Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe
Analysis ID:	1528588
MD5:	7da5b29a33cdab4e5a1dca996ec33a21
SHA1:	e28103e84901cfe9c3dd58c8d3583ae6031d9fa2
SHA256:	e9f7a54574090f114cbbaa06baba2912e0c61d2ade171ab0fc076ed1c785217c
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to resolve many domain names, but no domain seems valid

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe (PID: 6432 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe" MD5: 7DA5B29A33CDAB4E5A1DCA996EC33A21)

MSBuild.exe (PID: 6580 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 6396 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 3916 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 272 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["mobbipenju.stor", "studennotediw.stor", "trustterwowqm.shop", "spirittunek.stor", "clearancek.site", "dissapoiznw.stor", "eaglepawnoy.stor", "bathdoomgaz.stor", "licendfilteo.site"], "Build id": "tLYMe5--deli333"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DesusertionIp: 104.102.49.254, DesusertionIsIpv6: false, DesusertionPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6396, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49707

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:24:09.977390+0200	2054653	1	A Network Trojan was detected	192.168.2.9	49709	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:24:09.977390+0200	2049836	1	A Network Trojan was detected	192.168.2.9	49709	172.67.206.204	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:24:07.197543+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.9	64771	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:24:07.245457+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.9	64724	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:24:07.167904+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.9	52751	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:24:07.157244+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.9	56643	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:24:07.229782+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.9	60561	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:24:07.144800+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.9	50328	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:24:07.212175+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.9	50182	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:24:07.181487+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.9	62124	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:24:07.131654+0200	2056174	1	Domain Observed Used for C2 Detected	192.168.2.9	54523	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe.e30000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["mobbipenju.stor", "studennotediw.stor", "trustterwowqm.shop", "spirittunek.stor", "clearancek.site", "dissapoiznw.stor", "eaglepawnoy.stor", "bathdoomgaz.stor", "licendfilteo.site"], "Build id": "tLYMe5--deli333"}

Multi AV Scanner detection for domain / URL

Source: sergei-esenin.com	Virustotal: Detection: 11%	Perma Link
Source: eaglepawnoy.store	Virustotal: Detection: 17%	Perma Link
Source: mobbipenju.store	Virustotal: Detection: 13%	Perma Link
Source: spirittunek.store	Virustotal: Detection: 13%	Perma Link
Source: dissapoiznw.store	Virustotal: Detection: 13%	Perma Link
Source: licendfilteo.site	Virustotal: Detection: 15%	Perma Link
Source: clearancek.site	Virustotal: Detection: 17%	Perma Link
Source: bathdoomgaz.store	Virustotal: Detection: 13%	Perma Link
Source: trustterwowqm.shop	Virustotal: Detection: 13%	Perma Link
Source: studennotediw.store	Virustotal: Detection: 17%	Perma Link
Source: licendfilteo.site	Virustotal: Detection: 15%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	ReversingLabs: Detection: 39%
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Virustotal: Detection: 41%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: clearancek.site
Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: licendfilteo.site
Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: spirittunek.stor
Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bathdoomgaz.stor
Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: studennotediw.stor
Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: dissapoiznw.stor
Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: eaglepawnoy.stor
Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: mobbipenju.stor
Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: trustterwowqm.shop
Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tLYMe5--deli333

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.9:49709 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Code function: 0_2_00E49ABF FindFirstFileExW,

0_2_00E49ABF

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then jmp ecx	0_2_00EA604C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00E8C198
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00EA6140
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00E8E2E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00EA22A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00E6A268
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00E88278
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00E8C224
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov edx, dword ptr [esp]	0_2_00E5E3F7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00E6E3F3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_00E8C3AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00E8E388
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then jmp eax	0_2_00EA6343
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_00E8A438
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_00E8A438
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp byte ptr [esi], 00000000h	0_2_00E86410
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then push 00000000h	0_2_00E605B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_00E8C568
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, edi	0_2_00E866E6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7789B0CBh	0_2_00EA47F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_00E9074E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_00E72702
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	0_2_00E6C81B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_00EA49F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_00E78948
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	0_2_00E6C938
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00E90AD4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00E90AD4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00E90AD4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	0_2_00E8ABBB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00EA6B98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00EA6B98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00E7CB98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00E98B78
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00E62B08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00E9EC08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00EA0C08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then push ebx	0_2_00E72D4B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00EA6D28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00EA6D28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	0_2_00EA6EA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00EA6EA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00EA6FD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_00E7EF70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00E7AF2D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00EA1048
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00E8B175
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00E85108
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00EA5288
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then jmp ecx	0_2_00E7338E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00E85368
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00E91327
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00E91327
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00E91327
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00EA74F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then inc edi	0_2_00E734A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_00E9143A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00E9143A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00EA36EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00EA3642
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then jmp eax	0_2_00E7165F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00EA1798
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then push esi	0_2_00E8D75B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_00EA38E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00E918D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esi+40h]	0_2_00E71920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00E7FAE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	0_2_00E69AE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	0_2_00E6FA44
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00E61A58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00EA3A08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov byte ptr [esi+edx], bl	0_2_00E69BF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	0_2_00E6BB58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001C0h]	0_2_00E6FCD4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00E6BCB9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov dword ptr [esp+2Ch], ebp	0_2_00EA5EE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then cmp byte ptr [eax+01h], 00000000h	0_2_00E85EC3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_00E91FF9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	0_2_00EA3F68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0040D390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	3_2_0044676A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	3_2_00446A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	3_2_00447082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	3_2_00444170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0044A100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	3_2_00435121
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	3_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	3_2_00428230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	3_2_0042F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	3_2_004453D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	3_2_0042B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	3_2_004483B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	3_2_0042F46A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_00431410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	3_2_0042F4D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00428490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	3_2_004314B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	3_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	3_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	3_2_0043456A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_0043456A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_0041151B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edx, dword ptr [esp]	3_2_0040151F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then inc edi	3_2_004165CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0044A620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	3_2_0041463D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+40h]	3_2_0041463D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push 00000000h	3_2_004036E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebx], ax	3_2_0042F690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	3_2_0043387B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	3_2_00446816
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	3_2_0041582B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	3_2_004448C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push esi	3_2_00430883
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	3_2_0040F943
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7789B0CBh	3_2_00447920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0042D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	3_2_0040FA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	3_2_0041BA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_00434A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	3_2_0042DB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	3_2_00412B6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebx], ax	3_2_00421B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	3_2_00447B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00446B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	3_2_00422BEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	3_2_00404B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	3_2_0040CC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	3_2_00405C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_0041FCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	3_2_00449CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	3_2_00449CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	3_2_0040EC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_0043BCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi+edx], bl	3_2_0040CD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00443D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	3_2_00441D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	3_2_0040EDE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	3_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	3_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001C0h]	3_2_00412DFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	3_2_0041DD90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	3_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	3_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+2Ch], ebp	3_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	3_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	3_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	3_2_00449FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	3_2_00449FD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.9:60561 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.9:50182 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.9:64724 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.9:56643 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.9:50328 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.9:64771 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.9:62124 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.9:52751 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056174 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop) : 192.168.2.9:54523 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49709 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49709 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: mobbipenju.stor
Source: Malware configuration extractor	URLs: studennotediw.stor
Source: Malware configuration extractor	URLs: trustterwowqm.shop
Source: Malware configuration extractor	URLs: spirittunek.stor
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: dissapoiznw.stor
Source: Malware configuration extractor	URLs: eaglepawnoy.stor
Source: Malware configuration extractor	URLs: bathdoomgaz.stor
Source: Malware configuration extractor	URLs: licendfilteo.site

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: 206.23.85.13.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: clearancek.site replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mobbipenju.store replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bathdoomgaz.store replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: spirittunek.store replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: trustterwowqm.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: studennotediw.store replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eaglepawnoy.store replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dissapoiznw.store replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: licendfilteo.site replaycode: Name error (3)

Source: global traffic

TCP traffic: 192.168.2.9:60019 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 172.67.206.204 172.67.206.204

Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: trustterwowqm.shop
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PA
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=engli
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=qu55UpguGheU&l=e
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: MSBuild.exe, 00000003.00000002.1408871935.0000000001361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: MSBuild.exe, 00000003.00000002.1409148683.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/3f
Source: MSBuild.exe, 00000003.00000002.1409148683.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: MSBuild.exe, 00000003.00000002.1409148683.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiSK
Source: MSBuild.exe, 00000003.00000002.1408871935.0000000001361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 00000003.00000002.1408871935.0000000001361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: MSBuild.exe, 00000003.00000002.1408871935.0000000001361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/765611997243319006
Source: MSBuild.exe, 00000003.00000002.1408871935.000000000133D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store/

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.9:49709 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_004396A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004396A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_004396A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004396A0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E32021	0_2_00E32021
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E96078	0_2_00E96078
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E8A059	0_2_00E8A059
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E5E175	0_2_00E5E175
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E5E2D5	0_2_00E5E2D5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E62268	0_2_00E62268
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E64278	0_2_00E64278
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E5E212	0_2_00E5E212
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E96378	0_2_00E96378
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E62302	0_2_00E62302
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E68428	0_2_00E68428
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E8A438	0_2_00E8A438
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E605B8	0_2_00E605B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E6E768	0_2_00E6E768
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E94858	0_2_00E94858
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E3CAF2	0_2_00E3CAF2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E94A88	0_2_00E94A88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E7CB98	0_2_00E7CB98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E64C78	0_2_00E64C78
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E66C29	0_2_00E66C29
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00EA4DA8	0_2_00EA4DA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E68F38	0_2_00E68F38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E6F058	0_2_00E6F058
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E6B2D8	0_2_00E6B2D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00EA5288	0_2_00EA5288
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E3729C	0_2_00E3729C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E4D39B	0_2_00E4D39B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E67338	0_2_00E67338
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E9D598	0_2_00E9D598
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E65618	0_2_00E65618
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00EA1798	0_2_00EA1798
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E4572C	0_2_00E4572C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E81908	0_2_00E81908
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E67908	0_2_00E67908
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E8BADA	0_2_00E8BADA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E4BB36	0_2_00E4BB36
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E9BCB8	0_2_00E9BCB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E43C92	0_2_00E43C92
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E31D79	0_2_00E31D79
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E3FEF0	0_2_00E3FEF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E5DED8	0_2_00E5DED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040FFE0	3_2_0040FFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040C060	3_2_0040C060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00401000	3_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00447082	3_2_00447082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00409110	3_2_00409110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004491F0	3_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00412180	3_2_00412180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042D181	3_2_0042D181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004391A0	3_2_004391A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040129D	3_2_0040129D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00405340	3_2_00405340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042D181	3_2_0042D181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004073A0	3_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004483B0	3_2_004483B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040A460	3_2_0040A460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040E400	3_2_0040E400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004394A0	3_2_004394A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040B550	3_2_0040B550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042D560	3_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004305E0	3_2_004305E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004406C0	3_2_004406C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004036E0	3_2_004036E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042B69D	3_2_0042B69D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00408740	3_2_00408740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004448C0	3_2_004448C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004298E2	3_2_004298E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00411890	3_2_00411890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042E977	3_2_0042E977
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00409903	3_2_00409903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004489D7	3_2_004489D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00437980	3_2_00437980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042D9A0	3_2_0042D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042FA20	3_2_0042FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040AA30	3_2_0040AA30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00424A30	3_2_00424A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042CAF0	3_2_0042CAF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00406B60	3_2_00406B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042DB64	3_2_0042DB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00448B00	3_2_00448B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00409B1C	3_2_00409B1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00437BB0	3_2_00437BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042EC02	3_2_0042EC02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041FCC0	3_2_0041FCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0043EDE0	3_2_0043EDE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00448DE0	3_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00407DA0	3_2_00407DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00432E33	3_2_00432E33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00448ED0	3_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00447ED0	3_2_00447ED0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CB10 appears 45 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D970 appears 155 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: String function: 00E7A848 appears 155 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: String function: 00E37B80 appears 49 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: String function: 00E699E8 appears 96 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 272

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe, 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Binary or memory string: OriginalFilenameproquota.exej% vs SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Static PE information: Section: .data ZLIB complexity 0.9911726409313726

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/5@12/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00428230 CoCreateInstance,

3_2_00428230

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6432

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\8e4d4fad-a3bf-4ef2-a3b5-90501e86455d

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Command line argument: MZx	0_2_00E32021
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Command line argument: MZx	0_2_00E32021
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Command line argument: MZx	0_2_00E32021

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	ReversingLabs: Detection: 39%
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Virustotal: Detection: 41%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 272
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E72722 push eax; retf	0_2_00E72727
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E371AD push ecx; ret	0_2_00E371C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041584A push eax; retf	3_2_0041584F

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

API coverage: 4.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 368

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Code function: 0_2_00E49ABF FindFirstFileExW,

0_2_00E49ABF

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000003.00000002.1409148683.0000000001388000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSBuild.exe, 00000003.00000002.1408677400.000000000132C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_004464F0 LdrInitializeThunk,

3_2_004464F0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Code function: 0_2_00E37922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00E37922

