Yara Rule

Strings

)5\l, xrefs: 6CE20AE7
)5\l, xrefs: 6CE206A6

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: )5\l$)5\l
API String ID: 0-132399245
Opcode ID: 9ad0e56ff2164cd1c949cb67b4d91ea23e61990564d2021cfac110a9b6406d1f
Instruction ID: 41d751fafb8ed3d41dc12d3f676e2f6278834e91a4c579e3f4958083ea5f4a82
Opcode Fuzzy Hash: 9ad0e56ff2164cd1c949cb67b4d91ea23e61990564d2021cfac110a9b6406d1f
Instruction Fuzzy Hash: BA32BE72B416418FDF08DE7CD5A53DE3BF2AB87325F30521AD411EBBD4D62A890A8B11

Function 6CE1EAB0 Relevance: 3.2, Strings: 2, Instructions: 709COMMON

Download Yara Rule

Strings

P(E, xrefs: 6CE1F228
P(E, xrefs: 6CE1F276

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: P(E$P(E
API String ID: 0-1669364682
Opcode ID: 40b700bfa4e690344cde4e45e93a9e13daea08aebfeed592485ff5b3100fd0d2
Instruction ID: 1018e99b0141122bc32ce0cc5189e8102f17015d0ebec2fd00c716294032948b
Opcode Fuzzy Hash: 40b700bfa4e690344cde4e45e93a9e13daea08aebfeed592485ff5b3100fd0d2
Instruction Fuzzy Hash: 323202767485418FCF089D7CC9D53EE3BF2AB87364F305119D421DBF94D22E8A0A8A90

Function 6CE1C350 Relevance: 3.2, Strings: 2, Instructions: 654COMMON

Download Yara Rule

Strings

tO,b, xrefs: 6CE1CAA7
tO,b, xrefs: 6CE1C68F

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: tO,b$tO,b
API String ID: 0-3347952807
Opcode ID: 88b3d1a2932287a8a65005b13f95ec7077889ef23a872cd45ac92400b2c9a527
Instruction ID: e6061180e45deb57308b514770620580dfa63c80a93db5d0eb72daa64f6e62ed
Opcode Fuzzy Hash: 88b3d1a2932287a8a65005b13f95ec7077889ef23a872cd45ac92400b2c9a527
Instruction Fuzzy Hash: 17320372B482058FCF08EE7CD5917DE7BF2AB4A314F20852AD412E7B54CA39990ACF55

Function 6CE2CC10 Relevance: 3.1, Strings: 2, Instructions: 624COMMON

Download Yara Rule

Strings

F, xrefs: 6CE2D271
p}i<, xrefs: 6CE2CFAB

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: p}i<$F
API String ID: 0-3465379454
Opcode ID: 025f511d8484a06f335f779b6d5618e11c1b4f99f3ef34f31542ed894486b8a6
Instruction ID: c45428debf48aee3e43b07f0db5c12930ad1078f50142f2ef72e48098a35638e
Opcode Fuzzy Hash: 025f511d8484a06f335f779b6d5618e11c1b4f99f3ef34f31542ed894486b8a6
Instruction Fuzzy Hash: 1122FB7AB502558FDF04DE7CC8D17EE77F2AB57364F20921AD915D7B90C22A990ACB00

Function 6CE21190 Relevance: 3.0, Strings: 2, Instructions: 540COMMON

Download Yara Rule

Strings

VxV, xrefs: 6CE21799
VxV, xrefs: 6CE218F6

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: VxV$VxV
API String ID: 0-1435218220
Opcode ID: 8de0db6196b6f6cd212475818b4f960401f351811eeacb1e8905a71f015398a3
Instruction ID: f160be792aa192ad622c2c4f414be3bb7f43af64fd8278f3cb022b82466d8c69
Opcode Fuzzy Hash: 8de0db6196b6f6cd212475818b4f960401f351811eeacb1e8905a71f015398a3
Instruction Fuzzy Hash: 3002E036B442098FCB08CEBCD9957EE77F2AB47315F21511AD811E7744C62F8E0A9B15

Function 6CE1E3B0 Relevance: 3.0, Strings: 2, Instructions: 517COMMON

Download Yara Rule

Strings

TF>., xrefs: 6CE1E6E5
TF>., xrefs: 6CE1E73B

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: TF>.$TF>.
API String ID: 0-2056618758
Opcode ID: 7ba0d7700c30090d689f15ea041d660065e43ca144d5de01da113ad7d89e1fd3
Instruction ID: 3525622f7fe09d9581384cae3a8e2c976151046126973d72a1ad07d9c451949f
Opcode Fuzzy Hash: 7ba0d7700c30090d689f15ea041d660065e43ca144d5de01da113ad7d89e1fd3
Instruction Fuzzy Hash: 31F12836B489118FDF089DBCC5D93DD7BF2AB8B324F345519E411E7F90D22A880A8B94

Function 6CE2A9B0 Relevance: 2.9, Strings: 2, Instructions: 407COMMON

Download Yara Rule

Strings

EhIB, xrefs: 6CE2AE14
EhIB, xrefs: 6CE2AE88

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: EhIB$EhIB
API String ID: 0-2233933190
Opcode ID: a825bf00e0a589bbc3b8eccee74d2b1abca1d6be1c3e7d5c825035b636193b55
Instruction ID: d2ed4db388b29c95d02c59465f064e3de3b398dd41f3c2c9b443f5f94a5a12bb
Opcode Fuzzy Hash: a825bf00e0a589bbc3b8eccee74d2b1abca1d6be1c3e7d5c825035b636193b55
Instruction Fuzzy Hash: BFE1C076B842058FDF04DEBCD5953DE7BF2AB4A318F209519E421EB791C22E990ACF50

Function 6CE2AF30 Relevance: 2.9, Strings: 2, Instructions: 372COMMON

Download Yara Rule

Strings

7!u, xrefs: 6CE2B1A7
7!u, xrefs: 6CE2B228

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: 7!u$7!u
API String ID: 0-2406978722
Opcode ID: 046d24205f7fa3ecfeb53e17ed651f21ffdedec6a5dca96d0344b4a9003f6307
Instruction ID: 130d10c7a23859b61a7f135694cb5f148b6f8bc4c6da42d062a63601ab3b7576
Opcode Fuzzy Hash: 046d24205f7fa3ecfeb53e17ed651f21ffdedec6a5dca96d0344b4a9003f6307
Instruction Fuzzy Hash: D5C1F376F442458FCF04CE7CC5957DE7BF2AB4B354F208116D822EB790D62E890A8B1A

Function 6CE1F470 Relevance: 2.9, Strings: 2, Instructions: 364COMMON

Download Yara Rule

Strings

iK6;, xrefs: 6CE1F932
iK6;, xrefs: 6CE1F7BB

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: iK6;$iK6;
API String ID: 0-4052201937
Opcode ID: 2a7e2ced7e14b7eaec19846f6abb46c5718e4e0335511ec59b1f0cb883ada530
Instruction ID: e43f5b853ffac073daa3c0a9be76a31574b7a5162fb905365f9f75d64e49fbe4
Opcode Fuzzy Hash: 2a7e2ced7e14b7eaec19846f6abb46c5718e4e0335511ec59b1f0cb883ada530
Instruction Fuzzy Hash: 15C1E576B581058FDF049E7CC9D53EE3BF2A747365F20A21AC425A7F94C12E851A8B90

Function 6CE01020 Relevance: 2.9, Strings: 2, Instructions: 356COMMON

Download Yara Rule

Strings

bmnvidjapmuqvqlivxazircppbjomunmxpjyeiwubtphnmhendbjxyloyarbch, xrefs: 6CE013E4, 6CE014C7
6b2, xrefs: 6CE01355

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: 6b2$bmnvidjapmuqvqlivxazircppbjomunmxpjyeiwubtphnmhendbjxyloyarbch
API String ID: 0-219893035
Opcode ID: 3f959435ee09d974f98c4c3aa064a09ae2ffa86d8cfb04a92f0c7c2d2b92fa98
Instruction ID: 1310abf0519a7654ad85d1f2e0fc7ff08f4a5f1df4c643585d26351ae96cd0d0
Opcode Fuzzy Hash: 3f959435ee09d974f98c4c3aa064a09ae2ffa86d8cfb04a92f0c7c2d2b92fa98
Instruction Fuzzy Hash: 42C1AE32304B418FC724DE7CC5946877BF2BB46358B205A1ED896CBFA1D725E81ACB85

Function 6CE38260 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

O2Iu, xrefs: 6CE38461
a*6, xrefs: 6CE38412

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: O2Iu$a*6
API String ID: 0-2619040148
Opcode ID: a5006abd449e5750f2990cdd277398e3d9822e562ebbbe58a42ea483cea04db2
Instruction ID: e312140016181c6814694dcfedade8e6ca3867df3c1160b7ff33fef2af5a4ad3
Opcode Fuzzy Hash: a5006abd449e5750f2990cdd277398e3d9822e562ebbbe58a42ea483cea04db2
Instruction Fuzzy Hash: 6E711432A445158FDF04CE7CC6907EE7BF2AB47318F30A11BD415EBB51C226AA0ACB61

Function 6CE29F90 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

0\7, xrefs: 6CE2A2B4
0\7, xrefs: 6CE2A23D

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: 0\7$0\7
API String ID: 0-2815222538
Opcode ID: 54a5315f750ea9f6197fd3a1dca65b97433390dc9a727ac201c773a0e6ef30e5
Instruction ID: 900050bcf8706ec71d2ac27f9bd0308c93d5cc29881ed65c1ed9880019f797d0
Opcode Fuzzy Hash: 54a5315f750ea9f6197fd3a1dca65b97433390dc9a727ac201c773a0e6ef30e5
Instruction Fuzzy Hash: 7E71D473B852068FDF08CEBCC6C57EE7BF2AB43348F209416A415D7B59D52E890A8B51

Function 6CE39420 Relevance: 2.4, Strings: 1, Instructions: 1173COMMON

Download Yara Rule

Strings

DBhH, xrefs: 6CE39E03

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: DBhH
API String ID: 0-2467258837
Opcode ID: 5469e856aeadf43bd0eb54c1d36101d2f4502ea589662d7a32c6fd9f52f0be77
Instruction ID: 8d66a75566a6b1a3f75044d131c291bb2e3c38461a927872a8fdf0b994c08b47
Opcode Fuzzy Hash: 5469e856aeadf43bd0eb54c1d36101d2f4502ea589662d7a32c6fd9f52f0be77
Instruction Fuzzy Hash: 3982D036B442118FCF08CEBCD5E57DD77F2EB87315F24A119E8199B794C62AA90ACB40

Function 6CE21920 Relevance: 2.4, Strings: 1, Instructions: 1141COMMON

Download Yara Rule

Strings

C<*, xrefs: 6CE22156

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: C<*
API String ID: 0-2991917769
Opcode ID: 6263dd93cf6bb057c4e7c1619b08d1ef32a32357da4e70722225cc87a67c9990
Instruction ID: ea4139aa99752ceabb5651d75f3babd0262d2d15835217b0ba0b71c7dba7a1b5
Opcode Fuzzy Hash: 6263dd93cf6bb057c4e7c1619b08d1ef32a32357da4e70722225cc87a67c9990
Instruction Fuzzy Hash: D7822236B551008FDB08CEBCC9993ED77F2AB57364F74611AD415EBB54C22E9E0AAB00

Function 6CE31FF0 Relevance: 1.9, Strings: 1, Instructions: 614COMMON

Download Yara Rule

Strings

bad array new length, xrefs: 6CE32322

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: bad array new length
API String ID: 0-1242854226
Opcode ID: ff5b7a5e4b9fc0013f745ef343572d6a8f9b0a10df53d461fbb43375efd0073c
Instruction ID: f40d38cbce4313ad2a8d49aa3b6ebd4f3cdc5f7364ed306942da2d23a8720031
Opcode Fuzzy Hash: ff5b7a5e4b9fc0013f745ef343572d6a8f9b0a10df53d461fbb43375efd0073c
Instruction Fuzzy Hash: 3D120436F442118FCF04DE7CC9993DE3BF2AB57358F30A11AD4659B795C22A5A0ACB90

Function 6CE2C440 Relevance: 1.8, Strings: 1, Instructions: 569COMMON

Download Yara Rule

Strings

_k, xrefs: 6CE2CB90

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: _k
API String ID: 0-1815099553
Opcode ID: b159df2a1cbb55244e6811fe5056e808e83cab673d7e85ee134f3c47c98d6cda
Instruction ID: f6b58db13a91749a753b203a638cfafc2bd38546d465059035007cc1dd64720d
Opcode Fuzzy Hash: b159df2a1cbb55244e6811fe5056e808e83cab673d7e85ee134f3c47c98d6cda
Instruction Fuzzy Hash: C812D076B801058FEB04EE6CD5D63DD7BF2AB4B324F34651AD411EB794C22EC84A8B50