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E32003 mov edi, dword ptr fs:[00000030h]	0_2_00E32003
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E4A64C mov eax, dword ptr fs:[00000030h]	0_2_00E4A64C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E40F2E mov ecx, dword ptr fs:[00000030h]	0_2_00E40F2E

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Code function: 0_2_00E4CC4B GetProcessHeap,

0_2_00E4CC4B

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E37610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00E37610
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E37922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E37922
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E37AAF SetUnhandledExceptionFilter,	0_2_00E37AAF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: 0_2_00E3DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E3DA73

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	String found in binary or memory: bathdoomgaz.stor
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	String found in binary or memory: spirittunek.stor
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	String found in binary or memory: dissapoiznw.stor
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	String found in binary or memory: studennotediw.stor
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	String found in binary or memory: mobbipenju.stor
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	String found in binary or memory: eaglepawnoy.stor
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	String found in binary or memory: trustterwowqm.shop
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	String found in binary or memory: licendfilteo.site
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	String found in binary or memory: clearancek.site

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44C000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44F000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45F000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 105E008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00E4C085
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: GetLocaleInfoW,	0_2_00E4622B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: EnumSystemLocalesW,	0_2_00E4C372
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: EnumSystemLocalesW,	0_2_00E4C327
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00E4C498
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: EnumSystemLocalesW,	0_2_00E4C40D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: GetLocaleInfoW,	0_2_00E4C6EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00E4C814
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00E4C9E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: GetLocaleInfoW,	0_2_00E4C91A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Code function: EnumSystemLocalesW,	0_2_00E45D7F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Code function: 0_2_00E37815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00E37815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	39%	ReversingLabs	Win32.Trojan.Mikey
SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	42%	Virustotal		Browse
SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	100%	Avira	HEUR/AGEN.1310458
SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
steamcommunity.com	0%	Virustotal	Browse
sergei-esenin.com	11%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
eaglepawnoy.store	18%	Virustotal	Browse
mobbipenju.store	14%	Virustotal	Browse
spirittunek.store	14%	Virustotal	Browse
206.23.85.13.in-addr.arpa	1%	Virustotal	Browse
dissapoiznw.store	14%	Virustotal	Browse
licendfilteo.site	16%	Virustotal	Browse
clearancek.site	18%	Virustotal	Browse
bathdoomgaz.store	14%	Virustotal	Browse
trustterwowqm.shop	14%	Virustotal	Browse
studennotediw.store	18%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl	0%	URL Reputation	safe
https://sergei-esenin.com/	0%	Virustotal		Browse
licendfilteo.site	16%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/css/	0%	Virustotal		Browse
https://studennotediw.store/	1%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PA	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.49.254	true	true	0%, Virustotal, Browse	unknown
sergei-esenin.com	172.67.206.204	true	true	11%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
trustterwowqm.shop	unknown	unknown	true	14%, Virustotal, Browse	unknown
eaglepawnoy.store	unknown	unknown	true	18%, Virustotal, Browse	unknown
bathdoomgaz.store	unknown	unknown	true	14%, Virustotal, Browse	unknown
spirittunek.store	unknown	unknown	true	14%, Virustotal, Browse	unknown
licendfilteo.site	unknown	unknown	true	16%, Virustotal, Browse	unknown
studennotediw.store	unknown	unknown	true	18%, Virustotal, Browse	unknown
mobbipenju.store	unknown	unknown	true	14%, Virustotal, Browse	unknown
clearancek.site	unknown	unknown	true	18%, Virustotal, Browse	unknown
206.23.85.13.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown
dissapoiznw.store	unknown	unknown	true	14%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware URL Reputation: malware	unknown
licendfilteo.site	true	16%, Virustotal, Browse	unknown
studennotediw.stor	true		unknown
spirittunek.stor	true		unknown
bathdoomgaz.stor	true		unknown
trustterwowqm.shop	true		unknown
dissapoiznw.stor	true		unknown
eaglepawnoy.stor	true		unknown
https://sergei-esenin.com/api	true		unknown
clearancek.site	true		unknown
mobbipenju.stor	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://sergei-esenin.com/3f	MSBuild.exe, 00000003.00000002.1409148683.0000000001388000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://sergei-esenin.com/	MSBuild.exe, 00000003.00000002.1408871935.0000000001361000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PA	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://studennotediw.store/	MSBuild.exe, 00000003.00000002.1408871935.000000000133D000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=engli	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/apiSK	MSBuild.exe, 00000003.00000002.1409148683.0000000001388000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://steamcommunity.com/	MSBuild.exe, 00000003.00000002.1408871935.0000000001361000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=qu55UpguGheU&l=e	MSBuild.exe, 00000003.00000002.1409336144.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/765611997243319006	MSBuild.exe, 00000003.00000002.1408871935.0000000001361000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true
172.67.206.204	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528588
Start date and time:	2024-10-08 03:23:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/5@12/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 68% Number of executed functions: 12 Number of non-executed functions: 156
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.140, 40.126.32.138, 20.190.160.14, 40.126.32.74, 20.190.160.22, 40.126.32.72, 40.126.32.76, 40.126.32.133, 52.168.117.173, 4.245.163.56, 192.229.221.95, 40.69.42.241, 13.95.31.18, 13.85.23.206, 4.175.87.197
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:24:06	API Interceptor	2x Sleep call for process: MSBuild.exe modified
21:24:11	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
172.67.206.204	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
fp2e7a.wpc.phicdn.net	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse	192.229.221.95
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	192.229.221.95
	DocuSign2.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	ylVAEHbMLf.exe	Get hash	malicious	Xmrig	Browse	192.229.221.95
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	192.229.221.95
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	2ngxhElaud.exe	Get hash	malicious	Xmrig	Browse	172.67.173.168
	copyright_infringement_evidence_1.exe	Get hash	malicious	Unknown	Browse	172.67.158.129
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	Copyright_Infringement_Evidence.exe	Get hash	malicious	Unknown	Browse	172.67.158.129
	ArT23Ix6Ox.exe	Get hash	malicious	Unknown	Browse	172.67.159.186
	cqKYl7T4CR.exe	Get hash	malicious	Unknown	Browse	104.21.9.92
	ArT23Ix6Ox.exe	Get hash	malicious	Unknown	Browse	104.21.9.92
	cqKYl7T4CR.exe	Get hash	malicious	Unknown	Browse	172.67.159.186
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	copyright_infringement_evidence_1.exe	Get hash	malicious	Unknown	Browse	23.47.168.24
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Copyright_Infringement_Evidence.exe	Get hash	malicious	Unknown	Browse	96.17.64.189
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	104.102.49.254 172.67.206.204
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_1b82bec763645d16ab9c0b439f8b0a42b432fae_974fe18f_a875a024-b057-4196-baf7-1056fcad35d7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7024064719939977
Encrypted:	false
SSDEEP:	96:d4F4boV6z+0LnyFsv9yLvfAWf8QXIDcQvc6QcEVcw3cE/jLXLz+HbHg/5hZAX/dN:GGo8z+vFd0BU/HDMjhzuiFYZ24IO8SI
MD5:	FFEAAD7CD3968D93A122AEE55697C3F1
SHA1:	50BCFD952C31269A961A9EBA5BB5B4BD31A1835B
SHA-256:	726E9358F3D0FEC1F3F7BBA21A0F3D0C4EFD00DCDFBBAAC77EBFC33C67C3B43A
SHA-512:	9A16EEEC5B86C1C8B1DDB6DDFE3CD14E689606EAFE2D9E92170D131BA21192D124BA1D270BF8F3E8F28F5E36E2797E70812C807482AB07C929638A13EE2D4BEB
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.2.4.2.4.6.4.4.1.4.6.0.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.2.4.2.4.6.7.5.3.9.6.4.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.8.7.5.a.0.2.4.-.b.0.5.7.-.4.1.9.6.-.b.a.f.7.-.1.0.5.6.f.c.a.d.3.5.d.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.5.5.c.5.2.f.e.-.e.6.b.b.-.4.7.1.6.-.a.5.6.7.-.3.f.e.2.c.c.a.5.9.7.4.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...D.o.w.n.L.o.a.d.e.r.4.7...4.3.3.4.0...2.7.4.6.9...3.0.3.5.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.2.0.-.0.0.0.1.-.0.0.1.4.-.8.9.7.6.-.2.f.c.4.2.0.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER81D3.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 01:24:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	35022
Entropy (8bit):	1.6911153552579334
Encrypted:	false
SSDEEP:	192:+E5MrOJg0W/2z6eG3//jYkKqLEYCzk7X:zZJdSYU9NLEP
MD5:	132848499C26900D9B6B77F1DBB5D33A
SHA1:	B43FE824F63B2B0284620E3A875117E0A169D83E
SHA-256:	D1008A9281A5ECA1F71A8E90FB72B186201ADEA35D69842F504FA256F10EECA6
SHA-512:	5C4EC3AF39D6B87E29674A616A2DA3E6D4507FFFA4C2431EE20ED4B077CB922FF6DF8A6889FC440210A21CAD4F0A7FEA3D17AD200EADAF48CA25C9BF4276B0F0
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T................}......................................................................................................eJ..............GenuineIntel............T....... ......g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8232.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8590
Entropy (8bit):	3.701516472357159
Encrypted:	false
SSDEEP:	192:R6l7wVeJKv6a6YcDgSUfzIJgmffkE0prr89bWmsf0U2ym:R6lXJa6a6Y3SUr2gmffkEtWFfK
MD5:	4E6990261A11141AB6E62A1C91F2011E
SHA1:	EDF4C8CE191205BAA98D2E74361AD585765D862D
SHA-256:	30C2893CCE1052F7BDB15B5D7DDCF27B338A12CF69FEBC639D06AB071A2605D0
SHA-512:	1918CABED43F31840A2E0729D541BF2055343B65AEDB12BD0D3B0AB5222A5540DCA3D8BFD9F0F6EA25B7D048645F666B6F65E35DB3134D2544F727CF941C1309
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8262.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4986
Entropy (8bit):	4.600314152835714
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9w7WpW8VYP1Ym8M4Jgf4NdFs+q8xMVQYabSmSXd:uIjf8I7CK7VCEJgfsUwMRabSmSXd
MD5:	9947356AC2B1D17239DFD641E2AABDFC
SHA1:	F7A7450C141BF0E3A7465EFE4B2D46B90639D143
SHA-256:	6C331F887DBF9DBFB95C48FF209139DA882CC4C33DE2035C4953D9F012C4D042
SHA-512:	92A7008694C6211796F82A887D67CC3793D72FF46E2A406446E49C63089EB26CCCBAD1FB43969E57992ADE87B6F5E6AD10F59613F0E67672E625486F776E93CD
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533786" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.394799089910549
Encrypted:	false
SSDEEP:	6144:gl4fiJoH0ncNXiUjt10qFG/gaocYGBoaUMMhA2NX4WABlBuNA+OBSqa:44vFFMYQUMM6VFYS+U
MD5:	D94DF5F2E0EF7AC46642B99B0A60375C
SHA1:	9BD3D6C1EB41D153FB9890E7CDD641023FDA1864
SHA-256:	7654803166B21282E952448873EF8615235388984B8F46FEFAC0B2169EBEE6D2
SHA-512:	224FBE69AE2A21B55F616194F6DC913391F2B78718A48FAF5057970E9A371B006AA32B8D6B97C737D835702D921A63DE0E675DB3AF299D1B07356D74E4C817A7
Malicious:	false
Reputation:	low
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.... ...............................................................................................................................................................................................................................................................................................................................................4.h.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.7224526627229455
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe
File size:	550'912 bytes
MD5:	7da5b29a33cdab4e5a1dca996ec33a21
SHA1:	e28103e84901cfe9c3dd58c8d3583ae6031d9fa2
SHA256:	e9f7a54574090f114cbbaa06baba2912e0c61d2ade171ab0fc076ed1c785217c
SHA512:	dd4a03b3c430547a9e68db4bf91f94653f84879fdcf00ac24f62291cf5c30829096569d7cd5ab42bbf63e0e03c8c42b580e28c2007a7b296f564122cfed130d8
SSDEEP:	12288:A90Q9bcUr0Kv8MZzSZGGvoBlcuykDZCAuW0iZ4H4S:AvbcpMRSxpktvT4Y
TLSH:	6EC4021575C0C072E5B315320AF0EAB45A7EF9A00A669EDF67880F7F4B305D0E725AA7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x670467F5 [Mon Oct 7 23:00:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007FB4D910BF10h
jmp 00007FB4D910B47Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FB4D910B61Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FB4D910B60Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007FB4D910B60Eh
add edx, 28h
cmp edx, esi
jne 00007FB4D910B5ECh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007FB4D910B5FBh
push esi
call 00007FB4D910C224h
test eax, eax
je 00007FB4D910B622h
mov eax, dword ptr fs:[00000018h]
mov esi, 0048655Ch
mov edx, dword ptr [eax+04h]
jmp 00007FB4D910B606h
cmp edx, eax
je 00007FB4D910B612h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007FB4D910B5F2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007FB4D910B609h
mov byte ptr [00486560h], 00000001h
call 00007FB4D910B8BAh
call 00007FB4D910E7D7h
test al, al
jne 00007FB4D910B606h
xor al, al
pop ebp
ret
call 00007FB4D9117239h
test al, al
jne 00007FB4D910B60Ch
push 00000000h
call 00007FB4D910E7DEh
pop ecx
jmp 00007FB4D910B5EBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00486561h], 00000000h
je 00007FB4D910B606h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x89000	0x1ad8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	432a6f4821dcf831ac04d651989b8210	False	0.5865639740566038	data	6.667052687296067	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	ea735719de5f1fbf0b05c80975a258de	False	0.43517602848101267	data	4.957696870793669	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x5a188	0x59400	b9c4630506dab9113835d7711d83fd72	False	0.9911726409313726	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.992613980358461	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x88000	0x3d8	0x400	c67ba8481d4e7c92e5fe9f152983a3f3	False	0.439453125	data	3.287044161603086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x89000	0x1ad8	0x1c00	45a933f459cf2411c3beb34de2684b0d	False	0.7268415178571429	data	6.390275449386977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x88058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T03:24:07.131654+0200	2056174	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop)	1	192.168.2.9	54523	1.1.1.1	53	UDP
2024-10-08T03:24:07.144800+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.9	50328	1.1.1.1	53	UDP
2024-10-08T03:24:07.157244+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.9	56643	1.1.1.1	53	UDP
2024-10-08T03:24:07.167904+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.9	52751	1.1.1.1	53	UDP
2024-10-08T03:24:07.181487+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.9	62124	1.1.1.1	53	UDP
2024-10-08T03:24:07.197543+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.9	64771	1.1.1.1	53	UDP
2024-10-08T03:24:07.212175+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.9	50182	1.1.1.1	53	UDP
2024-10-08T03:24:07.229782+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.9	60561	1.1.1.1	53	UDP
2024-10-08T03:24:07.245457+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.9	64724	1.1.1.1	53	UDP
2024-10-08T03:24:09.977390+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49709	172.67.206.204	443	TCP
2024-10-08T03:24:09.977390+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49709	172.67.206.204	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 03:24:01.141916037 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.179049969 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.179064035 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.179116011 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.181555033 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.181626081 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.186386108 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.192037106 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.193908930 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.199156046 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.199167013 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.199223995 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.201009989 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.201045036 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.205883026 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.279764891 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.279784918 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.279851913 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.282610893 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.282671928 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.287452936 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.296556950 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.298612118 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.301784039 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.301798105 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.301853895 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.303517103 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.303591967 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.308322906 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.353882074 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.413355112 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.415920973 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.415956974 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.415992975 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.416146994 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.416162968 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.416199923 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.416229963 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.416277885 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.418556929 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.418911934 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.419084072 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.419894934 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.420948029 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.423674107 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.423719883 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.423831940 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.424721003 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.514674902 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.517235041 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.517247915 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.517332077 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.517728090 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.519552946 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.519633055 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.519645929 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.519661903 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.519711018 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.521677017 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.521760941 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.522509098 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.524447918 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.524466991 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.526472092 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.526483059 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.620569944 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.623128891 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.625197887 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.625211954 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.625281096 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.627055883 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.627978086 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.631881952 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.722157955 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.722173929 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.722239017 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.725172043 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.725200891 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.725693941 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.728427887 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.728441000 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.728507996 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.730006933 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.730415106 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.730467081 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.733005047 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.736278057 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.736288071 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.824443102 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.825944901 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.826215982 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.827832937 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.827888012 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.832603931 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.832689047 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.883219004 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.883234978 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.883341074 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.885960102 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.886260033 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.890849113 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.891016960 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.916510105 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.926498890 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.926516056 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.926616907 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.930721998 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.934602022 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.939577103 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.962502956 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:01.990830898 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.990848064 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:01.990966082 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.037756920 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.037798882 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.037938118 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.089911938 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.137100935 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.215255022 CEST	49676	443	192.168.2.9	23.206.229.209
Oct 8, 2024 03:24:02.215269089 CEST	49675	443	192.168.2.9	23.206.229.209
Oct 8, 2024 03:24:02.243437052 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.244616032 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.245193958 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.246252060 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.247193098 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.249483109 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.251172066 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.293883085 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.342864037 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.345371962 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.345426083 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.345581055 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.348167896 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.353064060 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.379731894 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.386061907 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.402734995 CEST	49674	443	192.168.2.9	23.206.229.209
Oct 8, 2024 03:24:02.409209013 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.414179087 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.433381081 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.433413982 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.433515072 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.462759018 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.477704048 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.489289999 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.505156994 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.538544893 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.541352987 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.546235085 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.558695078 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.585002899 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.585120916 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.596194029 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.597640038 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.602622986 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.634413958 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.634444952 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.634557962 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.636929989 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.672749043 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.673391104 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.678209066 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.678467989 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.698520899 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.698559046 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.698596001 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.698612928 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.698658943 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.712272882 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.715282917 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.720230103 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.743838072 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.775127888 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.775146008 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.775204897 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.810946941 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.827341080 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.828936100 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.833909988 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.842453957 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.850177050 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.866898060 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.873683929 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.877089977 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.882215023 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.928551912 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.928566933 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.928672075 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.947530985 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.948571920 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:02.953342915 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.969644070 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.977689028 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.977729082 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:02.977770090 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.005475044 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.016967058 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.021928072 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.035717964 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.065876007 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.065988064 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.066056967 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.112737894 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.131231070 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.131463051 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.156399012 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.182106018 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.190243959 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.195121050 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.260210991 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.260546923 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.265393972 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.273838043 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.280112982 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.324728966 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.351656914 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.355710983 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.360605001 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.360618114 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.360701084 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.363009930 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.364042997 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.364804983 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.368861914 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.409938097 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.416501999 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.420588017 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.425501108 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.458681107 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.462001085 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.467103004 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.467124939 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.467192888 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.469970942 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.470227957 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.474965096 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.516278982 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.518656015 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.557966948 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.561264992 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.570135117 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.570194006 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.570246935 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.572822094 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.576091051 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.580882072 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.616839886 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.619580030 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.666568041 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.670703888 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.677366018 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.679464102 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.687539101 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.687824965 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.687880993 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.690269947 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.691063881 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.695863962 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.768651009 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.772291899 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.776191950 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.776310921 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.780070066 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.785990000 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.786784887 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.789635897 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.792637110 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.792711973 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.792818069 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.792872906 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.796158075 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.796348095 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.801220894 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.875811100 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.878694057 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.882131100 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.884049892 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.889046907 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.891973019 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.896842003 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.899275064 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.899338007 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.899549007 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.899597883 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.902076960 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.902559042 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.907186985 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.953919888 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.979818106 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.982975006 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.988100052 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.989299059 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:03.991569996 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:03.997934103 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.000273943 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.004215002 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.004295111 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.004467964 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.004534006 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.006517887 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.006867886 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.027638912 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.090451002 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.093847036 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.096024990 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.098207951 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.103092909 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.117218971 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.119920015 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.120299101 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.120491028 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.121205091 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.121263027 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.124372005 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.124432087 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.129281998 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.169935942 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.204624891 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.207974911 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.210967064 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.212852001 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.213267088 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.218135118 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.219894886 