Function 6CE2B450 Relevance: 1.8, Strings: 1, Instructions: 562COMMON

Download Yara Rule

Strings

UVL, xrefs: 6CE2B999

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: UVL
API String ID: 0-1545186319
Opcode ID: 82f39d32e3afa40df08a21f3ad57af9485866264d2689ea0460a7477cba00e19
Instruction ID: 550df0d8fed3e32dffc6649e1472af813c95b69b95f76c7ab3330389d7c9138c
Opcode Fuzzy Hash: 82f39d32e3afa40df08a21f3ad57af9485866264d2689ea0460a7477cba00e19
Instruction Fuzzy Hash: 8512CE36F642058FCB04CE7CD9D5BDD7BF2AB46315F305219E812DB794D22E990A8B11

Function 6CE46A51 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6CE46A4C,?,?,00000008,?,?,6CE466E4,00000000), ref: 6CE46C7E

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 422e1507489a5da9031f0d3f328eb625f266a9313e5ffb790fa3c4d48cd93a57
Instruction ID: 34e76f4e90923bdc43aa1ebf93d2d5bac6430edc6979b2192e3d1e16b362552d
Opcode Fuzzy Hash: 422e1507489a5da9031f0d3f328eb625f266a9313e5ffb790fa3c4d48cd93a57
Instruction Fuzzy Hash: 55B103316216088FDB05CF28D486B997BB4FB45369F35C658E8A9CF6A1C335E992CB40

Function 6CE0D370 Relevance: 1.7, Strings: 1, Instructions: 434COMMON

Download Yara Rule

Strings

*-4, xrefs: 6CE0D695

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: *-4
API String ID: 0-880298536
Opcode ID: c9c8f25bc80684a0caa83e968a005f3675930176e946998f13f3686e60a6f781
Instruction ID: 6695c43a315002a44ecdac4ae1ee7ffb11cece9e969d32bcc9e466e4e7ee2bf2
Opcode Fuzzy Hash: c9c8f25bc80684a0caa83e968a005f3675930176e946998f13f3686e60a6f781
Instruction Fuzzy Hash: ADD1073AB442418FCF04CE7CC5953DE7BF2AB47325F349115D821E77A8C72A9A1A8B64

Function 6CE26780 Relevance: 1.7, Strings: 1, Instructions: 408COMMON

Download Yara Rule

Strings

J>#, xrefs: 6CE26AFE

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: J>#
API String ID: 0-3736109351
Opcode ID: 82f5f1bb94a9a9135cb619e0668f5e156fb44c07685679271637768b83629a06
Instruction ID: f210fe422a094b2b94ef801af2b79bf26eed98c742800c3a87a3c92654838a8c
Opcode Fuzzy Hash: 82f5f1bb94a9a9135cb619e0668f5e156fb44c07685679271637768b83629a06
Instruction Fuzzy Hash: C8D1E436F455428FCF089D7CC5953EE77FAAB43364F3093268825DB794D12E4A0A8B91

Function 6CE3CA58 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CE3CA6E

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 93a05c50ec47d9a7e96f4301acde4f45b15949a8ffaa0928fb9964dfba50c20a
Instruction ID: acfc7ae518612a952000449d818eae78e9c1c8098ee380a7a18319437a65b31a
Opcode Fuzzy Hash: 93a05c50ec47d9a7e96f4301acde4f45b15949a8ffaa0928fb9964dfba50c20a
Instruction Fuzzy Hash: 3A515FB1F012298BEB24DF59C58179AB7F0FB49318F20896AD419EB740E775E940CB50

Function 6CE40B60 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ddd0c17f81f45856ef9bd496d22b5f4d63651fac125964b470dcf9279261af0
Instruction ID: 7dd579d443238daf08d797e376df4149670f78b217cc853d1770fcc10dec09da
Opcode Fuzzy Hash: 2ddd0c17f81f45856ef9bd496d22b5f4d63651fac125964b470dcf9279261af0
Instruction Fuzzy Hash: 1E41A471804258AFDF10DF69DC88AEABBB8AF55308F2442EDE41DD3600D6349A858F50

Function 6CE1F970 Relevance: 1.6, Strings: 1, Instructions: 376COMMON

Download Yara Rule

Strings

<Am, xrefs: 6CE1FB88

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: <Am
API String ID: 0-446091913
Opcode ID: 771f6008a9bd038fd4723138c144c7d9c2b3d2729a9ad79d46f5d57d670c2ffd
Instruction ID: 4c709e0129c58a39f8489eb4516d3f90ca14c466813e9df74fd77b8e9662b16e
Opcode Fuzzy Hash: 771f6008a9bd038fd4723138c144c7d9c2b3d2729a9ad79d46f5d57d670c2ffd
Instruction Fuzzy Hash: 3BC1BD76B481068FCB08DE7CC6943DE7BF3AB87358F249516D411E7F45D22E8A0A8B91

Function 6CE37740 Relevance: 1.6, Strings: 1, Instructions: 368COMMON

Download Yara Rule

Strings

.4o, xrefs: 6CE37B41

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: .4o
API String ID: 0-347971548
Opcode ID: 744a6902d898360aa609404636f974db79014712558586092522d5c03a2f791f
Instruction ID: b4496e86e720d8293a8b43fb4efe397334833aec8f190142c6c95ee3c5984401
Opcode Fuzzy Hash: 744a6902d898360aa609404636f974db79014712558586092522d5c03a2f791f
Instruction Fuzzy Hash: 6BD1EF72E44225DFCF08CE7CD6D57CD7BF2AB4A314F216219E819EBB50C629A906CB04

Function 6CE14050 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

u%jd, xrefs: 6CE140AE

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: u%jd
API String ID: 0-2532191701
Opcode ID: 6478028c7b896438ca8021deb2ae26535ffded37ae1cc7749ff04033564e1174
Instruction ID: 829b96ae87eda3dcc3802e03c62dcd2571f2e5f4d602d2108bebf9771a8b2c9c
Opcode Fuzzy Hash: 6478028c7b896438ca8021deb2ae26535ffded37ae1cc7749ff04033564e1174
Instruction Fuzzy Hash: BB81E272F081158FCB04CE7CD9917DEBBF1BB4A328F20461AE521EBB94C6359D068B95

Function 6CE1D750 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f210e43f66e96e82f5c8a73cd913ddaf4539e2d4bfb305ee9209278c9a8211f
Instruction ID: a148ca9451b95c4d423577ebf3de1c024628b47200e512b1506aeb52007cfecc
Opcode Fuzzy Hash: 6f210e43f66e96e82f5c8a73cd913ddaf4539e2d4bfb305ee9209278c9a8211f
Instruction Fuzzy Hash: D762DF76B496048FCF08DEBCD5D93DE7BF2AB47314F245519E812DBF94C22A891A8B40

Function 6CE38580 Relevance: .6, Instructions: 575COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a8bba87fba59b83baf62b40ce9d927dc37985ee10c2660ad373f50a11e5606
Instruction ID: b5c0872d4206ee2bca0cd35ae2f0d1df65fa726140b3cef14db28dca192db2b4
Opcode Fuzzy Hash: e3a8bba87fba59b83baf62b40ce9d927dc37985ee10c2660ad373f50a11e5606
Instruction Fuzzy Hash: 7C12A176B406158FCF08CE7CD5953CD7BF2AB57324F20A617D829EB790C62A690ACB04

Function 6CE283E0 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95f1a295eccd5c5494358330f2a6455fe195c443ae2b76a426b4bcd4bdb05c8b
Instruction ID: 5845a743c72da00d4a63ed62cef142a5216f0ac311ab9b778fcd94ca3cc457de
Opcode Fuzzy Hash: 95f1a295eccd5c5494358330f2a6455fe195c443ae2b76a426b4bcd4bdb05c8b
Instruction Fuzzy Hash: 6B02EF77B512048FCF18CE7CD5953DE77F2AB4B358F30A11AE851EB794C62A990A8B40

Function 6CE2A2D0 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0654a5f370ec69cce07496b8c311c17c0e98ad068256d8701c888fd926ea7b
Instruction ID: abad153bb7ce1b4ef70ebfa077aaaefa4ded5db6a0ef0202752451d54776af34
Opcode Fuzzy Hash: 4e0654a5f370ec69cce07496b8c311c17c0e98ad068256d8701c888fd926ea7b
Instruction Fuzzy Hash: AB02E072B802458FCB08DEBCE9957ED7BF2AB4B314F209529E801EB754D63D9909CB41

Function 6CE24F60 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f59e8accfb8812907394a99f3fcdb4a2a51db1510d01a5597a2d9e8ee26f88e
Instruction ID: a3be76d1c4a213c04c775c3b18123cbd0aeec17fa48d41376c2fb19187a1399e
Opcode Fuzzy Hash: 7f59e8accfb8812907394a99f3fcdb4a2a51db1510d01a5597a2d9e8ee26f88e
Instruction Fuzzy Hash: 80D12972B825124FCF04DDBCC6953EE77F29B43325F309516D425D7B98D22E850A8B51

Function 6CE24660 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b400e316ecd6162a5bb3848f5beeba29bdcc8a200b3018149ce29a95769052bf
Instruction ID: c8a6622a2acea71bc55f6a33de08b8dec82d42d587df552c8538d5bd11f7a2d5
Opcode Fuzzy Hash: b400e316ecd6162a5bb3848f5beeba29bdcc8a200b3018149ce29a95769052bf
Instruction Fuzzy Hash: 7AC10636B555168FCB089E7CC5D53EE37F29B83329F30A117D825DBB94C22E890A8B05

Function 6CE22CC0 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593a06440b8b8bb03fc9eb277904cf59f89bbe2120bd608891980aa093887117
Instruction ID: ef2ed8f46052dbba20d6f734ce6dc4a4c07785bca4020325999ca159ebcab501
Opcode Fuzzy Hash: 593a06440b8b8bb03fc9eb277904cf59f89bbe2120bd608891980aa093887117
Instruction Fuzzy Hash: 8AC13773B902018FDF089E7CC8D93EE7BF6AB97329F30551AD4119BB94C52E450A8B50

Function 6CE38EF0 Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a53329dd04ad6461b7899dc5a4305a8861dbe3b46d831a6fc645072afd9c6b
Instruction ID: feca2a5f366f9080066324c83c1d2459f3cb8455714eb07b085f96e53920625b
Opcode Fuzzy Hash: d9a53329dd04ad6461b7899dc5a4305a8861dbe3b46d831a6fc645072afd9c6b
Instruction Fuzzy Hash: 24C11476A412558FCF04DE7CD5C12DD7BF2AB86314F34E11AE818E7784DA3AA90ACB05

Function 6CE2F650 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25bfb810cb0d44238342f6705b06d5b84533a1ebfae203affb69f3d5954bfd2b
Instruction ID: 2ec4fbfbd656c9b8e5c10d74f64706b374b02361f4646042a8f11e702528d94a
Opcode Fuzzy Hash: 25bfb810cb0d44238342f6705b06d5b84533a1ebfae203affb69f3d5954bfd2b
Instruction Fuzzy Hash: 16A13676F402158FDF08DEBCC6A57DE7BF1EB4B324F20911AD411AB794D22E490A8B64

Function 6CE31C00 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed3ec38347301b472551542911c5162bc0fe0e6b93f500892213662d041530b
Instruction ID: beefe000ebc21f6f2b22053a64ed7a8c319745fb7c770415bba4290674d63112
Opcode Fuzzy Hash: 2ed3ec38347301b472551542911c5162bc0fe0e6b93f500892213662d041530b
Instruction Fuzzy Hash: 77911A36B442158FCF089EBCC8963EE7BF29B43359F20651DD4199BB85C62AE50BC741

Function 6CE20DB0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008ae45dd8cf19c7f93f18edbe391470138628ad89ba72c8f04d117140ebfda5
Instruction ID: 05f2b08656fecb1289e00d66e56097d0dcd766d3d813d840ae28aa61b35fa307
Opcode Fuzzy Hash: 008ae45dd8cf19c7f93f18edbe391470138628ad89ba72c8f04d117140ebfda5
Instruction Fuzzy Hash: 71910436B441468FDF08CEBCC5957EE77F2AB4B318F209115D421ABB94C22E8E4ACB51

Function 6CE231C0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de52675c1349042e202b376ab4f9a9faa0f4add266c9dcfd619f5e0e2f73283
Instruction ID: e4af564c23b0b7efb3e567b9d2590cb5fa894abbe6cefb24b50929cdc6a99333
Opcode Fuzzy Hash: 4de52675c1349042e202b376ab4f9a9faa0f4add266c9dcfd619f5e0e2f73283
Instruction Fuzzy Hash: E691F236B842158FCF049EBCC9D53EE77F6AB47364F30511AC8259BBA4C52D890A8F41

Function 6CE32D80 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e515a2633873dcfb42eb9ceb80ceee730fa79923d7751641bc65d3cbc3d99b6
Instruction ID: bb7a5b382064a097ccddcba4bc589f0f043cebb33fe7feb7df14719ce0a691df
Opcode Fuzzy Hash: 9e515a2633873dcfb42eb9ceb80ceee730fa79923d7751641bc65d3cbc3d99b6
Instruction Fuzzy Hash: A0910477A442158FCB04DEBCC5967DE7BF2AB56344F30611AD814E7784C23AAA4ACB81

Function 6CE24BB0 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4d9c0a71400706d52af23c3d0fc79ea0e2e389a064cab664be6cf6fcdfa24c
Instruction ID: d2fe0fc728a347d33a871a612509fa4757b56bccc886987b5723e1b727a7e3d5
Opcode Fuzzy Hash: 3b4d9c0a71400706d52af23c3d0fc79ea0e2e389a064cab664be6cf6fcdfa24c
Instruction Fuzzy Hash: FC91D532B402168FDF049E7CC9953EE77F5AB87355F20A116D425EB784C63E850A8F51

Function 6CE2D610 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004031851c0c557bf178262dcb9a61e1b34e59f4523caaaa5f738b588f1cc14c
Instruction ID: 79c0624dff2ea01acac980d2eb8a467ad64d4054d594e35a984b5b24800917cf
Opcode Fuzzy Hash: 004031851c0c557bf178262dcb9a61e1b34e59f4523caaaa5f738b588f1cc14c
Instruction Fuzzy Hash: 0E81247AB811468FCF04CE7CC5953EE3BF2AF47364F20A1169525DBB94C12E8A0ACB45

Function 6CE2C0A0 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f092f454400ec802f591578fe348ad10f7b7ead6a29db22f12b3b186825f69
Instruction ID: 1913721d1c16a8fdabe9b2b4770ce33e5a15da69392391e9f3321ce809f5c645
Opcode Fuzzy Hash: 28f092f454400ec802f591578fe348ad10f7b7ead6a29db22f12b3b186825f69
Instruction Fuzzy Hash: 1181DF36B401458FEB04EEBCD9867EE77F2AB4B358F345116C411E7B45C22E8A0A8B56

Function 6CE22920 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539d7b1cb40fa82f1dcbeba8ab2e032af43f92a0f88a306db0f65609ab9aff35
Instruction ID: d8434dc9a52b4e7a600b9fa15a158056524ab9e1cfc57d24653d606250be8ef0
Opcode Fuzzy Hash: 539d7b1cb40fa82f1dcbeba8ab2e032af43f92a0f88a306db0f65609ab9aff35
Instruction Fuzzy Hash: F2812A72B542068FCF04DE7CC5897ED77F2AB63368F3095168821DBB94C63E860A9751

Function 6CE1FEF0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7de2f7203a91de87b0e4703e3ad13e3c642b6edb91533f320f0accf413e0989
Instruction ID: 40e8da2c2cd517b5cb3acb61cb413a1fb2ce03f034e1c17f926b83d9da1dec28
Opcode Fuzzy Hash: b7de2f7203a91de87b0e4703e3ad13e3c642b6edb91533f320f0accf413e0989
Instruction Fuzzy Hash: 9351F472A4464A4FCB04DD7CC8E53DE7BF1AB47324F30561AD922DBBD0C26A494A8B81

Function 6CE2BBF0 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c534ba9bcb232b1d041f2b77542618e8f490c6a0495189c28fbe3e64df73dc4
Instruction ID: 0936c984b44af97dc9c094c3111eeb35a1f53150ce496cd87d1cf022a465a37b
Opcode Fuzzy Hash: 0c534ba9bcb232b1d041f2b77542618e8f490c6a0495189c28fbe3e64df73dc4
Instruction Fuzzy Hash: B551F676F41109CFCB04DEACC6C13EE7BB2AB47358F308116D912EB751C6399A468B81

Function 6CE406A1 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1244d2490e722d8e2d4b08a687ba54e345a4788b81df14d6debf1e67a5b6da9d
Instruction ID: fe25dbe1bc8e0aa2e18b0ba384811c70a4f263b95837ad7384f6541fa06150ff
Opcode Fuzzy Hash: 1244d2490e722d8e2d4b08a687ba54e345a4788b81df14d6debf1e67a5b6da9d
Instruction Fuzzy Hash: 25E08C72916278EBCB10CFC8D944E8AB3FCEB84B08B2180AAB512D3A10C270DE00C7D0

Function 6CE42D80 Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 6CE42DC4

Part of subcall function 6CE44CB7: _free.LIBCMT ref: 6CE44CD4
Part of subcall function 6CE44CB7: _free.LIBCMT ref: 6CE44CE6
Part of subcall function 6CE44CB7: _free.LIBCMT ref: 6CE44CF8
Part of subcall function 6CE44CB7: _free.LIBCMT ref: 6CE44D0A
Part of subcall function 6CE44CB7: _free.LIBCMT ref: 6CE44D1C
Part of subcall function 6CE44CB7: _free.LIBCMT ref: 6CE44D2E
Part of subcall function 6CE44CB7: _free.LIBCMT ref: 6CE44D40
Part of subcall function 6CE44CB7: _free.LIBCMT ref: 6CE44D52
Part of subcall function 6CE44CB7: _free.LIBCMT ref: 6CE44D64
Part of subcall function 6CE44CB7: _free.LIBCMT ref: 6CE44D76
Part of subcall function 6CE44CB7: _free.LIBCMT ref: 6CE44D88
Part of subcall function 6CE44CB7: _free.LIBCMT ref: 6CE44D9A
Part of subcall function 6CE44CB7: _free.LIBCMT ref: 6CE44DAC

_free.LIBCMT ref: 6CE42DB9

Part of subcall function 6CE40667: HeapFree.KERNEL32(00000000,00000000,?,6CE3FB79), ref: 6CE4067D
Part of subcall function 6CE40667: GetLastError.KERNEL32(?,?,6CE3FB79), ref: 6CE4068F

_free.LIBCMT ref: 6CE42DDB
_free.LIBCMT ref: 6CE42DF0
_free.LIBCMT ref: 6CE42DFB
_free.LIBCMT ref: 6CE42E1D
_free.LIBCMT ref: 6CE42E30
_free.LIBCMT ref: 6CE42E3E
_free.LIBCMT ref: 6CE42E49
_free.LIBCMT ref: 6CE42E81
_free.LIBCMT ref: 6CE42E88
_free.LIBCMT ref: 6CE42EA5
_free.LIBCMT ref: 6CE42EBD

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 03dc2ccb25708bf763293dbf99e2736cfbf1416dda23942a16b547ebbd367d2a
Instruction ID: 66a5a484f352db339d6cbf74a637bc5f10c3addc7fe8b426aa7eaef0ff2ec68a
Opcode Fuzzy Hash: 03dc2ccb25708bf763293dbf99e2736cfbf1416dda23942a16b547ebbd367d2a
Instruction Fuzzy Hash: 72313A71604641DEEB219A35F848F9673F8AFA031CF34896DE4A6DBF50DF32E8848614

Function 6CE401E3 Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 6CE401F9

Part of subcall function 6CE40667: HeapFree.KERNEL32(00000000,00000000,?,6CE3FB79), ref: 6CE4067D
Part of subcall function 6CE40667: GetLastError.KERNEL32(?,?,6CE3FB79), ref: 6CE4068F

_free.LIBCMT ref: 6CE40205
_free.LIBCMT ref: 6CE40210
_free.LIBCMT ref: 6CE4021B
_free.LIBCMT ref: 6CE40226
_free.LIBCMT ref: 6CE40231
_free.LIBCMT ref: 6CE4023C
_free.LIBCMT ref: 6CE40247
_free.LIBCMT ref: 6CE40252
_free.LIBCMT ref: 6CE40260

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b49a2662d25df75e662a00f80e03d50bd3d346ea33f587e402b94face67f5a7d
Instruction ID: 05bbcf8f9385f01c33f4a6bf9ba78bb698c5974f4af9f8197d220cc66d799efc
Opcode Fuzzy Hash: b49a2662d25df75e662a00f80e03d50bd3d346ea33f587e402b94face67f5a7d
Instruction Fuzzy Hash: B121DCB6900148FFCB41DF94D841DDD7BB9BF98748F1085AAF5159BA21DB32DA48CB80

Function 6CE3E480 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 6CE3E4B7
___except_validate_context_record.LIBVCRUNTIME ref: 6CE3E4BF
_ValidateLocalCookies.LIBCMT ref: 6CE3E548
__IsNonwritableInCurrentImage.LIBCMT ref: 6CE3E573
_ValidateLocalCookies.LIBCMT ref: 6CE3E5C8

Strings

csm, xrefs: 6CE3E55D

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 36c0555184525a064d3789ff35f6a400f7092c1a7d19201de9c37d6ffca5b022
Instruction ID: edfcff730a018f5830203a17079c4e887f4d304a99f8969fb9c325a963a3e0f8
Opcode Fuzzy Hash: 36c0555184525a064d3789ff35f6a400f7092c1a7d19201de9c37d6ffca5b022
Instruction Fuzzy Hash: FB417334E00629EBCF10CF68C880A9EBBB5AF4531CF249559E8189B791E735ED15CBE1

Function 6CE41CA8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

api-ms-, xrefs: 6CE41CFF
ext-ms-, xrefs: 6CE41D13

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 1640d9330096dfbf00dd8eb98f60a10c994934fe765e64da69cd7a835dfcaba1
Instruction ID: 1c901ff7665559e9718ae295429ab0c1333780ba1172ab9b3821f2c08e83162c
Opcode Fuzzy Hash: 1640d9330096dfbf00dd8eb98f60a10c994934fe765e64da69cd7a835dfcaba1
Instruction Fuzzy Hash: 202108B1A41220ABDF219AA5EC40B4A37789F037ADF358621E819B7790D730EC11C5D0

Function 6CE44E56 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CE44E1E: _free.LIBCMT ref: 6CE44E43

_free.LIBCMT ref: 6CE44EA4

Part of subcall function 6CE40667: HeapFree.KERNEL32(00000000,00000000,?,6CE3FB79), ref: 6CE4067D
Part of subcall function 6CE40667: GetLastError.KERNEL32(?,?,6CE3FB79), ref: 6CE4068F

_free.LIBCMT ref: 6CE44EAF
_free.LIBCMT ref: 6CE44EBA
_free.LIBCMT ref: 6CE44F0E
_free.LIBCMT ref: 6CE44F19
_free.LIBCMT ref: 6CE44F24
_free.LIBCMT ref: 6CE44F2F

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7df7bc2e45ad0bb9c7f8bc702183ee147632bc2a3689b57671c2733396f6c7e8
Instruction ID: cd9b056f45f06360185c5e77fbd5a602f9328866ce04b1b56599fb17f347e1d6
Opcode Fuzzy Hash: 7df7bc2e45ad0bb9c7f8bc702183ee147632bc2a3689b57671c2733396f6c7e8
Instruction Fuzzy Hash: ED1151B1680B14EAE520AFB4EC05FDBB7BC5F80704F50CC2EB29AAAA50DF75B5184751

Function 6CE43F6F Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 6CE43FB7
__fassign.LIBCMT ref: 6CE4419C
__fassign.LIBCMT ref: 6CE441B9
WriteFile.KERNEL32(?,6CE42799,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE44201
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CE44241
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE442E9

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 6f60f3e24da9726117a664fac66e02b8124aaecbf47de04cc0833e9607617df2
Instruction ID: 5675855848089b98e62cb5089496f845d5a8d6f53f8418180681e4aa4715b964
Opcode Fuzzy Hash: 6f60f3e24da9726117a664fac66e02b8124aaecbf47de04cc0833e9607617df2
Instruction Fuzzy Hash: ABC19D71E012589FDF10CFE8D8809EDBBB5AF4A318F28816AE855FB741D6319946CF60

Function 6CE3E957 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CE3E625,6CE3C668,6CE3C02F,?,6CE3C267,?,00000001,?,?,00000001,?,6CE4D908,0000000C,6CE3C360), ref: 6CE3E965
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CE3E973
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CE3E98C
SetLastError.KERNEL32(00000000,6CE3C267,?,00000001,?,?,00000001,?,6CE4D908,0000000C,6CE3C360,?,00000001,?), ref: 6CE3E9DE