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.222021103 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.225660086 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.225742102 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.225836039 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.225891113 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.228146076 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.228239059 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.233212948 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.324110031 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.326741934 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.326826096 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.326875925 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.327215910 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.329257965 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.329296112 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.329339027 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.329358101 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.329490900 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.329541922 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.331485033 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.331571102 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.334912062 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.336857080 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.377855062 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.426075935 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.429039001 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.429255962 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.429255962 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.429353952 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.431020975 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.431102037 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.431143045 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.431194067 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.431647062 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.431726933 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.433716059 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.434004068 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.434171915 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.436499119 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.438590050 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.438787937 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.527899027 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.530304909 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.530498028 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.530498028 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.530920029 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.532584906 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.532661915 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.532689095 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.534550905 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.535182953 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.535399914 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.535526037 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.536019087 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.539468050 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.539977074 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.540262938 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.541038990 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.674048901 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.677086115 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.677098036 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.677126884 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.677139997 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.677155972 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.677156925 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.677186966 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.677222013 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.679941893 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.679970026 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.680620909 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.680752993 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.683192015 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.684803009 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.684861898 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.685410976 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.685616016 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.776411057 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.779098988 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.779234886 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.779252052 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.779298067 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.781641006 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.781658888 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.781682014 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.781718969 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.781841993 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.784053087 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.784682989 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.784739017 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.785454035 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:04.786629915 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.789535999 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.789629936 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:04.790358067 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.012761116 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.012789011 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.012800932 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.012816906 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.012830019 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.012897015 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.012998104 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.019898891 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.020713091 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.021317959 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.021764040 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.022140980 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.024826050 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.025552988 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.026073933 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.026561022 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.026881933 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.118439913 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.121437073 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.121448994 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.121500015 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.122129917 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.122174978 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.122267008 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.154330015 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.154751062 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.154989004 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.155307055 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.155535936 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.159552097 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.159564018 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.159686089 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.160033941 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.160233974 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.252970934 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.253017902 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.253089905 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.255331039 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.255702019 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.255747080 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.257286072 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.258721113 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.259715080 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.262151957 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.263562918 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.264628887 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.346271038 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.349442959 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.349570990 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.354293108 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.354326010 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.358498096 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.358537912 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.358604908 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.361682892 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.362682104 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.367764950 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.402702093 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 8, 2024 03:24:05.447412968 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.449992895 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.454901934 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.454915047 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.454998970 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.457254887 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.457592964 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.462120056 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.482568026 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.482582092 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.482645988 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.485084057 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.485174894 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.489937067 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.585038900 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.588325977 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.590154886 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.590167999 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.590202093 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.590219021 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.592858076 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.592921972 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.592936993 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.592976093 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.593472004 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.595382929 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.598267078 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.598676920 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.600331068 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.603526115 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.645848989 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.690706015 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.694017887 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.694478989 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.696885109 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.698890924 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.699903965 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.699915886 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.699958086 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.702220917 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.702755928 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.707062960 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.753902912 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.784904957 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.787334919 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.792370081 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.795847893 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.795859098 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.795901060 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.798396111 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.798515081 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.803313971 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.805028915 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.805042028 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.805083036 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.807248116 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.807339907 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.812184095 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.893982887 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.898255110 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.898504972 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.898514986 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.898525953 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.898591995 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.901065111 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.901783943 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.905848980 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.923748016 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.923762083 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:05.923821926 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.927859068 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.928786039 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:05.933651924 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.053209066 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.057059050 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.059890985 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.059962034 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.060024023 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.062206030 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.062268019 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.066989899 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.073164940 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.073179960 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.073246956 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.075817108 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.076703072 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.081495047 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.157697916 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.160327911 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.163975000 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.164043903 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.166110039 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.171005011 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.171380043 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.173273087 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.181330919 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.181349993 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.181401014 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.183433056 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.183590889 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.188458920 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.261940002 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.265002012 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.268843889 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.268903017 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.271095037 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.271662951 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.273678064 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.278585911 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.284604073 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.284661055 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.284713030 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.289251089 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.290333986 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.295156956 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.369385958 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.371974945 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.372579098 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.372641087 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.372663021 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.372684956 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.374793053 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.374914885 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.379735947 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.389730930 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.389772892 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.389843941 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.392127991 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.392211914 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.397056103 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.470515013 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.473048925 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.478303909 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.478354931 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.478699923 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.481107950 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.481232882 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.486071110 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.492640018 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.492652893 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.492696047 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.494788885 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.494883060 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.499629021 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.576899052 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.581459999 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.581562996 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.581688881 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.593619108 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.593631983 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.593707085 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.606442928 CEST	49673	443	192.168.2.9	204.79.197.203
Oct 8, 2024 03:24:06.812316895 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.812364101 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.813239098 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.813461065 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.814416885 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.819164991 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.862656116 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.927150965 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.927186012 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.927231073 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.927830935 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.928325891 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.928384066 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.936969042 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.938141108 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.939354897 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.940300941 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:06.942141056 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.943350077 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.944164038 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:06.945106030 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.032032013 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.059879065 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.064933062 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.086770058 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.086787939 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.086798906 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.086834908 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.103945971 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.111284971 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.116271973 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.156915903 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.157058954 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.157119989 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.160320044 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.161469936 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.166300058 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.178102016 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.181864023 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.206994057 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.214925051 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.257122040 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.260787964 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.262015104 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.262022018 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.262135983 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.272367001 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:07.272416115 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:07.272484064 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:07.276834011 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:07.276858091 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:07.277394056 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.277880907 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.283509970 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.312071085 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.314699888 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.314759016 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.314848900 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.319061995 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.323785067 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.329791069 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.359369040 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.359406948 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.359417915 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.359525919 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.363565922 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.379096031 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.379242897 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.379254103 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.379293919 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.382972956 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.384260893 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.389180899 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.420717955 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.421907902 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.421971083 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.424052954 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.452588081 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.455419064 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.472420931 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.474371910 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.484663010 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.484682083 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.484735012 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.487968922 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.488779068 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.493611097 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.551357031 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.555306911 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.570445061 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.575321913 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.575372934 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.591819048 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.591913939 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.591958046 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.666315079 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:24:07.715317965 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:24:07.928064108 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:07.928133965 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:07.934983015 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:07.934993982 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:07.935300112 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:07.980794907 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:08.135567904 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:08.179403067 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:08.756198883 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:08.756262064 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:08.756287098 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:08.756314993 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:08.756330967 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:08.756340027 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:08.756349087 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:08.756356955 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:08.756390095 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:08.863440990 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:08.863511086 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:08.863545895 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:08.863554955 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:08.863605022 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:08.869064093 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:08.869131088 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:08.869172096 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:08.869226933 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:08.869235992 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:08.869322062 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:08.869482994 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:08.870213032 CEST	49707	443	192.168.2.9	104.102.49.254
Oct 8, 2024 03:24:08.870222092 CEST	443	49707	104.102.49.254	192.168.2.9
Oct 8, 2024 03:24:09.065902948 CEST	49709	443	192.168.2.9	172.67.206.204
Oct 8, 2024 03:24:09.065953016 CEST	443	49709	172.67.206.204	192.168.2.9
Oct 8, 2024 03:24:09.066054106 CEST	49709	443	192.168.2.9	172.67.206.204
Oct 8, 2024 03:24:09.066329002 CEST	49709	443	192.168.2.9	172.67.206.204
Oct 8, 2024 03:24:09.066340923 CEST	443	49709	172.67.206.204	192.168.2.9
Oct 8, 2024 03:24:09.537797928 CEST	443	49709	172.67.206.204	192.168.2.9
Oct 8, 2024 03:24:09.537904978 CEST	49709	443	192.168.2.9	172.67.206.204
Oct 8, 2024 03:24:09.539519072 CEST	49709	443	192.168.2.9	172.67.206.204
Oct 8, 2024 03:24:09.539535046 CEST	443	49709	172.67.206.204	192.168.2.9
Oct 8, 2024 03:24:09.539829016 CEST	443	49709	172.67.206.204	192.168.2.9
Oct 8, 2024 03:24:09.541081905 CEST	49709	443	192.168.2.9	172.67.206.204
Oct 8, 2024 03:24:09.541081905 CEST	49709	443	192.168.2.9	172.67.206.204
Oct 8, 2024 03:24:09.541151047 CEST	443	49709	172.67.206.204	192.168.2.9
Oct 8, 2024 03:24:09.977406025 CEST	443	49709	172.67.206.204	192.168.2.9
Oct 8, 2024 03:24:09.977509975 CEST	443	49709	172.67.206.204	192.168.2.9
Oct 8, 2024 03:24:09.977565050 CEST	49709	443	192.168.2.9	172.67.206.204
Oct 8, 2024 03:24:09.977859020 CEST	49709	443	192.168.2.9	172.67.206.204
Oct 8, 2024 03:24:09.977859020 CEST	49709	443	192.168.2.9	172.67.206.204
Oct 8, 2024 03:24:09.977878094 CEST	443	49709	172.67.206.204	192.168.2.9
Oct 8, 2024 03:24:09.977888107 CEST	443	49709	172.67.206.204	192.168.2.9
Oct 8, 2024 03:24:11.824582100 CEST	49676	443	192.168.2.9	23.206.229.209
Oct 8, 2024 03:24:11.824609995 CEST	49675	443	192.168.2.9	23.206.229.209
Oct 8, 2024 03:24:12.012049913 CEST	49674	443	192.168.2.9	23.206.229.209
Oct 8, 2024 03:24:13.746798992 CEST	443	49704	23.206.229.209	192.168.2.9
Oct 8, 2024 03:24:13.748315096 CEST	49704	443	192.168.2.9	23.206.229.209
Oct 8, 2024 03:24:15.012093067 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 8, 2024 03:24:37.894644022 CEST	60019	53	192.168.2.9	162.159.36.2
Oct 8, 2024 03:24:37.899524927 CEST	53	60019	162.159.36.2	192.168.2.9
Oct 8, 2024 03:24:37.899612904 CEST	60019	53	192.168.2.9	162.159.36.2
Oct 8, 2024 03:24:37.899645090 CEST	60019	53	192.168.2.9	162.159.36.2
Oct 8, 2024 03:24:37.904473066 CEST	53	60019	162.159.36.2	192.168.2.9
Oct 8, 2024 03:24:38.362998009 CEST	53	60019	162.159.36.2	192.168.2.9
Oct 8, 2024 03:24:38.363842964 CEST	60019	53	192.168.2.9	162.159.36.2
Oct 8, 2024 03:24:38.369229078 CEST	53	60019	162.159.36.2	192.168.2.9
Oct 8, 2024 03:24:38.369281054 CEST	60019	53	192.168.2.9	162.159.36.2
Oct 8, 2024 03:24:55.293761969 CEST	49705	80	192.168.2.9	199.232.214.172
Oct 8, 2024 03:24:55.299968004 CEST	80	49705	199.232.214.172	192.168.2.9
Oct 8, 2024 03:24:55.300079107 CEST	49705	80	192.168.2.9	199.232.214.172
Oct 8, 2024 03:25:37.654953003 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:25:37.655036926 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 8, 2024 03:25:37.655107021 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:25:37.656219006 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 8, 2024 03:25:37.661041021 CEST	443	49706	13.107.246.45	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 03:24:07.131654024 CEST	54523	53	192.168.2.9	1.1.1.1
Oct 8, 2024 03:24:07.139781952 CEST	53	54523	1.1.1.1	192.168.2.9
Oct 8, 2024 03:24:07.144799948 CEST	50328	53	192.168.2.9	1.1.1.1
Oct 8, 2024 03:24:07.154370070 CEST	53	50328	1.1.1.1	192.168.2.9
Oct 8, 2024 03:24:07.157243967 CEST	56643	53	192.168.2.9	1.1.1.1
Oct 8, 2024 03:24:07.165565014 CEST	53	56643	1.1.1.1	192.168.2.9
Oct 8, 2024 03:24:07.167903900 CEST	52751	53	192.168.2.9	1.1.1.1
Oct 8, 2024 03:24:07.177496910 CEST	53	52751	1.1.1.1	192.168.2.9
Oct 8, 2024 03:24:07.181487083 CEST	62124	53	192.168.2.9	1.1.1.1
Oct 8, 2024 03:24:07.195004940 CEST	53	62124	1.1.1.1	192.168.2.9
Oct 8, 2024 03:24:07.197542906 CEST	64771	53	192.168.2.9	1.1.1.1
Oct 8, 2024 03:24:07.205498934 CEST	53	64771	1.1.1.1	192.168.2.9
Oct 8, 2024 03:24:07.212174892 CEST	50182	53	192.168.2.9	1.1.1.1
Oct 8, 2024 03:24:07.227091074 CEST	53	50182	1.1.1.1	192.168.2.9
Oct 8, 2024 03:24:07.229782104 CEST	60561	53	192.168.2.9	1.1.1.1
Oct 8, 2024 03:24:07.239342928 CEST	53	60561	1.1.1.1	192.168.2.9
Oct 8, 2024 03:24:07.245456934 CEST	64724	53	192.168.2.9	1.1.1.1
Oct 8, 2024 03:24:07.255074978 CEST	53	64724	1.1.1.1	192.168.2.9
Oct 8, 2024 03:24:07.256771088 CEST	52386	53	192.168.2.9	1.1.1.1
Oct 8, 2024 03:24:07.264539003 CEST	53	52386	1.1.1.1	192.168.2.9
Oct 8, 2024 03:24:08.872163057 CEST	52476	53	192.168.2.9	1.1.1.1
Oct 8, 2024 03:24:09.060667992 CEST	53	52476	1.1.1.1	192.168.2.9
Oct 8, 2024 03:24:37.894084930 CEST	53	53269	162.159.36.2	192.168.2.9
Oct 8, 2024 03:24:38.375227928 CEST	50887	53	192.168.2.9	1.1.1.1
Oct 8, 2024 03:24:38.382101059 CEST	53	50887	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 03:24:07.131654024 CEST	192.168.2.9	1.1.1.1	0x91ee	Standard query (0)	trustterwowqm.shop	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.144799948 CEST	192.168.2.9	1.1.1.1	0x79	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.157243967 CEST	192.168.2.9	1.1.1.1	0x22f	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.167903900 CEST	192.168.2.9	1.1.1.1	0x2b5e	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.181487083 CEST	192.168.2.9	1.1.1.1	0xf461	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.197542906 CEST	192.168.2.9	1.1.1.1	0x76bd	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.212174892 CEST	192.168.2.9	1.1.1.1	0x1915	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.229782104 CEST	192.168.2.9	1.1.1.1	0x59dc	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.245456934 CEST	192.168.2.9	1.1.1.1	0x2213	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.256771088 CEST	192.168.2.9	1.1.1.1	0x3023	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:08.872163057 CEST	192.168.2.9	1.1.1.1	0x1edb	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:38.375227928 CEST	192.168.2.9	1.1.1.1	0x9b63	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 03:24:07.139781952 CEST	1.1.1.1	192.168.2.9	0x91ee	Name error (3)	trustterwowqm.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.154370070 CEST	1.1.1.1	192.168.2.9	0x79	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.165565014 CEST	1.1.1.1	192.168.2.9	0x22f	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.177496910 CEST	1.1.1.1	192.168.2.9	0x2b5e	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.195004940 CEST	1.1.1.1	192.168.2.9	0xf461	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.205498934 CEST	1.1.1.1	192.168.2.9	0x76bd	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.227091074 CEST	1.1.1.1	192.168.2.9	0x1915	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.239342928 CEST	1.1.1.1	192.168.2.9	0x59dc	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.255074978 CEST	1.1.1.1	192.168.2.9	0x2213	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:07.264539003 CEST	1.1.1.1	192.168.2.9	0x3023	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:09.060667992 CEST	1.1.1.1	192.168.2.9	0x1edb	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:09.060667992 CEST	1.1.1.1	192.168.2.9	0x1edb	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:22.992244959 CEST	1.1.1.1	192.168.2.9	0x21e0	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 03:24:22.992244959 CEST	1.1.1.1	192.168.2.9	0x21e0	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:35.879281044 CEST	1.1.1.1	192.168.2.9	0xe865	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 03:24:35.879281044 CEST	1.1.1.1	192.168.2.9	0xe865	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:38.382101059 CEST	1.1.1.1	192.168.2.9	0x9b63	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49707	104.102.49.254	443	6396	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:24:08 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-08 01:24:08 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 08 Oct 2024 01:24:08 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=70d597e5ae21164e63d5ac05; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-08 01:24:08 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-08 01:24:08 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-08 01:24:08 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-08 01:24:08 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49709	172.67.206.204	443	6396	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:24:09 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-08 01:24:09 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-08 01:24:09 UTC	772	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:24:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gc8e50agt4nofhe6a5kcdgs872; expires=Fri, 31 Jan 2025 19:10:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g7lJkEUCWpWYZJQXnJz0Yuzf5PCoCaKfSK6WTs7aDY6oagE%2FD264tRjUjj%2F2VBB67G1dPVttJYzPIYhaFFK7C9lN2zBiSFqOqr4L6uUumr7fzrSL2uHY1isJoeqzK0EdQHi7ig%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf25467fbfd0f64-EWR
2024-10-08 01:24:09 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-08 01:24:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	21:24:05
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe"
Imagebase:	0xe30000
File size:	550'912 bytes
MD5 hash:	7DA5B29A33CDAB4E5A1DCA996EC33A21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:24:06
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xe0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:24:06
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xec0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:24:06
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 272
Imagebase:	0xc60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	3