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 270c536c7ec8453e82ae4041c600bcc39998225f9fb544306f3037e0cdaab49c
Instruction ID: dd197192555690e0bec7c4d854656ad2181cbfd484ab50596674988b52b1db79
Opcode Fuzzy Hash: 270c536c7ec8453e82ae4041c600bcc39998225f9fb544306f3037e0cdaab49c
Instruction Fuzzy Hash: AB01DE32609E319AAA6119755C80A8B2AB49B43B7C734336BF42C82AD0EF516C05D2C4

Function 6CE40FED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\Leside-.exe, xrefs: 6CE40FF2

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\Leside-.exe
API String ID: 0-3881279091
Opcode ID: 5acf17d2bd2d683dbd921eccaa40ae30825dd3eba2d431080705db1c2370ef21
Instruction ID: bd5c825f5e798643bb374f75647fbf283d55e9d8a661d6d3c20eb848c1ae02e1
Opcode Fuzzy Hash: 5acf17d2bd2d683dbd921eccaa40ae30825dd3eba2d431080705db1c2370ef21
Instruction Fuzzy Hash: 3E21B671604245AF9F20AAE6AC80D9A777DAB013AE724C619F518C7B40E730EC65A791

Function 6CE3EAD3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6CE3EB94,00000000,?,00000001,00000000,?,6CE3EC0B,00000001,FlsFree,6CE49354,FlsFree,00000000), ref: 6CE3EB63

Strings

api-ms-, xrefs: 6CE3EB23

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: f2cd1c41d600fb483d1e9e0d638927f2c3764cf25ec3497c6aef598d7459ddf6
Instruction ID: bed13877c9293d7a8d70c31d9c209d8df414aa526754937fe4b92590b46dea9c
Opcode Fuzzy Hash: f2cd1c41d600fb483d1e9e0d638927f2c3764cf25ec3497c6aef598d7459ddf6
Instruction Fuzzy Hash: 2C119131A41A35ABDB325A688C40B4973B4AB0377CF390221E919FB7C0D670FD01CAD5

Function 6CE3F4E7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6CE3F499,?,?,6CE3F461,?,00000001,?), ref: 6CE3F4FC
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CE3F50F
FreeLibrary.KERNEL32(00000000,?,?,6CE3F499,?,?,6CE3F461,?,00000001,?), ref: 6CE3F532

Strings

mscoree.dll, xrefs: 6CE3F4F5
CorExitProcess, xrefs: 6CE3F507

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3bcdedfebfc3d742fada9a45f0d82ff1cafdaaaef24b16e66d150ed510eecb0d
Instruction ID: f8db166e4f21e59473874a528147cfc6e9265b10e3d19e56e3c878a5c8ea5f4d
Opcode Fuzzy Hash: 3bcdedfebfc3d742fada9a45f0d82ff1cafdaaaef24b16e66d150ed510eecb0d
Instruction Fuzzy Hash: E4F01C31611228FBEF11AF91DE09B9D7A79EB4575FF2081A2F405E2650CB389F01DAE1

Function 6CE44DB5 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6CE44DCD

Part of subcall function 6CE40667: HeapFree.KERNEL32(00000000,00000000,?,6CE3FB79), ref: 6CE4067D
Part of subcall function 6CE40667: GetLastError.KERNEL32(?,?,6CE3FB79), ref: 6CE4068F

_free.LIBCMT ref: 6CE44DDF
_free.LIBCMT ref: 6CE44DF1
_free.LIBCMT ref: 6CE44E03
_free.LIBCMT ref: 6CE44E15

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4a894694b81cba12cd4195f2253e1b39f5a169418fe26c432c725ecefa6e7837
Instruction ID: 1b111536a289ebe3bea1e563ae34eb9c430848a0419c3ca5b57231d66ef8e46a
Opcode Fuzzy Hash: 4a894694b81cba12cd4195f2253e1b39f5a169418fe26c432c725ecefa6e7837
Instruction Fuzzy Hash: 48F04FB1A11744DB8A20DE64F084D5733F9EB80B1CB709D0BE029D7F00CB31F8808694

Function 6CE40971 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6CE40B0B

Strings

*?, xrefs: 6CE409B4

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: efaba169b8992d2e26a785112f36f40523865fa27bba120f56925424b36ce35c
Instruction ID: 26644e685a9582cb71df3e6ccf189e27a5771dc1d6004315575db299964f9433
Opcode Fuzzy Hash: efaba169b8992d2e26a785112f36f40523865fa27bba120f56925424b36ce35c
Instruction Fuzzy Hash: 76617FB5D002599FDB14CFA9D8809DEFBF5EF98318F2482AAD815E7700D731AE418B90

Function 6CE447DC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6CE43F6F: GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 6CE43FB7

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,6CE42799,?,00000000,00000000,6CE4DBB8,0000002C,6CE4280A,?), ref: 6CE44922
GetLastError.KERNEL32 ref: 6CE4492C
__dosmaperr.LIBCMT ref: 6CE4496B

Strings

(l, xrefs: 6CE447DE

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite__dosmaperr
String ID: (l
API String ID: 910155933-3029988293
Opcode ID: 1dadb8b1616d9939bd5dcea8eeec27ea4ab285700a6f72e5a6daab52a4fd03d3
Instruction ID: 7d9af9e2a28a41c787d4bf12c2f96e9650cffd472a0ad00c3cf6fe3b594c76e8
Opcode Fuzzy Hash: 1dadb8b1616d9939bd5dcea8eeec27ea4ab285700a6f72e5a6daab52a4fd03d3
Instruction Fuzzy Hash: 5C51E571B0028AABDB019FA8E844FDE7BB5EF4A31CF34805AE500B7B40D3759946DB61

Function 6CE40885 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CE40EA7: _free.LIBCMT ref: 6CE40EB5

Part of subcall function 6CE41A7B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,6CE43A13,?,00000000,00000000), ref: 6CE41B27

GetLastError.KERNEL32 ref: 6CE408ED
__dosmaperr.LIBCMT ref: 6CE408F4
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6CE40933
__dosmaperr.LIBCMT ref: 6CE4093A

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 41df09fff09f2b3d3537d107820d3b2248368fc271b1b0116f56449acb0fe753
Instruction ID: 8d287e1a27f4e5065a3e9c0e3ec732dc8e2e5d767759c3e1a70b2807f05f5abe
Opcode Fuzzy Hash: 41df09fff09f2b3d3537d107820d3b2248368fc271b1b0116f56449acb0fe753
Instruction Fuzzy Hash: CC21B571604245BFEB105F66AC80C97777CAFA537C724C638E51897B40E731EC554B90

Function 6CE40327 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6CE443B7,?,00000001,6CE4280A,?,6CE44871,00000001,?,?,?,6CE42799,?,00000000), ref: 6CE4032C
_free.LIBCMT ref: 6CE40389
_free.LIBCMT ref: 6CE403BF
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6CE44871,00000001,?,?,?,6CE42799,?,00000000,00000000,6CE4DBB8,0000002C,6CE4280A), ref: 6CE403CA

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: b0a99e4910707e085f76a213b5d9ea483c9f02bfc0208baf6924e2997e1ee7e1
Instruction ID: 9dd0a0108c94f70e99bf0d114b7e0de334c792651bd16810b414fc57bdfb47b7
Opcode Fuzzy Hash: b0a99e4910707e085f76a213b5d9ea483c9f02bfc0208baf6924e2997e1ee7e1
Instruction Fuzzy Hash: 7D11CA32705144ABDA1165B9BCC4E5A2B7B9FD267DB34827DF134D3BD0EB61CC198120

Function 6CE4047E Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000001,6CE40750,6CE4068D,?,?,6CE3FB79), ref: 6CE40483
_free.LIBCMT ref: 6CE404E0
_free.LIBCMT ref: 6CE40516
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,00000001,6CE40750,6CE4068D,?,?,6CE3FB79), ref: 6CE40521

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 5a3c7451394609a59cb5adcd16a41766804ee6f50859bc468ac97f045d953d11
Instruction ID: 1e0a94c8e6365845b20853f3565ca3824147c3949767990315faa3c2f2b5d04a
Opcode Fuzzy Hash: 5a3c7451394609a59cb5adcd16a41766804ee6f50859bc468ac97f045d953d11
Instruction Fuzzy Hash: B811E532704284AADA2029B9BC84E5A257ADFD267DB34C23DF534C3FC0EF21C81A8564

Function 6CE45606 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6CE45060,?,00000001,?,00000001,?,6CE44346,?,?,00000001), ref: 6CE4561D
GetLastError.KERNEL32(?,6CE45060,?,00000001,?,00000001,?,6CE44346,?,?,00000001,?,00000001,?,6CE44892,6CE42799), ref: 6CE45629

Part of subcall function 6CE455EF: CloseHandle.KERNEL32(FFFFFFFE,6CE45639,?,6CE45060,?,00000001,?,00000001,?,6CE44346,?,?,00000001,?,00000001), ref: 6CE455FF

___initconout.LIBCMT ref: 6CE45639

Part of subcall function 6CE455B1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CE455E0,6CE4504D,00000001,?,6CE44346,?,?,00000001,?), ref: 6CE455C4

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6CE45060,?,00000001,?,00000001,?,6CE44346,?,?,00000001,?), ref: 6CE4564E

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: bb1ea9ddbebd3b3cd33c84ac103523a5cbb98e07d573d951617ec778d32d7703
Instruction ID: 38105fd3e29c702b9da64bd912ce18e8089c5e9d661b5eda82da9eac56668147
Opcode Fuzzy Hash: bb1ea9ddbebd3b3cd33c84ac103523a5cbb98e07d573d951617ec778d32d7703
Instruction Fuzzy Hash: 6EF01C36611118BBCF722FD5EC089893F76EF0A7A9F148011FA1885620C6328820EB94

Function 6CE3F575 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\Leside-.exe, xrefs: 6CE3F5B8, 6CE3F5BF, 6CE3F5F5

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\Leside-.exe
API String ID: 0-3881279091
Opcode ID: 0d704c4abad429a7a74533bf0c5105e964e4c558e813cf557e77a57777551e18
Instruction ID: 46ea272b6fe7c6c4338334bf1c6d4ead2b9c2191a546c03bcc43c7265ba9c94c
Opcode Fuzzy Hash: 0d704c4abad429a7a74533bf0c5105e964e4c558e813cf557e77a57777551e18
Instruction Fuzzy Hash: 614174B1F00264AFDB11DF99D881D9E7BB8EF85718F3040AAE41897750D775AA44CB90

Function 6CE414F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 6CE4129E: GetOEMCP.KERNEL32(00000000,6CE4150F,?,00000001,6CE44871,6CE44871,00000001,?,?), ref: 6CE412C9

_free.LIBCMT ref: 6CE4156C

Strings

h, xrefs: 6CE415FE

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: _free
String ID: h
API String ID: 269201875-3790492082
Opcode ID: 4bc92c6f402ad63528cb9f8439b6600ab03483b3238c1a473703b1ad51ec8bf3
Instruction ID: 2ca00f345f9e237cc30fe0d1340df0384c309b4161568656562f50a68b757a63
Opcode Fuzzy Hash: 4bc92c6f402ad63528cb9f8439b6600ab03483b3238c1a473703b1ad51ec8bf3
Instruction Fuzzy Hash: 17319072904249AFCF01CFA9E880BDA77B4FF84358F25856AE815DB790EB35D924CB50

Function 6CE43E50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6CE43D0F: EnterCriticalSection.KERNEL32(00000001,?,6CE4474E,?,6CE4DC58,00000010,6CE428AD,00000000,00000000,?,?,?,?,6CE428F1,?,00000000), ref: 6CE43D2A

FlushFileBuffers.KERNEL32(00000000,6CE4DC38,0000000C,6CE43F57,(l,?,00000001,?,6CE4280A,?), ref: 6CE43E99
GetLastError.KERNEL32 ref: 6CE43EAA

Strings

(l, xrefs: 6CE43ED1

Memory Dump Source

Source File: 00000000.00000002.1658743870.000000006CE01000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000000.00000002.1658731937.000000006CE00000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658782040.000000006CE48000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658797790.000000006CE4F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1658838868.000000006CE9D000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce00000_Leside-.jbxd