Executed Functions

Function 00E32021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00EB58D8,?,00000040,?), ref: 00E32738

Strings

a, xrefs: 00E32296
MZx, xrefs: 00E3274B, 00E32757, 00E3275C
', xrefs: 00E32718
S, xrefs: 00E3206A

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID: '$MZx$S$a
API String ID: 544645111-3057195942
Opcode ID: 33db22513b77f2b9514d9d69131df4c105dc13b6bbcdbcf8b82b1cf03badab28
Instruction ID: 2df8a51b522ed05d4adb7047f9c417fc192d650909a8b9ee831270f6adf1d347
Opcode Fuzzy Hash: 33db22513b77f2b9514d9d69131df4c105dc13b6bbcdbcf8b82b1cf03badab28
Instruction Fuzzy Hash: C5F1E337934E1B06D70860394D5A2F69D4ADBEA330F91633ABFA2B73F4E3590941D285

Function 00E46368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00E48F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00E4639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00E48F1C,?,?,00000000,?,00000000), ref: 00E463BA

Strings

R[, xrefs: 00E46396

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: String
String ID: R[
API String ID: 2568140703-3972925902
Opcode ID: 09c93fb3f24e4723df6e55f15d20bc910171a099c46e0e21ee3a994be784a300
Instruction ID: 6bde0e5dd0e77556ba78fcf0ef52b8a4fc67b95992dd4f58f23f00499cc324ea
Opcode Fuzzy Hash: 09c93fb3f24e4723df6e55f15d20bc910171a099c46e0e21ee3a994be784a300
Instruction Fuzzy Hash: D4F07A3300029ABBCF125FA1EC05DDE3F66EF893A1F059010FA1865020C732D975AB91

Function 00E48E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00E48FDD

Part of subcall function 00E43A83: HeapAlloc.KERNEL32(00000000,00E4A1AA,?,?,00E4A1AA,00000220,?,?,?), ref: 00E43AB5

__freea.LIBCMT ref: 00E48FF2
__freea.LIBCMT ref: 00E49002

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 8c76ccc405e8e08347163a64079715d6cb6f197f70572c7e22287a15caa69c4c
Instruction ID: 5c13b10852ccfac47da28c63d67636619eda0ab6d4405e0c43aa1a33bb557b48
Opcode Fuzzy Hash: 8c76ccc405e8e08347163a64079715d6cb6f197f70572c7e22287a15caa69c4c
Instruction Fuzzy Hash: 1451DE7260020AAFEF219FA4ED85EBF3AEAEB44354F152129FD08F6150EB31CC048660

Function 00E4A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E49ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00E49F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00E4A1ED,?,00000000,?,?,?), ref: 00E4A407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00E4A1ED,?,00000000,?,?,?), ref: 00E4A449

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 33b19a16e8227f1ddd71ed6027ec1cd6e3cf6f6d11cb03eaf3c5c1506cc28609
Instruction ID: 925c622bd0102790b6a80e2845edbca670e3734a3711d4b48df78ce1749ff7ae
Opcode Fuzzy Hash: 33b19a16e8227f1ddd71ed6027ec1cd6e3cf6f6d11cb03eaf3c5c1506cc28609
Instruction Fuzzy Hash: E1515570A403408FDB30CF75E8446AFBBF5EF80328F18647ED092AB651E6B89945CB52

Function 00E49FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00E4A1F9,00E4A1ED,00000000), ref: 00E49FDC

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: d72eac8f4e3d727d9837d9d18c3030ed9ee1347a15928831faff73002f1e6e13
Instruction ID: 10bec7ca2827caedf5ba0fee75bfe88b678bb69a43c5d87ca8c071be4452a05f
Opcode Fuzzy Hash: d72eac8f4e3d727d9837d9d18c3030ed9ee1347a15928831faff73002f1e6e13
Instruction Fuzzy Hash: 63519FB19042589EDB218F28DC80BE67BBCEB49314F2815FDD09AE7182C335AD46DF21

Non-executed Functions

Function 00E7CB98 Relevance: 20.7, Strings: 15, Instructions: 1988COMMON

Download Yara Rule

Strings

efgh, xrefs: 00E7D6D8
(+*-, xrefs: 00E7D6A1
`onm, xrefs: 00E7D8F8
lkji, xrefs: 00E7D903
pwvu, xrefs: 00E7D8AB
yz{|, xrefs: 00E7D6B7
lcba, xrefs: 00E7D8CC
$'&9, xrefs: 00E7D6C2
,/.!, xrefs: 00E7D6AC
,, xrefs: 00E7DC6F
0325, xrefs: 00E7D6E3
@GFE, xrefs: 00E7D92F
8;:=, xrefs: 00E7D6CD
4, xrefs: 00E7D80C
p, xrefs: 00E7E019

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $'&9$(+*-$,$,/.!$0325$4$8;:=$@GFE$`onm$efgh$lcba$lkji$p$pwvu$yz{|
API String ID: 0-4284672935
Opcode ID: 17a9da9fb198ce4cff53889ca9a74bbfb73063c59ecad7ce56909eb832305105
Instruction ID: 6ada4bb75cffb776b24fe8f354c54e1b2438c2ed232ca81f5b647e242a4dd30c
Opcode Fuzzy Hash: 17a9da9fb198ce4cff53889ca9a74bbfb73063c59ecad7ce56909eb832305105
Instruction Fuzzy Hash: 53F275B1508381ABD734CF54D884BAFBBE1BF8A305F58995DE4C8AB292D7359804CB53

Function 00E8C568 Relevance: 11.5, Strings: 9, Instructions: 256COMMON

Download Yara Rule

Strings

W7JI, xrefs: 00E8C5DB
8O?A, xrefs: 00E8C5E9
0W4i, xrefs: 00E8C613
=G!Y, xrefs: 00E8C5F7
A3W5, xrefs: 00E8C5D4
7S.U, xrefs: 00E8C60C
4[&], xrefs: 00E8C5FE
2C!E, xrefs: 00E8C5F0
;_(Q, xrefs: 00E8C605

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0W4i$2C!E$4[&]$7S.U$8O?A$;_(Q$=G!Y$A3W5$W7JI
API String ID: 0-83756894
Opcode ID: c1abe5d969104e4faaeeb94a57dcd0a77674fd740321b7385ce3fa244a949eb5
Instruction ID: 7dbe75500e9ac69e9a77bccd8bea0a574742ead7d63bc23b32d3df6a8f76fbe7
Opcode Fuzzy Hash: c1abe5d969104e4faaeeb94a57dcd0a77674fd740321b7385ce3fa244a949eb5
Instruction Fuzzy Hash: 3481BBB4900206DBDB10DF94C990BBEB7B1FF46704F646149E848BB791E334AE51CBA6

Function 00E4C9E9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E44EB1: GetLastError.KERNEL32(?,00000008,00E49482), ref: 00E44EB5
Part of subcall function 00E44EB1: SetLastError.KERNEL32(00000000,00E5C480,00000024,00E40419), ref: 00E44F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00E4CAF5
IsValidCodePage.KERNEL32(00000000), ref: 00E4CB3E
IsValidLocale.KERNEL32(?,00000001), ref: 00E4CB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00E4CB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00E4CBB4

Strings

||, xrefs: 00E4CA4E

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ||
API String ID: 415426439-2950303532
Opcode ID: 2d7228609f8651a0a702a1cf31053bc21b64c9519eae8737c30c6f48523ad945
Instruction ID: 99af67877097d6448362cfad0857a23e9fa2a8dde9bb0773ad5629bc37a8381d
Opcode Fuzzy Hash: 2d7228609f8651a0a702a1cf31053bc21b64c9519eae8737c30c6f48523ad945
Instruction Fuzzy Hash: CE51A171A01209AFDF60DFA6EC41ABE77B8FF48704F245869E911F7190E7709904CB61

Function 00E4D39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00E4D57F

Strings

1#IND, xrefs: 00E4D4A0
1#SNAN, xrefs: 00E4D4A7
1#INF, xrefs: 00E4D4D1
1#QNAN, xrefs: 00E4D4AE

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 28a02d1a035d0d2842000bbcec89afeda94ccfb22d1db82f8d66896349df7414
Instruction ID: 59584f6e6a3041291f3006c3e01fd931e4249211c1c8788dc40cd15262984926
Opcode Fuzzy Hash: 28a02d1a035d0d2842000bbcec89afeda94ccfb22d1db82f8d66896349df7414
Instruction Fuzzy Hash: 13D20471E082288BDB65CE28ED447EAB7B5FB44305F1455EAD80DF7240EB78AE858F41

Function 00E4C085 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E44EB1: GetLastError.KERNEL32(?,00000008,00E49482), ref: 00E44EB5
Part of subcall function 00E44EB1: SetLastError.KERNEL32(00000000,00E5C480,00000024,00E40419), ref: 00E44F57

GetACP.KERNEL32(?,?,?,?,?,?,00E41848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00E4C146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00E41848,?,?,?,00000055,?,-00000050,?,?), ref: 00E4C171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00E4C2D4

Strings

||, xrefs: 00E4C0C7
utf8, xrefs: 00E4C243

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8$||
API String ID: 607553120-644368747
Opcode ID: 7d216e4cefc7c1d6ad42191fd9ca89454c949a942c5d3ee47fb4b0349fa4f769
Instruction ID: 96df5af43cbd77fc449b93265d33271431b0a89acf188f0669b41c5cc434e7f0
Opcode Fuzzy Hash: 7d216e4cefc7c1d6ad42191fd9ca89454c949a942c5d3ee47fb4b0349fa4f769
Instruction Fuzzy Hash: 3F712B31602702AADB64BB75FC42BAB73E8EF44704F246469F905F7191EBB0ED408764

Function 00E4C814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00E4CB32,00000002,00000000,?,?,?,00E4CB32,?,00000000), ref: 00E4C8AD
GetLocaleInfoW.KERNEL32(?,20001004,00E4CB32,00000002,00000000,?,?,?,00E4CB32,?,00000000), ref: 00E4C8D6
GetACP.KERNEL32(?,?,00E4CB32,?,00000000), ref: 00E4C8EB

Strings

OCP, xrefs: 00E4C868
ACP, xrefs: 00E4C832

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 05a08299c3703724aea9db88c95914e2c5caa29c2e3961c598b738f1de962189
Instruction ID: c1b8dee8a1ca4367d7d219d0cd509c417f28c976ed1af74243146511b53f6e96
Opcode Fuzzy Hash: 05a08299c3703724aea9db88c95914e2c5caa29c2e3961c598b738f1de962189
Instruction Fuzzy Hash: E421B832A02201DADB7C8F65E901A9773A6BF9CB58B765424E909F7111EB32FD40D750

Function 00E3FEF0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Strings

G, xrefs: 00E40233, 00E40211
G, xrefs: 00E3FF0B, 00E4008E, 00E402B7, 00E40250, 00E400DD

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: G$G
API String ID: 0-3574868976
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: faeeebf9f89d274a48842573aba70e0e9131ee1fbf42d1e46a2ad1e228177807
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: F8F13F71E012199FDF14CFA8D884AAEBBB1FF88314F159269E915B7391D730AE01CB94

Function 00E5E175 Relevance: 7.2, Strings: 5, Instructions: 909COMMON

Download Yara Rule

Strings

0, xrefs: 00E5F3A0
@, xrefs: 00E5F90C
0, xrefs: 00E5ECA9
i, xrefs: 00E5F7FE
0, xrefs: 00E5ED58

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 71f3d092406bf2b1da397f9251c19992cfeb9473183140990b6d77d2ed173c24
Instruction ID: afa850b2a3e238cd737d75719be90930e0ab05863848405b7e5c00d18ee028b6
Opcode Fuzzy Hash: 71f3d092406bf2b1da397f9251c19992cfeb9473183140990b6d77d2ed173c24
Instruction Fuzzy Hash: 4772D071A083518FD318CE28C49076ABBE1ABC9709F149E2DECD9A7391D674DD49CB82

Function 00E5E2D5 Relevance: 6.7, Strings: 5, Instructions: 453COMMON

Download Yara Rule

Strings

gfff, xrefs: 00E5F033
gfff, xrefs: 00E5F0EC
gfff, xrefs: 00E5F0A1
0, xrefs: 00E5E5FB
-, xrefs: 00E5EFFD

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: -$0$gfff$gfff$gfff
API String ID: 0-1217629319
Opcode ID: e70ea6af7df4099828697e47c503092b59018ffd614456e3a52484d2297035ff
Instruction ID: 957dc63287326e22b400fc93f1cb530f43c9681badce706ac1c65cc865a0bd46
Opcode Fuzzy Hash: e70ea6af7df4099828697e47c503092b59018ffd614456e3a52484d2297035ff
Instruction Fuzzy Hash: CEF1C2716083518FD318CE28C49075EFBE2ABC9315F489A2DE8D5DB382D674D949CB82

Function 00E6C938 Relevance: 6.7, Strings: 5, Instructions: 409COMMON

Download Yara Rule

Strings

d`df, xrefs: 00E6C94A
q-s, xrefs: 00E6CA32
\W, xrefs: 00E6CAEC
vLyB, xrefs: 00E6CCDB, 00E6CCE3
JpzN, xrefs: 00E6CCA5

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: JpzN$\W$d`df$vLyB$q-s
API String ID: 0-2943124228
Opcode ID: c0123f9ddd81bde4ead67e13c59693835463b28b846828819b093025ea9eb232
Instruction ID: d650bdee3d5e8efe7c21b5730f41d0287966c73115754467d1c1c0433e24e62e
Opcode Fuzzy Hash: c0123f9ddd81bde4ead67e13c59693835463b28b846828819b093025ea9eb232
Instruction Fuzzy Hash: A5D19CB054C3808BD711DF18E49066EBBF1AF96788F681D1CE4D5AB352C336C949CBA6

Function 00E7EF70 Relevance: 6.5, Strings: 5, Instructions: 258COMMON

Download Yara Rule

Strings

zC, xrefs: 00E7EFC5
k$i, xrefs: 00E7F259, 00E7F25D
KC, xrefs: 00E7EFCD
-{4y, xrefs: 00E7F17B, 00E7F183
H~, xrefs: 00E7EFD5

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: k$i$-{4y$H~$KC$zC
API String ID: 0-1198185020
Opcode ID: cb060303c5a1a0c4baba74594868201dd970643a30ef342180b2144766bb590c
Instruction ID: 434c78cd3ebf609cab4bd5d8ae23559a10457c9ffc52dbd0fe24caebe3c67d73
Opcode Fuzzy Hash: cb060303c5a1a0c4baba74594868201dd970643a30ef342180b2144766bb590c
Instruction Fuzzy Hash: C4819CB05083409BD710EF14C881B2AB7F0FF96764F44A91CE4D9AB392E339D905CBA6