Similarity

API ID: BuffersCriticalEnterErrorFileFlushLastSection
String ID: (l
API String ID: 4109680722-3029988293
Opcode ID: 228062ee869952885c74acc10e44882750a299f6fe58a3354c369a552bc714de
Instruction ID: aa08320176592272e258f814e0e3ca06000f6ac7a8e3d6a8834feade05cf8676
Opcode Fuzzy Hash: 228062ee869952885c74acc10e44882750a299f6fe58a3354c369a552bc714de
Instruction Fuzzy Hash: 20018C36A043108FD710EFA8E805A8D7BB4EF4A728F24C61FE811DB790DBB49846CB40

Analysis Process: aspnet_regiis.exePID: 480, Parent PID: 2120COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	21.6%
Total number of Nodes:	74
Total number of Limit Nodes:	5

Executed Functions

Function 72C48600 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 351
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 72C48624
GetCurrentThreadId.KERNEL32 ref: 72C4862E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 72C487FA
GetForegroundWindow.USER32 ref: 72C48974

Part of subcall function 72C4B7B0: FreeLibrary.KERNEL32(72C48A31), ref: 72C4B7B6
Part of subcall function 72C4B7B0: FreeLibrary.KERNEL32 ref: 72C4B7D7

ExitProcess.KERNEL32 ref: 72C48A4A

Strings

}, xrefs: 72C48913
b]u), xrefs: 72C48877
}, xrefs: 72C4890C

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID: b]u)$}$}
API String ID: 3676751680-2900034282
Opcode ID: f262346e74f837c6d9de7d32c9c47269155e29bfc8895ff9b92009d14eb6bd8a
Instruction ID: 8e27c43a83b9279df307366128c6d2a94a739757458a16833a6e4da60e78cc1c
Opcode Fuzzy Hash: f262346e74f837c6d9de7d32c9c47269155e29bfc8895ff9b92009d14eb6bd8a
Instruction Fuzzy Hash: 71C1E773A187144BC708DF6DCC4125AFBE6ABC4710F1AC62EA899EB354EA74DC058BC1

Function 72C7E110 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(72C8148A,00000002,00000018,?,?,00000018,?,?,?), ref: 72C7E13E

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 72C48A50 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction ID: 275957155fb7f5e12868e5e5f5221a80a6147f3987afad807f4f354de555d269
Opcode Fuzzy Hash: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction Fuzzy Hash: A521C537A627184BD3008E54DCC87917762E7D9328F3E86B8C9249F3D2C97BA91386C0

Function 72C7E34B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 72C7E3BA

Strings

, xrefs: 72C7E365, 72C7E37C

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-3019521637
Opcode ID: 886f1e6439959a4795be2dd0d466d87128220e816994151028bd6f62f89854e6
Instruction ID: 786404173860e1cf3a5fdd5f2665c302915c0026218edcca8ec9a09eb4e6fc85
Opcode Fuzzy Hash: 886f1e6439959a4795be2dd0d466d87128220e816994151028bd6f62f89854e6
Instruction Fuzzy Hash: BB112B77E808914BDF08CA3DCC171AA77A2B3E4325B3D8ABDC816E3384D93858068A40

Function 72C49D1E Relevance: 3.1, APIs: 2, Instructions: 142
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000), ref: 72C49D98
LoadLibraryExW.KERNEL32(?,00000000), ref: 72C49E78

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ecbbc5446eca3e3d57eb8fc53e18ca4e9d4c15149e51de99a9714fbd5ee0164c
Instruction ID: 46ef009d338f67413dc2cc725448eb0c3758ff098646287d29c49c5af5f71bcd
Opcode Fuzzy Hash: ecbbc5446eca3e3d57eb8fc53e18ca4e9d4c15149e51de99a9714fbd5ee0164c
Instruction Fuzzy Hash: 55410FB4D003409FE7159F78C9D2A8A7F71EB46224F61929CE4902F3A6C631940ACBE2

Function 72C4EF53 Relevance: 3.1, APIs: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 72C4EF57
CoInitializeEx.COMBASE(00000000,00000002), ref: 72C4F09C

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 6985306469e24cd05c7bf57e365346a10ebfe985b1e453da3e7713ad9efe0bcd
Instruction ID: 1cfe02d6bacc07e1a293db7780b629356d114f9c22079f1611ab679a53b28d0c
Opcode Fuzzy Hash: 6985306469e24cd05c7bf57e365346a10ebfe985b1e453da3e7713ad9efe0bcd
Instruction Fuzzy Hash: 2E41C8B4910B40AFD370EF398A4B7137EB8AB05250F504B1EF9E6866D4E231A4198BD7

Function 72C4EC77 Relevance: 3.0, APIs: 2, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 72C4EC89
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 72C4ECA2

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 2848e7e9236a6cfe3eda65033fe0c3e4f4ee276280997640208243417720eebf
Instruction ID: 990c72484a489a63e7e5ee1c703d72c922d127c37b45f02fcc5339cc9a2e9250
Opcode Fuzzy Hash: 2848e7e9236a6cfe3eda65033fe0c3e4f4ee276280997640208243417720eebf
Instruction Fuzzy Hash: B6E017753D83817AF2788602CD17F6432216F61F22F308708B3213F3C58AE03100450C

Function 72C77764 Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 72C7779D

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: e253a80b623b097cc8d00af9df4fb41400cbcc1f16c3f5ab96d8a11ff74b3647
Instruction ID: cf9201f71772a7e1ddff73f2d421d3e17c287e65664c37fedfd98d27d900886c
Opcode Fuzzy Hash: e253a80b623b097cc8d00af9df4fb41400cbcc1f16c3f5ab96d8a11ff74b3647
Instruction Fuzzy Hash: DB31F332B426848FD716CA7DC89379DBFE38BE5214F1E81A9D059CB391C9389946CB20

Function 72C7E0A0 Relevance: 1.5, APIs: 1, Instructions: 31
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 72C7E0E0

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 61080dca012a60b1fdcd8050d1c3e8f3ca2c117bdf09d8d8e52357d2eb8fb97d
Instruction ID: 82c25a2bf8adcbc6cd491235703ed8e7b57db207739e3c5dce3c06f407bae725
Opcode Fuzzy Hash: 61080dca012a60b1fdcd8050d1c3e8f3ca2c117bdf09d8d8e52357d2eb8fb97d
Instruction Fuzzy Hash: 64F0A033854292EBC3519F3EAD04A4B3AA8AFE2720F164968E40096304DA35E926D692

Function 72C7E3A9 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 72C7E3BA

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: f46bf5fa33a3d2f5a208ee19c6572bf81e1516989a2a00b0c2f1e383b82b77bd
Instruction ID: f620c24a3013679135c99639bc398535818162e687a75d1d074d1c34111bbe6a
Opcode Fuzzy Hash: f46bf5fa33a3d2f5a208ee19c6572bf81e1516989a2a00b0c2f1e383b82b77bd
Instruction Fuzzy Hash: 2FF08CBBE905928FDB04CF56CC506A433A2B7E831632DCA6DD502A3308DA74A902CA51

Function 72C7C570 Relevance: 1.5, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?,72C7E0F9), ref: 72C7C590

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c489af5ae98f7bf0f8e21dc15f0c9a2c6a9a1b79d3e333b4079f6ea6ff7695e7
Instruction ID: 8bb4590a2d0c89bca9cd42cd9fd8fb561b1c5ec9a933ede012307a05b5f59056
Opcode Fuzzy Hash: c489af5ae98f7bf0f8e21dc15f0c9a2c6a9a1b79d3e333b4079f6ea6ff7695e7
Instruction Fuzzy Hash: 8CD0A932445122EBCA40AF28BC01BC73A589F68320F030880A0406A160C220EC80CAC0

Function 72C7C55B Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 72C7C561

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 11e8acb9fd0dde65895eb4a3c0f95f0c4d5716f0f5c2ac0ecd859488aa041aed
Instruction ID: 56f24585265c6d01c482d7b64e364f47ca60297f0ff9b213dc2ce3b5e4fba49c
Opcode Fuzzy Hash: 11e8acb9fd0dde65895eb4a3c0f95f0c4d5716f0f5c2ac0ecd859488aa041aed
Instruction Fuzzy Hash: 1DA012310800509BC5111A11BC08FC13E20DB14220F130140F040540B182208C41C580

Function 72C4DDBB Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE ref: 72C4DDC3

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: fc577955f67ac39d97a92358e2cd3e338c06159afe6ed9cf15440a7fdd49fbbc
Instruction ID: c4297e45f542da537761bf4a72d7da122ab54992fd68286ceae7bca1e5820405
Opcode Fuzzy Hash: fc577955f67ac39d97a92358e2cd3e338c06159afe6ed9cf15440a7fdd49fbbc
Instruction Fuzzy Hash: 02C012376AC0C09BD308C6668C655673A569FBA288326EA1DC94687305EBF454118A41

Non-executed Functions

Function 72C62E6D Relevance: 47.0, APIs: 3, Strings: 23, Instructions: 1504COMMON

Download Yara Rule

Strings

V], xrefs: 72C631FA
lev-tolstoi.com, xrefs: 72C633BD
%", xrefs: 72C6334A
JOSP, xrefs: 72C62F6F
8]pY, xrefs: 72C62EFF
_^]\, xrefs: 72C63695
wdnf, xrefs: 72C62F07
~SS}, xrefs: 72C62F37
CNF8, xrefs: 72C62F3F
9#', xrefs: 72C63040
R03!, xrefs: 72C62F77
I, xrefs: 72C63048
eN, xrefs: 72C641BA
- $f, xrefs: 72C63038
_^]\, xrefs: 72C62EA5
].n^, xrefs: 72C62F57
+A#C=]=_, xrefs: 72C63F9D
s, xrefs: 72C62FCA
Q*RG, xrefs: 72C62F5F
Fm, xrefs: 72C631F2
=]=_, xrefs: 72C63D0E
rp, xrefs: 72C63FF3
g}zh, xrefs: 72C62F27

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %"$+A#C=]=_$- $f$8]pY$9#'$=]=_$CNF8$Fm$I$JOSP$Q*RG$R03!$V]$].n^$_^]\$_^]\$eN$g}zh$lev-tolstoi.com$s$wdnf$~SS}$rp
API String ID: 0-796191818
Opcode ID: e77fb34321e9b9b52073da323b85872f9ba98986cd6de5e406c43bbbec052a9f
Instruction ID: 1c71f1f24633ac8c16540910ab72492a564e79b2810a25516132b4c8a68f6fdb
Opcode Fuzzy Hash: e77fb34321e9b9b52073da323b85872f9ba98986cd6de5e406c43bbbec052a9f
Instruction Fuzzy Hash: FDB2F2B2A08341CFD714CF29C89176ABBB2FF95314F298A6CE4959B395D734D802CB91

Function 72C73E30 Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 116clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 72C73E44
GetClipboardData.USER32 ref: 72C73E5F
GlobalLock.KERNEL32 ref: 72C73E78
GetWindowLongW.USER32 ref: 72C73ED7
GlobalUnlock.KERNEL32 ref: 72C73FA9
CloseClipboard.USER32 ref: 72C73FB4

Strings

;, xrefs: 72C73F0B
', xrefs: 72C73EED
-, xrefs: 72C73F1F
=, xrefs: 72C73EF7
I, xrefs: 72C73F06
(, xrefs: 72C73F1A
6, xrefs: 72C73F10
}, xrefs: 72C73F15
5, xrefs: 72C73EF2
q, xrefs: 72C73EE8
L, xrefs: 72C73EFC
*, xrefs: 72C73F24
8, xrefs: 72C73F01

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: '$($*$-$5$6$8$;$=$I$L$q$}
API String ID: 2832541153-2064290267
Opcode ID: 3fbeb9dfcdfbe5bacfbe6d67d914686db58c828b2f06759cfba40a78bbae3b4a
Instruction ID: 5c3707f3a5056f94d3ea62c6a8877625f429ce31c0bde95b580c9089765b4672
Opcode Fuzzy Hash: 3fbeb9dfcdfbe5bacfbe6d67d914686db58c828b2f06759cfba40a78bbae3b4a
Instruction Fuzzy Hash: 9D413D7110C3818EE301EFBDD58835EBEE0AB95348F059A6EE4D987382D6BA8549C753

Function 72C79280 Relevance: 32.2, APIs: 10, Strings: 8, Instructions: 653memorycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(72C8368C,00000000,00000001,72C8367C,00000000), ref: 72C794CF
SysAllocString.OLEAUT32(00001F7A), ref: 72C79550
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 72C7958E
SysAllocString.OLEAUT32(8DFD93FD), ref: 72C79625
SysAllocString.OLEAUT32(4A105420), ref: 72C79706
VariantInit.OLEAUT32(?), ref: 72C79774
VariantClear.OLEAUT32(?), ref: 72C798BC
SysFreeString.OLEAUT32 ref: 72C798DF
SysFreeString.OLEAUT32(?), ref: 72C798E5
SysFreeString.OLEAUT32(00000000), ref: 72C798F6