Function 00E43C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00E43D1F

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 8eabf70b409c765cd962f22158e0240fcce2b19276cfe7e8fa3c424e4984f44d
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: 82B15672E052469FDB15CF78D881BEEBBF5EF55304F14916AE804BB242D2349E09CBA0

Function 00E37922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00E3792E
IsDebuggerPresent.KERNEL32 ref: 00E379FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00E37A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00E37A1D

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ffc86510ad900339a77e28eda1f1bc561ed19ad1e7162a689df0847599574aaf
Instruction ID: 53e1324696d3a6a8c55690048de4319e56a16d42e748952112295a5b6946985b
Opcode Fuzzy Hash: ffc86510ad900339a77e28eda1f1bc561ed19ad1e7162a689df0847599574aaf
Instruction Fuzzy Hash: 5B31F6B5D053189BDB21DFA5D9497CDBBB8AF08344F1051EAE40CAB290EB709B85CF45

Function 00EA5288 Relevance: 5.3, Strings: 4, Instructions: 348COMMON

Download Yara Rule

Strings

kD, xrefs: 00EA5509
, xrefs: 00EA55BE, 00EA5717, 00EA56EB, 00EA559B, 00EA55A3, 00EA56F3
oD, xrefs: 00EA551C
P, xrefs: 00EA542E

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: P$kD$oD$
API String ID: 0-1115615460
Opcode ID: ed1cfad7e5831a2e1b48057f332d66576bd6f5d84c9fae2d0d95bb32115eec55
Instruction ID: 5b5a71c0423a7d0c68869d9a2cda0d06268ab2d0372a65d630619e71ac03e85f
Opcode Fuzzy Hash: ed1cfad7e5831a2e1b48057f332d66576bd6f5d84c9fae2d0d95bb32115eec55
Instruction Fuzzy Hash: 53C1F1725087618FC715CE28D84061EB7E1EBCA718F158A2DE8A5AF380D775EC49CBC2

Function 00E7FAE2 Relevance: 5.2, Strings: 4, Instructions: 209COMMON

Download Yara Rule

Strings

~, xrefs: 00E7FB45
v}, xrefs: 00E7FB37
I}, xrefs: 00E7FD29
I}, xrefs: 00E7FB3E

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: I}$I}$v}$~
API String ID: 0-1535326304
Opcode ID: 18d941ddf0c7df2a2020a84959c7baed37afdcccf923d2de2c574be5e132557b
Instruction ID: 37580437475340ceb75d774c56538308883cc5dbb6b0fd597599502fd4eff70c
Opcode Fuzzy Hash: 18d941ddf0c7df2a2020a84959c7baed37afdcccf923d2de2c574be5e132557b
Instruction Fuzzy Hash: D661A0B09002568BDB11CF94CC91BBEBBB1FF46344F189998E8947F391D3359841CBA5

Function 00EA3642 Relevance: 5.1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

Strings

Q_, xrefs: 00EA3652
, xrefs: 00EA385E, 00EA383B, 00EA3843
@, xrefs: 00EA37F5
US, xrefs: 00EA364A

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @$Q_$US$
API String ID: 0-1387636662
Opcode ID: b84bd2cad6fc919d03a3147de07ecc8b5f863db2d204b0a85fdfcd1955775bcd
Instruction ID: 7e13c602af1c34b1090ca83df3ce71cc24b26dce9b8fff89925f7a2df5cc6ed0
Opcode Fuzzy Hash: b84bd2cad6fc919d03a3147de07ecc8b5f863db2d204b0a85fdfcd1955775bcd
Instruction Fuzzy Hash: AF4177B0418341ABD714DF24C451A2BBBF0FF8A348F54591DF4C9AB2A1D339EA45CB5A

Function 00E4C498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00E44EB1: GetLastError.KERNEL32(?,00000008,00E49482), ref: 00E44EB5
Part of subcall function 00E44EB1: SetLastError.KERNEL32(00000000,00E5C480,00000024,00E40419), ref: 00E44F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E4C4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E4C536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E4C5FC

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: ddbb46881511d971a44de3eca630903a83937d4cfbe7f918235c1f252139925a
Instruction ID: 6b4e77b342231c2870a206ba0eff6a621898eef20d04f37118500e7f7cc41469
Opcode Fuzzy Hash: ddbb46881511d971a44de3eca630903a83937d4cfbe7f918235c1f252139925a
Instruction Fuzzy Hash: 4D61D6725012079FDB68DF25EC82BBA73A8FF04714F21A1BAE905E7185E734E944CB50

Function 00E3DA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00E3DB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00E3DB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00E3DB82

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e21b296a8c204f144151413ec275e9891e39827a00e21b8e1b43411b29b9a5ed
Instruction ID: cc4927d4dfce455db993d8f1599b1d9fb3dab72daa3c06b03005ae3989f34e02
Opcode Fuzzy Hash: e21b296a8c204f144151413ec275e9891e39827a00e21b8e1b43411b29b9a5ed
Instruction Fuzzy Hash: 1B31B274901328ABCB21DF65DD89B8DBBB8AF08310F5055DAE41CA7290EB749F85CF44

Function 00E65618 Relevance: 4.1, Strings: 3, Instructions: 379COMMON

Download Yara Rule

Strings

IEND, xrefs: 00E65A65
), xrefs: 00E65695
), xrefs: 00E6569F

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: e3af02e7cd14337d65bc99edb6bb6da9af78cbb27c27db32bd75912408caa374
Instruction ID: 4ddba1cfb3f6a304e3bc591da7af27771cb0fe06ee0d198bcba6e09f6683df18
Opcode Fuzzy Hash: e3af02e7cd14337d65bc99edb6bb6da9af78cbb27c27db32bd75912408caa374
Instruction Fuzzy Hash: 6BE1F1B2A48B01AFD310CF28D88175ABBE0FB85354F14962DF998A7381D374E915CBD2

Function 00EA36EE Relevance: 3.9, Strings: 3, Instructions: 122COMMON

Download Yara Rule

Strings

]oXm, xrefs: 00EA3716
, xrefs: 00EA385E, 00EA383B, 00EA3843
@, xrefs: 00EA37F5

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @$]oXm$
API String ID: 0-4013158905
Opcode ID: 08b563d773aac84b36ad4809571cbbdf506584426bf330bc6785f7f8a4602933
Instruction ID: 8600d3466230dbf7062ab00c387a2bc4b70569e4805b956724bee364668e3588
Opcode Fuzzy Hash: 08b563d773aac84b36ad4809571cbbdf506584426bf330bc6785f7f8a4602933
Instruction Fuzzy Hash: 064145B44183419BD714DF24C49062FBBF0EF8A348F54A91DF4C9AB261D339EA45CB5A

Function 00E8C224 Relevance: 3.8, Strings: 3, Instructions: 38COMMON

Download Yara Rule

Strings

Q^\X, xrefs: 00E8C23A
UNOc, xrefs: 00E8C232
KFCI, xrefs: 00E8C252

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: KFCI$Q^\X$UNOc
API String ID: 0-1593643587
Opcode ID: c1021c8647da17318554d3aa5cff67c87dd53425995099f84c7b189f47ca34d0
Instruction ID: 7e0627f9f1a150e7768bf1bdbcb282a1fb5a67f6a10f59cca56e1efdc99fd0e5
Opcode Fuzzy Hash: c1021c8647da17318554d3aa5cff67c87dd53425995099f84c7b189f47ca34d0
Instruction Fuzzy Hash: 6711EEB0508381ABD3219F95C480A1EFFF4AB96785F50991CFAD867221C375C8818F17

Function 00E4622B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00E423AE,?,20001004,00000000,00000002,?,?,00E419B0), ref: 00E4625F

Strings

R[, xrefs: 00E4624A

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale
String ID: R[
API String ID: 2299586839-3972925902
Opcode ID: 31943e5797e922e5a5481a6b25ae90164c93256b02360766cb9269390852e998
Instruction ID: 5f46235066068a64c9404be592f4df00cd57c70f777fbbcb54df5bf73779f94b
Opcode Fuzzy Hash: 31943e5797e922e5a5481a6b25ae90164c93256b02360766cb9269390852e998
Instruction Fuzzy Hash: F2E04F32500728BBCF122F71EC08AAE7F6AEF85761F009410FD0575161DB718E24AA96

Function 00EA49F8 Relevance: 2.8, Strings: 2, Instructions: 288COMMON

Download Yara Rule

Strings

, xrefs: 00EA4C0C, 00EA4BDC, 00EA4BE5
, xrefs: 00EA4A69, 00EA4B39, 00EA4C4D, 00EA4B70, 00EA4B0C, 00EA4A3C, 00EA4A48, 00EA4B18, 00EA4B7B, 00EA4C56

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: a72b061ef2fa19078f6f09b4256c813a26286e548eea71359ce8abeef3a1e115
Instruction ID: da9a63073fb82ef24b587f77a2fa379fa3d417fd33cd010be90de28bae16b6dd
Opcode Fuzzy Hash: a72b061ef2fa19078f6f09b4256c813a26286e548eea71359ce8abeef3a1e115
Instruction Fuzzy Hash: CAA1C4B1608340ABEB24CB54CC40BABB7E5EBCA354F54582CF595AB391E770F940CB96

Function 00EA6FD8 Relevance: 2.7, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

, xrefs: 00EA70CE
, xrefs: 00EA702E, 00EA7142, 00EA711B, 00EA700B, 00EA7013, 00EA7123

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: e90198aaeed22a300b19465d833889039e3ddf500042478477c72a525097edc6
Instruction ID: 861b50bd61e0108791c2c7c34275c72057f6337a43493cd969d5de8ee274fcd0
Opcode Fuzzy Hash: e90198aaeed22a300b19465d833889039e3ddf500042478477c72a525097edc6
Instruction Fuzzy Hash: 4371AE7060C341ABCB10EB58CC80A2FB7E5EF9A714F14A81CF5C59B2A2D375E854CB96

Function 00E85EC3 Relevance: 2.6, Strings: 2, Instructions: 140COMMON

Download Yara Rule

Strings

^TPX, xrefs: 00E85FE9
6, xrefs: 00E86061

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 6$^TPX
API String ID: 0-3674074485
Opcode ID: e2faa7a7b5874149e8eed49c136e69c5cac99755a3b347c5e8b82d654e240883
Instruction ID: 4d625896748b973b50c740c57d446f24a5ef94d0dd3e102b026b8bdb28b8409b
Opcode Fuzzy Hash: e2faa7a7b5874149e8eed49c136e69c5cac99755a3b347c5e8b82d654e240883
Instruction Fuzzy Hash: 85510FB050C7808FD362AF2A858062AFBF2AB92745F64695CE1E95B361C732C845CF17

Function 00EA6EA8 Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

@, xrefs: 00EA6F10
, xrefs: 00EA6F7E, 00EA6F5B, 00EA6F63

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @$
API String ID: 0-736778079
Opcode ID: 0ac285f3c4d7bf6ff568a0e3d31a6644a2a8a6f4a62bd3ece0da7e21683cf0fc
Instruction ID: 88937548cfb568b64d2b7dc6ae0f49c1ed63659cd73e8422f75e7bbe2aeae508
Opcode Fuzzy Hash: 0ac285f3c4d7bf6ff568a0e3d31a6644a2a8a6f4a62bd3ece0da7e21683cf0fc
Instruction Fuzzy Hash: 8D3189756083009FC314DF14D880A2FFBE5EF8A308F18992CE598AB291D335E908CB96

Function 00E6BB58 Relevance: 2.6, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

p, xrefs: 00E6BBE9
p, xrefs: 00E6BBC1, 00E6BB9B

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: p$p
API String ID: 0-2001073228
Opcode ID: 9ccebd6029074dcc193b65c5d4f3edf18eb513497d73d4234c938a2efa72fd27
Instruction ID: 1163c3591e8d3aa7c91981c094a9d1ea68f471504520094f26d8000199eb0843
Opcode Fuzzy Hash: 9ccebd6029074dcc193b65c5d4f3edf18eb513497d73d4234c938a2efa72fd27
Instruction Fuzzy Hash: 1A311DB0D0024A9BDB00CF98D886AAEFFB1FB0A310F145519E550FB781D734AA94CBE5

Function 00E66C29 Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

8, xrefs: 00E66C7F
0, xrefs: 00E66C87

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 101362e4397cd3868e0d82b2d27283c317da1e6fc92abe76afbb474ffa19d7ef
Instruction ID: f7dd2403ab4d586ae90cf74ece5ea41d3926d1938f4392fccd0081db0a96349a
Opcode Fuzzy Hash: 101362e4397cd3868e0d82b2d27283c317da1e6fc92abe76afbb474ffa19d7ef
Instruction Fuzzy Hash: C231D53660D3C58FD315CA68948069FFBE1ABE6354F484D5DE8C4A7342CA74D809CBA3