Strings

=hn, xrefs: 72C79676
O^, xrefs: 72C797A6
b{tu, xrefs: 72C792D9, 72C7939B
SB, xrefs: 72C7979E
:;$%, xrefs: 72C799C0
t"j, xrefs: 72C7966E
gd, xrefs: 72C7968E
Jtuj, xrefs: 72C792E5

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInitInstanceProxy
String ID: :;$%$=hn$Jtuj$O^$SB$b{tu$gd$t"j
API String ID: 2485776651-1335595022
Opcode ID: 481c3e83d30a2485bfb6021a79bc1c358bc5ae7dbbdc3ec97a4cfee0a1622e43
Instruction ID: 4be036074631a82513f532286d312ab1f9cc1668de3d90b444617f6081e9dcd1
Opcode Fuzzy Hash: 481c3e83d30a2485bfb6021a79bc1c358bc5ae7dbbdc3ec97a4cfee0a1622e43
Instruction Fuzzy Hash: 66221276A183419BE300CF39C880B5BBBE2EFD5314F148A2CE9959B391D775D946CB82

Function 72C67740 Relevance: 16.6, Strings: 13, Instructions: 338COMMON

Download Yara Rule

Strings

}9F;, xrefs: 72C67F62
!A/C, xrefs: 72C67FD0
1Q>S, xrefs: 72C67FA4
O=q?, xrefs: 72C67F6D
r, xrefs: 72C6831A
f!V#, xrefs: 72C67F78
P-X/, xrefs: 72C67F99
s1z3, xrefs: 72C67F4C
Z)o+, xrefs: 72C67F8E
$Y)[, xrefs: 72C67FBA
DE, xrefs: 72C67FDB
S%g', xrefs: 72C67F83
}5x7, xrefs: 72C67F57

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: !A/C$$Y)[$1Q>S$DE$O=q?$P-X/$S%g'$Z)o+$f!V#$r$s1z3$}5x7$}9F;
API String ID: 0-3413813421
Opcode ID: da511abdf7d69269a39ed0f57cd372f7978266ded2ab66e473f5871b1ce312ff
Instruction ID: ac43892ac9301ee77d8f94f93cd9235de2aac796673fd33955394e170c1af06b
Opcode Fuzzy Hash: da511abdf7d69269a39ed0f57cd372f7978266ded2ab66e473f5871b1ce312ff
Instruction Fuzzy Hash: D8C100B1508380CFD724CF29C852B6BBBF1FF95304F158A6CE5998B251E7358549CB92

Function 72C5C8A0 Relevance: 15.6, Strings: 12, Instructions: 585COMMON

Download Yara Rule

Strings

uvw, xrefs: 72C5CA0A
wt, xrefs: 72C5CB3E
MO, xrefs: 72C5CD10
#M%O, xrefs: 72C5C9FA
*", xrefs: 72C5CE7A
pv, xrefs: 72C5CB36
AC, xrefs: 72C5CCF8
a`|v, xrefs: 72C5C8A1
"nl, xrefs: 72C5CC10
\701, xrefs: 72C5CF03, 72C5CF0C
\701, xrefs: 72C5CF55
4UW, xrefs: 72C5CCE0

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: "nl$#M%O$*"$4UW$\701$\701$a`|v$wt$AC$MO$pv$uvw
API String ID: 0-635595044
Opcode ID: c84eab3e47b8ac47354ad87a7731697313089ccbf8dafab6b60dde2d07d52d3a
Instruction ID: cea5bd1e5e532c77b19591c3b29ea82aaec3442bda3bf251e281f378dd456b15
Opcode Fuzzy Hash: c84eab3e47b8ac47354ad87a7731697313089ccbf8dafab6b60dde2d07d52d3a
Instruction Fuzzy Hash: 2F02CF7654C3408BD3048F29C8916ABBBF1EFD5314F25892CE4C68B351E235DA49CB9A

Function 72C639B9 Relevance: 14.8, APIs: 3, Strings: 5, Instructions: 821COMMON

Download Yara Rule

Strings

eN, xrefs: 72C641BA
+A#C=]=_, xrefs: 72C63F9D
_^]\, xrefs: 72C63865
=]=_, xrefs: 72C63D0E
rp, xrefs: 72C63FF3

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: +A#C=]=_$=]=_$_^]\$eN$rp
API String ID: 0-2225558837
Opcode ID: 93c29ba08d9608cc33f41ec6aa7887c7cba5a9b8b2087611d7b3f630fada0d8f
Instruction ID: b6a169828bada90e1623ebf0db18eb9b9d0c941a3653be31fda48f11519112a7
Opcode Fuzzy Hash: 93c29ba08d9608cc33f41ec6aa7887c7cba5a9b8b2087611d7b3f630fada0d8f
Instruction Fuzzy Hash: 534236B6A04201CFD714CF69C8917AABBB2FF99310F29C6ACD4459B395D738D942CB90

Function 72C5EB80 Relevance: 12.1, Strings: 9, Instructions: 812COMMON

Download Yara Rule

Strings

AL, xrefs: 72C5EF3D
, xrefs: 72C5F25F, 72C5F26A, 72C5F29C
t|f, xrefs: 72C5EE88
hch&, xrefs: 72C5EEA8
Yxqs, xrefs: 72C5EEC8
CPm5, xrefs: 72C5EEE0
uvqs, xrefs: 72C5EEC0
O}nl, xrefs: 72C5EED8
f>mI, xrefs: 72C5EED0

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: AL$CPm5$O}nl$Yxqs$f>mI$hch&$t|f$uvqs$
API String ID: 0-1556426300
Opcode ID: e634cef07219046654e77a9efcd370274dabb20924d147c154604c147342adef
Instruction ID: 8a821d1314854c9d3edb525ceefcddb504f1f49ae856c5906614414aa6b1a8b9
Opcode Fuzzy Hash: e634cef07219046654e77a9efcd370274dabb20924d147c154604c147342adef
Instruction Fuzzy Hash: 4D52357150C3918FC716CF29C84065FBBE1AFE6214F244B6CE8EA9B282D735D506CB96

Function 72C6B980 Relevance: 10.3, Strings: 8, Instructions: 329COMMON

Download Yara Rule

Strings

UXWZ, xrefs: 72C6BC26
220, xrefs: 72C6BBE0
:/', xrefs: 72C6BBFE
nV[k, xrefs: 72C6BC30
AZDH, xrefs: 72C6BC44
" , xrefs: 72C6BC08
47:, xrefs: 72C6BBD6
pMC@, xrefs: 72C6BC3A

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: 47:$ " $220$AZDH$UXWZ$nV[k$pMC@$:/'
API String ID: 0-3711047884
Opcode ID: b9f7b377af8717c7fcead8f3ed908807518a85707a7c592cbb5a54d35cd06e07
Instruction ID: 52204e98e1d1e78b325fb3143c08c52f252343a646377167e3232257636dc146
Opcode Fuzzy Hash: b9f7b377af8717c7fcead8f3ed908807518a85707a7c592cbb5a54d35cd06e07
Instruction Fuzzy Hash: B3C158B4800B819FD321AF3AC5867A3BFF0AB56310F504A5DD4EB5B685E734601ACBD2

Function 72C58B15 Relevance: 9.7, Strings: 7, Instructions: 999COMMON

Download Yara Rule

Strings

_^]\, xrefs: 72C59425
_^]\, xrefs: 72C58F25
_^]\, xrefs: 72C58B44
_^]\, xrefs: 72C59115
BVLm, xrefs: 72C5902A
/, xrefs: 72C592BA
_^]\, xrefs: 72C58DE5

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: /$BVLm$_^]\$_^]\$_^]\$_^]\$_^]\
API String ID: 2994545307-2892575238
Opcode ID: 079e98df4b9d3fdbf00daf5cb795b0aaff828beab46c89db088fad010dd82721
Instruction ID: 62e32dd2b2306fc6f30eb2edfe2d4312228c49064ca9a4aff8268667ee7d4c6d
Opcode Fuzzy Hash: 079e98df4b9d3fdbf00daf5cb795b0aaff828beab46c89db088fad010dd82721
Instruction Fuzzy Hash: EA323AB26082408BD719CA3ACC5176BB7E2FBF5314F398AACD19787295D730C942CB95

Function 72C4AB40 Relevance: 8.0, Strings: 6, Instructions: 481COMMON

Download Yara Rule

Strings

>, xrefs: 72C4AB5E
]><, xrefs: 72C4AC83
HYZF, xrefs: 72C4AE05, 72C4B07E, 72C4B075
Y2^0, xrefs: 72C4AC7B
HYZF, xrefs: 72C4AE40
UMAG, xrefs: 72C4AEF0

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: >$HYZF$HYZF$UMAG$Y2^0$]><
API String ID: 0-2666672646
Opcode ID: 6ac985df5208fa9c4c3a4f6e578a18e671911fa87d401b4d1357bc748228769c
Instruction ID: 124babbfcc7bb125f8cdd91a3e954e402c5c2fb93c33c1271e299447b24f6308
Opcode Fuzzy Hash: 6ac985df5208fa9c4c3a4f6e578a18e671911fa87d401b4d1357bc748228769c
Instruction Fuzzy Hash: 01E157B6A4C3504BD314CF6DC8503AFBFE2ABD1304F08992DE9EA9B345DA75C9058786

Function 72C4CE45 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 341COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 72C4CE55

Strings

lev-tolstoi.com, xrefs: 72C4D266
6=.), xrefs: 72C4CF3B
<1!9, xrefs: 72C4CF34
`{tu, xrefs: 72C4D1A8

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: Uninitialize
String ID: 6=.)$<1!9$`{tu$lev-tolstoi.com
API String ID: 3861434553-1386727196
Opcode ID: cc70f5880497a853474d4c37b72271f83ae40f944a0a94b11dcbe4c8bddfc04b
Instruction ID: c0af22871abee2003397507328f29880f11dd68f41067c64af0132b1b8620820
Opcode Fuzzy Hash: cc70f5880497a853474d4c37b72271f83ae40f944a0a94b11dcbe4c8bddfc04b
Instruction Fuzzy Hash: DFA123B42047818FD716CF2AC4D0752BFE2BFA6304B18969CC8D24F75AD73AA446CB91

Function 72C681CC Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 593COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 72C684BD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 72C685B4

Strings

_^]\, xrefs: 72C68A15
LF7Y, xrefs: 72C68951

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: LF7Y$_^]\
API String ID: 237503144-3688711800
Opcode ID: d97acd4c0b68f919e4599a8115768a7173dc7e18e3e0ea0d6356f39f786a2fae
Instruction ID: 537a9ceaba116db7a7544d9fac80cf71117d9fb928c6e3f5bc7cffb83a63b779
Opcode Fuzzy Hash: d97acd4c0b68f919e4599a8115768a7173dc7e18e3e0ea0d6356f39f786a2fae
Instruction Fuzzy Hash: DC223272948381CFD310CF29CC8176BBBE2BFA9310F198B6CE99657291D7319949CB42

Function 72C683D8 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 542COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 72C684BD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 72C685B4

Strings

_^]\, xrefs: 72C68A15
LF7Y, xrefs: 72C68951

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: LF7Y$_^]\
API String ID: 237503144-3688711800
Opcode ID: bc31b7727be6a2d32898aeccb6fbdaebc790d394c64f1908aac31476b906b4a6
Instruction ID: f1a8a9a9b9ec1fd2397939cd953478e52928efe1bea6dbff71a77c97e8258535
Opcode Fuzzy Hash: bc31b7727be6a2d32898aeccb6fbdaebc790d394c64f1908aac31476b906b4a6
Instruction Fuzzy Hash: 84122172948381CFD310CF29C88076BBBE2BF99310F198B6CE99A57291D731D949CB52

Function 72C58169 Relevance: 6.5, Strings: 5, Instructions: 299COMMON

Download Yara Rule

Strings

^`/4, xrefs: 72C581E1
7, xrefs: 72C58419
2h?n, xrefs: 72C583A0
gfff, xrefs: 72C58458
SP, xrefs: 72C58396

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: 2h?n$7$SP$^`/4$gfff
API String ID: 0-3257051659
Opcode ID: 26a58d1228707e468bcc1e770b982ac75f41587ccc9b18842ef8cdb4681b4d81
Instruction ID: f72f6b225b11a84265dcb30a551486de20c4fca6ad854694b823e0883cee2363
Opcode Fuzzy Hash: 26a58d1228707e468bcc1e770b982ac75f41587ccc9b18842ef8cdb4681b4d81
Instruction Fuzzy Hash: 07A13772A142508BD314CF29CD5176FBBE2FBD4318F69CA2DD48AD7395EA38C8428785

Function 72C691AE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?), ref: 72C691DA

Strings

wpq, xrefs: 72C692B7
+Ku, xrefs: 72C692AF

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: +Ku$wpq
API String ID: 237503144-1953850642
Opcode ID: 299ea5ff109f30334631e58458856269d4d36f1034fd5006e38a572b7846a986
Instruction ID: 3dc10d723d26f6d8eee7883a6dbb3e7bcb044402c14cb30fb33a0d99e9f21305
Opcode Fuzzy Hash: 299ea5ff109f30334631e58458856269d4d36f1034fd5006e38a572b7846a986
Instruction Fuzzy Hash: D251CE7221C3518FC314CF69988176FB7F2EBC5310F15892DE4AACB285DB30D60A8B92

Function 72C748C2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 72C74910
GetSystemMetrics.USER32 ref: 72C7491F

Strings

, xrefs: 72C749F3

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 46fae7ac221e462fa1bd517b88b44838e8e1e8952e6bae866075233eb720763d
Instruction ID: 0755e25c0ea87fa8f9b32e32d5ff120ff60ac67351824cb9c587d1fa52667eb3
Opcode Fuzzy Hash: 46fae7ac221e462fa1bd517b88b44838e8e1e8952e6bae866075233eb720763d
Instruction Fuzzy Hash: 0F5162B1E142489FCB40EFADD98569DBBF0BB48310F10852EE898E7350E734A945CF92

Function 72C690D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 72C69170

Strings

M/(, xrefs: 72C6913D
M/(, xrefs: 72C6919E

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: M/($M/(
API String ID: 237503144-1710806632
Opcode ID: c37101561110a5e3a56eee9c6f13a93edf26f76bb6924eb6dba7f20ee9ade939
Instruction ID: be2afe2572cbe22aebaaaec8844e3abd77c6b2b1cc1b175ed60842af8bc4620b
Opcode Fuzzy Hash: c37101561110a5e3a56eee9c6f13a93edf26f76bb6924eb6dba7f20ee9ade939
Instruction Fuzzy Hash: 742123716583515FE714CE38DC8279FB7AAEBD2700F11892CE0D1EB1C5D675880B8752

Function 72C49780 Relevance: 2.9, Strings: 2, Instructions: 420COMMON

Download Yara Rule

Strings

1, xrefs: 72C49A7B
A, xrefs: 72C49922

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: 1$A
API String ID: 0-719046165
Opcode ID: 6880b94caaa2b9775e65e87bff26e4ac5f9e6f4726df1c138d6b4f417168255c
Instruction ID: eafcf670c91f40432f5afb900797a15dd777444486ee76cb27b80699e837b530
Opcode Fuzzy Hash: 6880b94caaa2b9775e65e87bff26e4ac5f9e6f4726df1c138d6b4f417168255c
Instruction Fuzzy Hash: 52D116755083508BD718CF28C851BABBBE1FFD5318F089A6DE5DACB241DB388506CB96

Function 72C62830 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

_^]\, xrefs: 72C62C05
C@, xrefs: 72C6285E

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: C@$_^]\
API String ID: 0-1259475386
Opcode ID: a898e46164b98d770bede86ea40384378d0603a94dd4560820d1a2bd95851f03
Instruction ID: eed88153c55d99c4d88aad1a21fead9f26bfbd0f6d98dc911678f43855892667
Opcode Fuzzy Hash: a898e46164b98d770bede86ea40384378d0603a94dd4560820d1a2bd95851f03
Instruction Fuzzy Hash: 37B108A1A042005BE715DF29CC9273BB7F6EFE5224F15991CE89797382E235D906C353

Function 72C5B8F6 Relevance: 1.7, Strings: 1, Instructions: 477COMMON

Download Yara Rule

Strings

EWC`, xrefs: 72C5BD43

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: EWC`
API String ID: 0-1922773688
Opcode ID: 41fe52dae277590a098fe4bb1a53dfbe2c8fab9eba0f905e21f3817d44c1f8a9
Instruction ID: 3f37e39b2683a934ab65584dbbb139e2c40a5ea03ef60a33b841c60a53479662
Opcode Fuzzy Hash: 41fe52dae277590a098fe4bb1a53dfbe2c8fab9eba0f905e21f3817d44c1f8a9
Instruction Fuzzy Hash: 32D13270505B428BC3258F29C4A17A3BBF2FFA2314F28552CE5D78B699E73AE406C754

Function 72C6D17D Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(1A11171A), ref: 72C6D2A4

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 5f1ed4b3d3f20cc372cbba8728561fad4f070d97d716efcd4d8fe47ea01b939e
Instruction ID: 8c3c8d0e03ed694247dd38681046e3e82517470761b29e3dfcdf80d4143d5df5
Opcode Fuzzy Hash: 5f1ed4b3d3f20cc372cbba8728561fad4f070d97d716efcd4d8fe47ea01b939e
Instruction Fuzzy Hash: C441C3705043819BE3158F39C9E0B63BFE1EF67314F28868CD5D64B296D625D816C751

Function 72C6D34A Relevance: 1.6, Strings: 1, Instructions: 398COMMON

Download Yara Rule

Strings

><+, xrefs: 72C6D353

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: ><+
API String ID: 0-2918635699
Opcode ID: 589730f44867dbd3fe64943969d4625b71e2c89851dc653ce60dee7affd1cd31
Instruction ID: 6cb8343d9ad159cc67a615bfd9677e1ee046f19fe6c89dfde2acac91bd362cca
Opcode Fuzzy Hash: 589730f44867dbd3fe64943969d4625b71e2c89851dc653ce60dee7affd1cd31
Instruction Fuzzy Hash: C8C1A1756047818FD715CF2AC490762FBF2AF9A314B28859DC4DA8B752D735E806CB50

Function 72C6B170 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 72C6B458

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: d05c80c795993c871168dd86f7d1ea5d1d218413b04f758d20a6faf4e3c25647
Instruction ID: 36e8ca2da88c4285ef74394953533ea3e2fba5a839d4e2efc11b07c3d88e995d
Opcode Fuzzy Hash: d05c80c795993c871168dd86f7d1ea5d1d218413b04f758d20a6faf4e3c25647
Instruction Fuzzy Hash: E5C119B2A043445FD7158E2DC4D077BBBEAAFE4314F09892DE89A97381EB34E845C791

Function 72C69E80 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 72C69F6C

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 03931c0ee3c894ed1e7081685cf11bca85bb2a99e3e6f5f51b5975ed00d3b387
Instruction ID: 0c3fb3b70422f0b230c9e3280699504afd0c50e640ad57c8852998142cc6b2e2
Opcode Fuzzy Hash: 03931c0ee3c894ed1e7081685cf11bca85bb2a99e3e6f5f51b5975ed00d3b387
Instruction Fuzzy Hash: 0841E2B554C340CFE3008F25A88266BBBF5EBD2714F209D6CE6929B291D735D54BCB82

Function 72C7CA40 Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

_^]\, xrefs: 72C7CC20

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: 3ac50b92ff5f7a0642eac576d0f9eb6b11634079a6aeb40372d9b28aa7f6b2a2
Instruction ID: 00a873a12c4bec170545ea3883a2755b7a888d5936fe33adc2e93db8c4fb5753
Opcode Fuzzy Hash: 3ac50b92ff5f7a0642eac576d0f9eb6b11634079a6aeb40372d9b28aa7f6b2a2
Instruction Fuzzy Hash: 43712672A047024FD708DE2DCCD072EBBA6EBE5624F19863DD49797399D6309941C781

Function 72C6C0E6 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

N&, xrefs: 72C6C173

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: 5665b64be25d203cd2c098854cb0f624d733d04435fb67f576dcce93946ba0a9
Instruction ID: 27c1ec8e42747c089b8b123e81ffb07e23350837b758712f2c1fb5e25d9b7a9d
Opcode Fuzzy Hash: 5665b64be25d203cd2c098854cb0f624d733d04435fb67f576dcce93946ba0a9
Instruction Fuzzy Hash: 3551E725614B804BD72ACB3EC8513B7BBE3ABE7314B58969DC4D7C7686CA3CE1068710

Function 72C6C09E Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

N&, xrefs: 72C6C173

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: 67778d2b500347c8f6d70a6dff6ebacd1377335ec9b4928ea528ea997ceaea96
Instruction ID: bec86c7ea79c96c888ff96f52c7279be26b2b528aa7b521bcd9bb81d527e98fd
Opcode Fuzzy Hash: 67778d2b500347c8f6d70a6dff6ebacd1377335ec9b4928ea528ea997ceaea96
Instruction Fuzzy Hash: 1B510825614BC04AD72ACB3AC8503B37BE3AFE7314F58969DC4D7D7A86CA3CA0028710

Function 72C81160 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

@, xrefs: 72C8123B

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: dbb30c95de9822867e1a3469e31d8e7f1c7048795ce33ecf2797a703ce94cb88
Instruction ID: 6313eed8fb551813fd00674aa4d61fb46bb3c5a8ae2cd4986a68cea52479b929
Opcode Fuzzy Hash: dbb30c95de9822867e1a3469e31d8e7f1c7048795ce33ecf2797a703ce94cb88
Instruction Fuzzy Hash: E941F0B29043109BD705CF18CC56B6BBBE2FFE5358F149A1CE58A5B3A0E3759904CB82

Function 72C7C830 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

0$z, xrefs: 72C7C915

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: 0$z
API String ID: 0-542936926
Opcode ID: 39ab586f5e999548821ca83dad873216abc4af67417f2f31f134f8ac7be989e3
Instruction ID: fd889885270086e40ddf5b8b4c13b3fbe61d8e137e366543d84bc37e0c6f9ca7
Opcode Fuzzy Hash: 39ab586f5e999548821ca83dad873216abc4af67417f2f31f134f8ac7be989e3
Instruction Fuzzy Hash: AB3105B2A193128FD340DE28C88071BBBE6EBE5724F19C92CE485A7346D376D942C7D1

Function 72C61A10 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

,-, xrefs: 72C61A64

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: ,-
API String ID: 0-1027024164
Opcode ID: f03900367e77a19023a08ba0b9c494200b74c7219e7791d8082fc1faacc84a8d
Instruction ID: 17c4aec696578ba9e098cde90741933142f691792ca22af8ae889de4bdcc28c2
Opcode Fuzzy Hash: f03900367e77a19023a08ba0b9c494200b74c7219e7791d8082fc1faacc84a8d
Instruction Fuzzy Hash: 462137A19553008BC3159F2DCC92637B7B2EFD2266F45961CE4868B352F7B4C906C7A2

Function 72C80340 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

@, xrefs: 72C803AD

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 3fbd1981f99873e8961414f5555c365cdb3ae45abda99689729feee5d24243a6
Instruction ID: b7ec70c768de17e56e89dc3da87a37ca3876c03003f63da1ad42a00031aa705a
Opcode Fuzzy Hash: 3fbd1981f99873e8961414f5555c365cdb3ae45abda99689729feee5d24243a6
Instruction Fuzzy Hash: 0B31E1725483048BD304DE58C8D266FBBF5EBD5328F14892CE69A87390D735D848CB92

Function 72C6DE07 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

ses`, xrefs: 72C6DE34

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: ses`
API String ID: 0-1601344200
Opcode ID: 5152013babc3b36c107958c39b0feab8ed73559e8af87732ea39a45d2f7c1d5d
Instruction ID: 788d1233b391264a5543285841ef2c7c1b0244deb95bf5a2a97457d7c7d9ed61
Opcode Fuzzy Hash: 5152013babc3b36c107958c39b0feab8ed73559e8af87732ea39a45d2f7c1d5d
Instruction Fuzzy Hash: 3211E6615446C28BEB178F3ACC60722BBF2AF73254F2896D8D0D2DB296C225C452CB20

Function 72C689E9 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

_^]\, xrefs: 72C68A15

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: ce722ba43f2aeab3a0f84d0b0430ad6adb0840d3dd34b49d02a5f1163e562b36
Instruction ID: 2673e8718623e2d925deb67a7ad92b2c93f2e5691cc26631207c83f3518ec5f7
Opcode Fuzzy Hash: ce722ba43f2aeab3a0f84d0b0430ad6adb0840d3dd34b49d02a5f1163e562b36
Instruction Fuzzy Hash: A501FDB1A49741C7D308CB19C59162BB7E2BBE9714F289B1CC48323749C330A8468BC6

Function 72C7FA20 Relevance: .7, Instructions: 685COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79629f29ef22bd4ebc1eca5c83dd3f0ab08e8c5b6ffb90968eb7d68a128c648a
Instruction ID: b07c347be0eacfb69f49c3365072b95aaede1369f22332d62b0442525e8467bc
Opcode Fuzzy Hash: 79629f29ef22bd4ebc1eca5c83dd3f0ab08e8c5b6ffb90968eb7d68a128c648a
Instruction Fuzzy Hash: B922F036A54251CFC718CF69CCE12AAB7A2FB99314F2E8A7DC94697341D735A841CB80

Function 72C42EB0 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1b421bc2b79de2bbf2d9608158f8ed8712bacb23e6b8d94726c066386c0b35
Instruction ID: 0a32375d3a1d55647b16bd0c5321d086532e5a21e1c2c11fbcb21c63270e763b
Opcode Fuzzy Hash: 2b1b421bc2b79de2bbf2d9608158f8ed8712bacb23e6b8d94726c066386c0b35
Instruction Fuzzy Hash: 1952B0316083458BC705CF29C4906ABBFF2BFD8358F25966DE89A57382DB35D849CB81

Function 72C473D0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e797157fb35717b6a91bbe19d3c6782b16ec68ef1e5ad1ec3f47f605a4e618f
Instruction ID: 4add6e702fd0d89cd26447fce6f14b29733f8e274ec23aa45bf60d9b6fffc25f
Opcode Fuzzy Hash: 6e797157fb35717b6a91bbe19d3c6782b16ec68ef1e5ad1ec3f47f605a4e618f
Instruction Fuzzy Hash: 9022E531A083118BC325DF1CD9816ABB7F2FFD4319F19992DD9C697285DB34A819CB82

Function 72C7FB10 Relevance: .5, Instructions: 537COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724d864883be28073fcb498bb04eecdf19646c97301887b34b55a7e1fbb0b270
Instruction ID: e142da88649eee7aa681e7f6825c91fb82782ba66ad3a767eda89586cc1c4395
Opcode Fuzzy Hash: 724d864883be28073fcb498bb04eecdf19646c97301887b34b55a7e1fbb0b270
Instruction Fuzzy Hash: B002F236B54251CFD718CF79C8E02AAB7A2FB99314F2E8A7DC94693341D735A851CB80

Function 72C7FB2A Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b8df791470a9236ed139514b4ebbc5ab66870113a63e0a438b20ff4a956eb26
Instruction ID: 2071756139c5264709a7b59ec2bf7cae01f04cc84e50c8386261bc75ef6b8ebc
Opcode Fuzzy Hash: 9b8df791470a9236ed139514b4ebbc5ab66870113a63e0a438b20ff4a956eb26
Instruction Fuzzy Hash: C3F1F436B54251CFD718CF79C8E02AAB7A2FB99314F2E8A7DC94693341D735A851CB80

Function 72C7FB28 Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f404b6d727ea3f44db5d0fec0b0c18087ee5a2b190e2d8d7592a5311162cef2
Instruction ID: 6a6510796acf800112cf2f4d056e984f6a5413076383c7bea5c99c7699e8afb2
Opcode Fuzzy Hash: 2f404b6d727ea3f44db5d0fec0b0c18087ee5a2b190e2d8d7592a5311162cef2
Instruction Fuzzy Hash: ECF1F436B54251CFD718CF79C8E02AAB7A2FB99314F2E8A7DC94693341D735A851CB80

Function 72C5D8AC Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ac5a85c8d8672ecf355c4484b4ef3f82979e43058e28f52cfc761d5e6ff929
Instruction ID: 94adaadb386d9de1292afb78d4f45c32a163eeccea043947f1958cf343dcf045
Opcode Fuzzy Hash: 91ac5a85c8d8672ecf355c4484b4ef3f82979e43058e28f52cfc761d5e6ff929
Instruction Fuzzy Hash: BBE1F4B1A00215CBCB14CF6DC8517BBBBB1FF5A310B24465CE892AB395E334E951CB94

Function 72C5D8D8 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4cf085a3c4514a62b801c5bad1c79d8bb6631f15d7e07756d7c93c0a4d17e7c
Instruction ID: 63b93cabff4c09d2a09e6cb6c6e043799797ebee9c7afe2da28500f374bfa6f0
Opcode Fuzzy Hash: a4cf085a3c4514a62b801c5bad1c79d8bb6631f15d7e07756d7c93c0a4d17e7c
Instruction Fuzzy Hash: C0E1F5B1A00615CBCB14CF6DC8517BBBBB1FF9A310B24465CE492AB395E334E952CB94

Function 72C7FE00 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f01baa346d380f1a378b02d9ce0389d71791b1e85cf68cf38a685c00bab6a7
Instruction ID: dc866b5e68b17f4a2692f623cfed3ed708e9a7d84688cc460095a5524412dea3
Opcode Fuzzy Hash: a4f01baa346d380f1a378b02d9ce0389d71791b1e85cf68cf38a685c00bab6a7
Instruction Fuzzy Hash: 7EB11036A04245CFDB14CF79C8902AEB7B2FF99314F298A6DD94A93341D735A912CB80

Function 72C806F0 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 05be47bd4888361448552ce63a8ddb3180d2f1370dbc0b76bdea39008dab90b4
Instruction ID: 1dc1042a3aee1627d0e3f188325b92c19c7e94f75c9510c209568c1d365fa6db
Opcode Fuzzy Hash: 05be47bd4888361448552ce63a8ddb3180d2f1370dbc0b76bdea39008dab90b4
Instruction Fuzzy Hash: 6481F1356043058BE715DE1DC890A2A77F2FFE9758F15C52CE8869B395EB30D891CB82

Function 72C76210 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: a19cf5af102ba576bef60c19968433c3f9aa45770e2b7ef87f6dab9ed75fdd1c
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: BE11C633A051D40ED3128D3C8440565BFE30AF3734B29439DE4B9AB3D6D6228D8A8354

Function 72C6AAC0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b5d740ace398df56c1bc651b30677a1090a792db8fb55b3a5b1b7746f8ad41c
Instruction ID: 5eaee53946b5f6a9afaa5f702f2c92959d864ade7d3f5dcaeeb3c6cdc6d676be
Opcode Fuzzy Hash: 7b5d740ace398df56c1bc651b30677a1090a792db8fb55b3a5b1b7746f8ad41c
Instruction Fuzzy Hash: 6F0171F160030297E7109E5CD5C0B37BAB9AFE5708F1C552DD80757301DB76E80AC6A1

Function 72C7C990 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1a449bc12dccc96a001ba33cf638a7af8b1c26dc328d2823da4fe9a536677627
Instruction ID: d754808561cdab0cc753ed1ae7b3bf9b2102e8a234551324c609412a5ab155d8
Opcode Fuzzy Hash: 1a449bc12dccc96a001ba33cf638a7af8b1c26dc328d2823da4fe9a536677627
Instruction Fuzzy Hash: C60126B2B502234BD711DE5ADCC0B2B7766E7F5676F298579D58267309D23088418290

Function 72C5C300 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d915abd692c596d351a76ef7c44155bf2f7634e88133afcabaf1f94f6f3ee80c
Instruction ID: 5580493ce0986b8d643997b41ad6637cc5913d1bfadd7ea23bc11d12d502a74d
Opcode Fuzzy Hash: d915abd692c596d351a76ef7c44155bf2f7634e88133afcabaf1f94f6f3ee80c
Instruction Fuzzy Hash: E6F04460104B914AD3328F3AC5643A3BFF09F23218F641A8CC5D7576D2D376E10AC798

Function 72C6C850 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0057a7699902e11f434577b59f93575e844e41ea0d416c12e73b52c1f8bfeec4
Instruction ID: e2497a706f55f70b44f9bccfec8f00309c1655201aa468638144f503e2169d61
Opcode Fuzzy Hash: 0057a7699902e11f434577b59f93575e844e41ea0d416c12e73b52c1f8bfeec4
Instruction Fuzzy Hash: BDF0F6254096C38AD705CE2AC0B0770FBB26F77208F2801DDC4C2AB683C726C9068710

Function 72C6E0DA Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction ID: 9e056d04943bacb8a78cbd18158867ad194e6dc0916b1da33885cdadbb3e157c
Opcode Fuzzy Hash: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction Fuzzy Hash: 43F06C104087D246D713463E44507B2BFF19FA3021B141BD5C8E2972CBD3059057D355

Function 72C6D116 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65b1768279325292b2893ee314312dab91274cb2d5539a2c295fc870cfa5264
Instruction ID: ffc41eb50bc6cad73c4482d9225c40615d4b4b3b09ed43ff64b60859a7f04f12
Opcode Fuzzy Hash: d65b1768279325292b2893ee314312dab91274cb2d5539a2c295fc870cfa5264
Instruction Fuzzy Hash: 760144316402828BD304CE39CDE0667FFA1EB92324F08CB8CC4568B79AC634C842C784

Function 72C4C805 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94933d0d7cd96f20976412cdcc0d02a59cdb2ada6708e11bd50c29a50730f6df
Instruction ID: 761e29128b512decff7d1cf7962268413e40153a88236dfc88259718de9f0c23
Opcode Fuzzy Hash: 94933d0d7cd96f20976412cdcc0d02a59cdb2ada6708e11bd50c29a50730f6df
Instruction Fuzzy Hash: 98C012365820C49F8214CF21CC08679B774AB1B183B34ED0CD60BD3201CB22A502CA5D

Function 72C637D6 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5b0cf78f5354a78c14233090b51dd83e2dd1980fa62fbb75c6783d4ab0329d
Instruction ID: 3d0afb36a8c57807202a859187bb3aa38cc0dd4367a7b1d4ce2235c5b7e68e58
Opcode Fuzzy Hash: bc5b0cf78f5354a78c14233090b51dd83e2dd1980fa62fbb75c6783d4ab0329d
Instruction Fuzzy Hash: 49B01270E4C202CAC308CF05C280139FAB473AF601F30B51DD04A63345C231C002CA8C

Function 72C7315D Relevance: 19.3, APIs: 1, Strings: 10, Instructions: 85COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 72C731A3

Strings

D, xrefs: 72C731DF
A, xrefs: 72C731CB
M, xrefs: 72C73221
q, xrefs: 72C731F3
B, xrefs: 72C731E9
j, xrefs: 72C73207
y, xrefs: 72C731D5
B, xrefs: 72C731C1
w, xrefs: 72C73231
K, xrefs: 72C731FD

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: InitVariant
String ID: A$B$B$D$K$M$j$q$w$y
API String ID: 1927566239-3160828158
Opcode ID: 8c47ad95a6727c3d244d84921b09de7afd8bdef561df148a6fa4fc5eb8b81bf7
Instruction ID: 154be70aee4860be1d2589a8c3391275065121c9370a5b9578b8d1f1db1250c7
Opcode Fuzzy Hash: 8c47ad95a6727c3d244d84921b09de7afd8bdef561df148a6fa4fc5eb8b81bf7
Instruction Fuzzy Hash: BB41187050CBC18AD335DB38845879EBFD16BE2224F188A9DE6E94B3E2D7788445CB53

Function 72C72A42 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 72C72A4C
VariantInit.OLEAUT32 ref: 72C72A5F

Strings

C, xrefs: 72C72B2D
C, xrefs: 72C72B0D
P, xrefs: 72C72B1D
T, xrefs: 72C72AFD

Memory Dump Source

Source File: 00000002.00000002.1739812110.0000000072C41000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C40000, based on PE: true

Associated: 00000002.00000002.1739801371.0000000072C40000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739835956.0000000072C82000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739847579.0000000072C85000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1739860083.0000000072C93000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_72c40000_aspnet_regiis.jbxd

Similarity

API ID: Variant$ClearInit
String ID: C$C$P$T
API String ID: 2610073882-3051599793
Opcode ID: ac8842b7d1af7027a5585f67b1b4638a1a3ac90b097c4fafeafb14a651bec445
Instruction ID: 6854bb69e8b5e882c9201e9ca47fc21fb8d29ca268cae6de714e15674aa5ffde
Opcode Fuzzy Hash: ac8842b7d1af7027a5585f67b1b4638a1a3ac90b097c4fafeafb14a651bec445
Instruction Fuzzy Hash: EB41C12010C7C18AD3729B38845979EBFE06BA6224F488A9DD4ED8B3D2DB754049DB63

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Leside-.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Leside-.exe.log

C:\Users\user\AppData\Roaming\gdi32.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
Leside-.exe

Function 6CE3C15E Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6CE3C20E Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6CE3C057 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6CE4075E Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 6CE0C260 Relevance: 12.3, Strings: 9, Instructions: 1058
COMMON

Function 6CE33150 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 498
COMMONLIBRARYCODE