Function 00E5DED8 Relevance: 2.5, Strings: 1, Instructions: 1296COMMON

Download Yara Rule

Strings

@, xrefs: 00E5FE4D

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0f2fb15fb640a0ac74f7ebf11ae0a00e79eb1ebbcee514835237cce2622ebf17
Instruction ID: 583f6c5479ef45dc21af7ad8bf2d1367f4e76abcbd436021baa5df081b0a59ba
Opcode Fuzzy Hash: 0f2fb15fb640a0ac74f7ebf11ae0a00e79eb1ebbcee514835237cce2622ebf17
Instruction Fuzzy Hash: 7C9215316083518FC714CF28C48436BBBE2AFC9359F189A2DE899AB391D374DD49CB91

Function 00EA1798 Relevance: 1.9, Strings: 1, Instructions: 618COMMON

Download Yara Rule

Strings

f, xrefs: 00EA1976

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: b38e6f6da0f4ee892dc7bd84d3849ea3ee91e3c5acb601456a1049e317f3aa66
Instruction ID: d0d6f7a831ddafea799a2a0e22ecec14fee35553212b3cfe7bcb3817931d6494
Opcode Fuzzy Hash: b38e6f6da0f4ee892dc7bd84d3849ea3ee91e3c5acb601456a1049e317f3aa66
Instruction Fuzzy Hash: 5122AC716083419FC714CF18C890A2FBBE5AF8A318F189A6CF5D5AB3A1D735E944CB52

Function 00E4572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00E45727,?,?,00000008,?,?,00E515F5,00000000), ref: 00E45959

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: a6f7f5ebb6ff3ab8113446ca1fe9df9b0737bf7e72027cb3cb0d1f1f54e8c450
Instruction ID: d21e142fd2ea0863e0e9414f84b8f1d5406a2fdb9ad723af83c7ef1d58e8e289
Opcode Fuzzy Hash: a6f7f5ebb6ff3ab8113446ca1fe9df9b0737bf7e72027cb3cb0d1f1f54e8c450
Instruction Fuzzy Hash: ACB18132610A04CFD719CF28D486BA47BE0FF45368F259658E999DF2A2C735E941CF40

Function 00E3729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00E372B2

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: c94e391121b0411c7150f9e01e119bbaea85cab86c1253c19bc34766786a3674
Instruction ID: 2abe1c0420a697d3d2034be35e1bdc554ae775e1a23569611937d3d7beacbc47
Opcode Fuzzy Hash: c94e391121b0411c7150f9e01e119bbaea85cab86c1253c19bc34766786a3674
Instruction Fuzzy Hash: 9EA18DB19193058FDB28CF65DC867AABBF1FB48325F14992AD449F73A0D3349849CB50

Function 00E605B8 Relevance: 1.7, Strings: 1, Instructions: 448COMMON

Download Yara Rule

Strings

CD, xrefs: 00E60616

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: CD
API String ID: 0-3115673787
Opcode ID: 4c0b4b88843fe66386dd9f80ba3723d5ab93d35f761372caa74b535c6bc6894e
Instruction ID: 1a05e4f62d99baddf61f391a54ce8beade08f43643b0a3c1f8fe38dab17be293
Opcode Fuzzy Hash: 4c0b4b88843fe66386dd9f80ba3723d5ab93d35f761372caa74b535c6bc6894e
Instruction Fuzzy Hash: 85E1F672A083119BC708CF29D88065FB7E6EBC4790F259A2DF898E7390E774DD458B81

Function 00E85368 Relevance: 1.7, Strings: 1, Instructions: 415COMMON

Download Yara Rule

Strings

TW, xrefs: 00E8538A

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: TW
API String ID: 0-1778470648
Opcode ID: 37e65682408c37040f626a0ca88badc03505eecafd751e2c16e196c146a53e28
Instruction ID: 177b9adf8d812653d14056c45eda13a8ea5a829d8c7b4b462047c2042771001f
Opcode Fuzzy Hash: 37e65682408c37040f626a0ca88badc03505eecafd751e2c16e196c146a53e28
Instruction Fuzzy Hash: 5FC1CEB25087009BDB11AB14C841A2BB7F5EF92754F48A81CF8CDAB252E735DD44DB63

Function 00E49ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc146903113bd5e2b9203fc5c0602670560f91f4a0dc71ff2c79aad2ae5d089
Instruction ID: 3904a80feaf0addb0d85b2f49a7d02bb156cfecd9c37c940a0faef6608a1dd97
Opcode Fuzzy Hash: 9fc146903113bd5e2b9203fc5c0602670560f91f4a0dc71ff2c79aad2ae5d089
Instruction Fuzzy Hash: 9131F772900219AFCB20DFB9EC89EABB7BDEB84314F144558F905B7245EA30AE408B54

Function 00E3CAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00E3CC80

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9c2302eb26cbc1300311d235b9f5f232117c311c9d47756cf3da964ed416da8a
Instruction ID: 1a4311056d19b0ce50fbb0dadebcd71e7c9a87261d63ee37184b382f167e27dd
Opcode Fuzzy Hash: 9c2302eb26cbc1300311d235b9f5f232117c311c9d47756cf3da964ed416da8a
Instruction Fuzzy Hash: 74C1BF7060464A8FCB28CF28C4896BAFFF1AF45318F346A59D456BB291C731ED45CB91

Function 00E9074E Relevance: 1.6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

Strings

-'.$, xrefs: 00E90989

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: -'.$
API String ID: 0-2031752551
Opcode ID: 34e3f814482b72035446470293d0cf0e4fa038b8cce2f5f390abddc47372c923
Instruction ID: b0f639c4f3412d457aa83b7c4a4ca4aea89ed9bacc699eb736f541244625cc66
Opcode Fuzzy Hash: 34e3f814482b72035446470293d0cf0e4fa038b8cce2f5f390abddc47372c923
Instruction Fuzzy Hash: C0B18F70504B818FDB268F29C090B26FBF1EF56314F54959ED4EAAB752C335E806CB90

Function 00E4C6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00E44EB1: GetLastError.KERNEL32(?,00000008,00E49482), ref: 00E44EB5
Part of subcall function 00E44EB1: SetLastError.KERNEL32(00000000,00E5C480,00000024,00E40419), ref: 00E44F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E4C73F

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: aa769e0a02a7bec76a58c7d382e4461ae5b842a4839c19eaf399c4c0e86caeaf
Instruction ID: b70ef62cab7779ff7d61063353cab6177a8d1b8fdf80799ef50ecf8d14775c80
Opcode Fuzzy Hash: aa769e0a02a7bec76a58c7d382e4461ae5b842a4839c19eaf399c4c0e86caeaf
Instruction Fuzzy Hash: DD21B372602206ABEB689B35EC45ABA77E8EF44314F20207BF905E7181EB35ED408A50

Function 00E4C372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E44EB1: GetLastError.KERNEL32(?,00000008,00E49482), ref: 00E44EB5
Part of subcall function 00E44EB1: SetLastError.KERNEL32(00000000,00E5C480,00000024,00E40419), ref: 00E44F57

EnumSystemLocalesW.KERNEL32(00E4C498,00000001,00000000,?,-00000050,?,00E4CAC9,00000000,?,?,?,00000055,?), ref: 00E4C3E4

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0249e91e31d11d876234cb71338a73f137d55fb9d7e8be85aa3bc176142b581d
Instruction ID: 2f88903b808ed446d3b811b22a34d848c314d93e317afa59bd6df8ad1b49738d
Opcode Fuzzy Hash: 0249e91e31d11d876234cb71338a73f137d55fb9d7e8be85aa3bc176142b581d
Instruction Fuzzy Hash: D31148372003055FDB189F39E9A16BABBA1FF8076DB24842CE947A7B40D371B942CB40

Function 00E4C91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00E44EB1: GetLastError.KERNEL32(?,00000008,00E49482), ref: 00E44EB5
Part of subcall function 00E44EB1: SetLastError.KERNEL32(00000000,00E5C480,00000024,00E40419), ref: 00E44F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00E4C6B4,00000000,00000000,?), ref: 00E4C946

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9a1f4d64fa37732b2fc155bb4b69896bcd9606e1864913478a8ed11468c48c4f
Instruction ID: ef4b21863b18153fc97479c105d50e5c54ed5e00b7001e05cda80ba29ff9870c
Opcode Fuzzy Hash: 9a1f4d64fa37732b2fc155bb4b69896bcd9606e1864913478a8ed11468c48c4f
Instruction Fuzzy Hash: 7EF02D33A11111BBDB289731DC05BBA77A8EFC0758F244429EE02B3180DA34FE41C5E0

Function 00E4C40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E44EB1: GetLastError.KERNEL32(?,00000008,00E49482), ref: 00E44EB5
Part of subcall function 00E44EB1: SetLastError.KERNEL32(00000000,00E5C480,00000024,00E40419), ref: 00E44F57

EnumSystemLocalesW.KERNEL32(00E4C6EB,00000001,?,?,-00000050,?,00E4CA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00E4C457

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c47da525a808b38f710a2133531d771029c14553c1f35c4646da1116d8d57d22
Instruction ID: e13250ddc6ddba8195abd97f5c882e120ccf7e6baacf47305616b6817a4133ee
Opcode Fuzzy Hash: c47da525a808b38f710a2133531d771029c14553c1f35c4646da1116d8d57d22
Instruction Fuzzy Hash: 85F0F6363013046FDB145F79EC91A7ABBE5FF80B6CF25842DF9469B690C6719C42C650

Function 00E45D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E3DDC1: EnterCriticalSection.KERNEL32(?,?,00E44B89,?,00E5C2E0,00000008,00E44D4D,?,00E3C446,?), ref: 00E3DDD0

EnumSystemLocalesW.KERNEL32(00E45D72,00000001,00E5C3A0,0000000C,00E46127,00000000), ref: 00E45DB7

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: d61bbc155dbe7138a2a9091c0a2cc49267e74fab3702b89c6880c66f17550b8e
Instruction ID: 46b4ef9f486cc6be25f0daa706c36004f49f433d9ad2c0e36708ccba4508130a
Opcode Fuzzy Hash: d61bbc155dbe7138a2a9091c0a2cc49267e74fab3702b89c6880c66f17550b8e
Instruction Fuzzy Hash: E1F04976A08304EFD704EF99E846B9E7BF0EB48721F20516AF405BB2E1C7759948CB44

Function 00E4C327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E44EB1: GetLastError.KERNEL32(?,00000008,00E49482), ref: 00E44EB5
Part of subcall function 00E44EB1: SetLastError.KERNEL32(00000000,00E5C480,00000024,00E40419), ref: 00E44F57

EnumSystemLocalesW.KERNEL32(00E4C280,00000001,?,?,?,00E4CAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00E4C35E

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d6a3db1ac522acc1c5862e2507fc1dce23904c6739fb04ce5074a092faf33d27
Instruction ID: b498ddb60bba2230d0580acf41764d1a3c86f3e2ed2ccf6ea42c6049c0d3b836
Opcode Fuzzy Hash: d6a3db1ac522acc1c5862e2507fc1dce23904c6739fb04ce5074a092faf33d27
Instruction Fuzzy Hash: E3F0553630030457CB149F75E80566ABF90EFC1B64B164098EA099B290C2729842C7A0

Function 00E8A059 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

P, xrefs: 00E8A397

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 4bfaa7626ea9b600e4b84af23bd05a8ca6e36999e86aa202f38862eca0be855c
Instruction ID: 1c48e7d8550351c946d53d0e56ab6d47c8f5630ab8f45d315e016563bf1329b6
Opcode Fuzzy Hash: 4bfaa7626ea9b600e4b84af23bd05a8ca6e36999e86aa202f38862eca0be855c
Instruction Fuzzy Hash: F0A1F1719093418BF710AA14C8803AFBBE2EB95390F5C693EE48DA73A2D335D945DB43

Function 00E67908 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00E67A3E

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 4ab73c068909bf4a579edcd3551088511d35e91c35163eb6544c071a430a9b34
Instruction ID: 51c973139430afb5f7e83a0e257ac46f5d1691950fa21a9ac276fa04a9a1ef05
Opcode Fuzzy Hash: 4ab73c068909bf4a579edcd3551088511d35e91c35163eb6544c071a430a9b34
Instruction Fuzzy Hash: 77B1377110D3819FD321CF28D88065BFBE1AFA9708F444A2DE5D997782D631E918CBA7

Function 00E5E212 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

@, xrefs: 00E5E7F8

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 306e642b51b2512054d38a46158e9f08723d7b25d1953b1fc47caece9ac7f322
Instruction ID: 1343f2f722a685d1bd18ffd6f701b8c88a6b69fa6048f0c41bdd50b62cd38970
Opcode Fuzzy Hash: 306e642b51b2512054d38a46158e9f08723d7b25d1953b1fc47caece9ac7f322
Instruction Fuzzy Hash: 07A19B71A087519FD318CE18C09475AFBE2ABC8319F19AE2DE8D967391C7349D49CB82

Function 00E37AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,00E36DC9), ref: 00E37AB4

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 38cd85bf4877e42f0ef5fcb8098c2502bf6122a89dae5b7c21d6666cbec536ed
Instruction ID: 4150417900b047e9921ffc073b3e0d46c9a2b83c7ef5fab2dc35bb99902d6af7
Opcode Fuzzy Hash: 38cd85bf4877e42f0ef5fcb8098c2502bf6122a89dae5b7c21d6666cbec536ed
Instruction Fuzzy Hash:

Function 00EA74F8 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

, xrefs: 00EA7552, 00EA760E, 00EA75EB, 00EA752B, 00EA7533, 00EA75F3

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 08d3931baa2a9c42408cb6ec1c64e50b571bbd3c3c2ceb0987ed0c3721af9082
Instruction ID: b39fb3b477d26d2c3ca736526d71adc4470a4254c5c3971f6aa61bee3700d045
Opcode Fuzzy Hash: 08d3931baa2a9c42408cb6ec1c64e50b571bbd3c3c2ceb0987ed0c3721af9082
Instruction Fuzzy Hash: 5681BC766083519BCB24DB18C840A2AB7E5EF8A714F19996CF8C5AB351D731FC50CB92

Function 00E8E388 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

", xrefs: 00E8E64C

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction ID: ce4dd56c10f90dd06a0bea098da18be5eabd754d55bf9e03051d501f70aa83fb
Opcode Fuzzy Hash: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction Fuzzy Hash: EA71D7327087504FD724AA2C888035AB7D2ABD6338F29A729E47CEB3E1D675DC459741

Function 00EA47F8 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

, xrefs: 00EA48BE, 00EA49A8, 00EA497B, 00EA489B, 00EA48A3, 00EA4983

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: caa00a0baa876a8884e4083aa7b8b58c4b77efdead5d9ec54620c567e662e154
Instruction ID: 05ea3f2dbe7643b01ac137df0b5e07483015e518a90e7cee217be2bed4997a2d
Opcode Fuzzy Hash: caa00a0baa876a8884e4083aa7b8b58c4b77efdead5d9ec54620c567e662e154
Instruction Fuzzy Hash: 3751F0B1608300ABC7149A19C881B2FB7E5EBCA318F149A2CF9D96B3D1C275EC108756

Function 00E90AD4 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

2FD>, xrefs: 00E91F68

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 2FD>
API String ID: 0-1510312430
Opcode ID: 242552adc178d8c3491bf93f30874780fcc0fbb89b54cad1dcff1d541b57b90a
Instruction ID: c0d6e2c63396ef7908312a12d45c17eab049da7f244b453c4dc0e507656b18d0
Opcode Fuzzy Hash: 242552adc178d8c3491bf93f30874780fcc0fbb89b54cad1dcff1d541b57b90a
Instruction Fuzzy Hash: EB5173705047818FDB268F25C450A26FBF1EF17354B6499CED8D6ABA83C339E806CB65

Function 00E6FA44 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

2, xrefs: 00E6FADA

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: e6034f399045d4b6abb2554f6b82214a593dffe65b117c12c080d18cf511f5b9
Instruction ID: b3da813ab0bc06a0b892e5310a3e5c84ce7d0d7eda9b8c15356eec7ff1905a0e
Opcode Fuzzy Hash: e6034f399045d4b6abb2554f6b82214a593dffe65b117c12c080d18cf511f5b9
Instruction Fuzzy Hash: 195171B198A380DBE631A7149846FEFB6E5BFD5304F08192CE48D77282DB369505CB63

Function 00E6FCD4 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

2, xrefs: 00E6FD63

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 15cde75e9d06dabda2588e85d20db4463443109759951a92bfa7a8f5d5147061
Instruction ID: 7de5997a3ba609d20f1a10ec510308daaf4055b1d2d2cbe4a715c968324c916e
Opcode Fuzzy Hash: 15cde75e9d06dabda2588e85d20db4463443109759951a92bfa7a8f5d5147061
Instruction Fuzzy Hash: B65191B198A380D7E631A7109846FEFB6E5BFD5304F08192CE48D77282DB769505CB63

Function 00E31D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00E31E9B

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: dcd3fc2cc26f1ecf76a744581de74268fb7988cfc1f2e1ce0a6ff437265da7c3
Instruction ID: 3b1c42ebc6a605d067f6cbc39ea0cbd0dbc0a3ad5669b1d1e41bce65092def13
Opcode Fuzzy Hash: dcd3fc2cc26f1ecf76a744581de74268fb7988cfc1f2e1ce0a6ff437265da7c3
Instruction Fuzzy Hash: 4F41FA76E2052B4BCB0CEEB9885A1AABF65EB46354F04527EDD11EB3D1E2348A01C6D0

Function 00E91327 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

2FD>, xrefs: 00E91F68

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 2FD>
API String ID: 0-1510312430
Opcode ID: 482e1bb03dcd7035389772e6bba219ce3904a568faca1742d2efed7deef8c6d7
Instruction ID: 157e2a9559a247e50f06c5908daafa9ccac400e0a718acbd8f74f1c308b4bb84
Opcode Fuzzy Hash: 482e1bb03dcd7035389772e6bba219ce3904a568faca1742d2efed7deef8c6d7
Instruction Fuzzy Hash: 574162705047828EDB268F158050A36FBF1EF17358F6499CDD4D6ABA83C735D806CB55

Function 00EA6B98 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

, xrefs: 00EA6BF7, 00EA6CAE, 00EA6C8B, 00EA6BCC, 00EA6BD5, 00EA6C93

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 3f681d420308340ce622b70d3801fe125027f74667fc1b293c25dd6169613fb3
Instruction ID: 489e5d3565b0bb14fc832872fc4b48d25aeacb045345a63613a32a87294fcc5e
Opcode Fuzzy Hash: 3f681d420308340ce622b70d3801fe125027f74667fc1b293c25dd6169613fb3
Instruction Fuzzy Hash: 55417274608340ABDB149F14C990B2FFBE5EB8B714F28A82CF5C56B291D335E814C756

Function 00EA6D28 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

, xrefs: 00EA6D87, 00EA6E3E, 00EA6E1B, 00EA6D5C, 00EA6D65, 00EA6E23

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 35ff341fea01c2b82f004fdc622a9334d9847dfee3824cdca80f10c1f8328be7
Instruction ID: c8e9bca4b65ca6a57f608579025a254dcfc11ada8abf4a4cdf15db3dd9fdcaa6
Opcode Fuzzy Hash: 35ff341fea01c2b82f004fdc622a9334d9847dfee3824cdca80f10c1f8328be7
Instruction Fuzzy Hash: 7A415D74608340AFDB149F14C980B2BBBE5EF8B754F68E82CF4896B291D335E910CB56

Function 00E7AF2D Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

qs, xrefs: 00E7AF96

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: qs
API String ID: 0-1399850505
Opcode ID: 8aaebf1e4c3640f5f3ce392bc9914373ba4fadcd76e73042caaaaaebe0853f7e
Instruction ID: 15b3c23f11d59ad59e1717f3d9b807e530f9715a55b839291ceb717042365766
Opcode Fuzzy Hash: 8aaebf1e4c3640f5f3ce392bc9914373ba4fadcd76e73042caaaaaebe0853f7e
Instruction Fuzzy Hash: 3F3145B0500B008BC734DF24D991A27B7F1FF5A754B54AA1CE4AA9BBA1E335F844CB15

Function 00EA38E2 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

, xrefs: 00EA394E, 00EA392B, 00EA3933

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 6755f9bab069ea5934903f8183f253ded6f2aca177a558b48b1de12272a79bcd
Instruction ID: 3d0a2a2163fd8530dc2ec0763a09be4fc6537d7d7d4ec459f9cf4e5ebf910838
Opcode Fuzzy Hash: 6755f9bab069ea5934903f8183f253ded6f2aca177a558b48b1de12272a79bcd
Instruction Fuzzy Hash: 2721CF70608301ABDB04DB18CC41B2AB7E5ABCA705F54A91CF1C1AB2E5C3B1E900CB56

Function 00E4CC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00E4CC4B

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: a8687f57f8ced3c92842827898afca0bdf3ab8ed01833c83d545e218a9426b90
Instruction ID: c0982e4a1a2d5c685f1dff58f7da8e4e7b942bf0e65de5feebbc3ca7a9d1e533
Opcode Fuzzy Hash: a8687f57f8ced3c92842827898afca0bdf3ab8ed01833c83d545e218a9426b90
Instruction Fuzzy Hash: CBA012301032009F43008F3A5B45209369457401C1B0540549800E0020DA2044445640

Function 00E68F38 Relevance: .8, Instructions: 789COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55bdd7183e786f206f49eb0e89a9435e12bd88c65a2001897e8b962e1375b007
Instruction ID: f60a939bac990d18cd6967b56223799574e5b1de000886bf44ed163e9558b83a
Opcode Fuzzy Hash: 55bdd7183e786f206f49eb0e89a9435e12bd88c65a2001897e8b962e1375b007
Instruction Fuzzy Hash: B842F7316443118BC724DF28F8806AEB3E5FFD5395F25992DD896E7282E734E841CB42

Function 00E81908 Relevance: .7, Instructions: 700COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16869c809fe6b9c013eb52f11e203e487ef228a061d05dc0c8baca727ee9c214
Instruction ID: 10e2c893b6cacddc0d02ba70dec0daa7f06e223f262ee58f4ffa34620b57409c
Opcode Fuzzy Hash: 16869c809fe6b9c013eb52f11e203e487ef228a061d05dc0c8baca727ee9c214
Instruction Fuzzy Hash: 2C72F6B0508B818ED375CF3C8849796BFE5AB1A324F044A5EE0EE8B3D2C3756505CB66

Function 00E68428 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169fd697c981202875bdf4f7b877c3bbabddd2f5e73f7c32bbe4a1385d044f0b
Instruction ID: 2740d7f251bece8c270f865348a061f4135e014fa4e7d9ca27d6944231909107
Opcode Fuzzy Hash: 169fd697c981202875bdf4f7b877c3bbabddd2f5e73f7c32bbe4a1385d044f0b
Instruction Fuzzy Hash: 96523770988B848FE734CB24D1843ABBBE1EF61394F546A2DC4E6577C2CB79A885C711

Function 00E64278 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction ID: 3cd2ec9349c588b2676289e2a453c2ea5f42f93464aab0513a66e00afcce02cd
Opcode Fuzzy Hash: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction Fuzzy Hash: B55201B15483458FCB18CF18D0906AEBBE1FF89358F199A6DF89967381D734E849CB81

Function 00E64C78 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4942d6c5a04db89343f61d2bd896b7a754b8bfa492006bc517a5ac4323522e
Instruction ID: 097c303233b351d8c5d1791a5f60c57bb5979f964f8b4331b6a00e025fdb3111
Opcode Fuzzy Hash: 8b4942d6c5a04db89343f61d2bd896b7a754b8bfa492006bc517a5ac4323522e
Instruction Fuzzy Hash: DF3244B1A55B108FC368CF29D59056ABBF1BF45780B606A2ED5A7A7F90D336F844CB00

Function 00E67338 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ed25ed2ecece428dec3d662da4c49c86df14d0f0cac3c7bd7da9d139c37883
Instruction ID: 5677464c6d8fe8d8b712aece26d26962a9393068daf64917405ca5ad4dce9402
Opcode Fuzzy Hash: c2ed25ed2ecece428dec3d662da4c49c86df14d0f0cac3c7bd7da9d139c37883
Instruction Fuzzy Hash: 3202EF7164C7418FC728CF29D88166BFBE2EFD8304F08992DE4D697391EA35A904CB56

Function 00E8A438 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d948c1b98276872fbedeb4ae571c7f1df7ffbfed0eb7000220ee8de56deee4
Instruction ID: 618b260eaefd9a2c78f885bdd8a691fc26e73f7f9c3d565921f44700c59a6cd2
Opcode Fuzzy Hash: 83d948c1b98276872fbedeb4ae571c7f1df7ffbfed0eb7000220ee8de56deee4
Instruction Fuzzy Hash: 4CB1EFB16083009BEB14AF24C85066AB7E6EF95304F1C693EE4CEAB251E335E945CB57

Function 00E9143A Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e5a161c1ab45c4b1e480cfbddb13b76eded34dc1ce46f9e0b718e5efcd9d52
Instruction ID: b2f97fd789427e619532ceb760311b480b5db76a38ad0003e82af7bfdb994d70
Opcode Fuzzy Hash: c5e5a161c1ab45c4b1e480cfbddb13b76eded34dc1ce46f9e0b718e5efcd9d52
Instruction Fuzzy Hash: 37D15FB4800B419FD720AF39C146756BFB0FB02300F549A9DE8EA5B686D335A45ACFD6

Function 00EA4DA8 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5adaadb379de4d0ac6695891303286d85bf5796d7f1c210cbcdbab9b523f8b94
Instruction ID: 9044f4bc6b3e241b6773ff771e34290ff280749b45e4659c3d08281c47a599cc
Opcode Fuzzy Hash: 5adaadb379de4d0ac6695891303286d85bf5796d7f1c210cbcdbab9b523f8b94
Instruction Fuzzy Hash: 32A109B2A043505FE7149F69CC8076BB7E5EBCA314F09592DF994AB381E771EC048792

Function 00E4BB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 9701009a659e1849e11cfb8e966a2ec6b0ab16ea6705a0a43c056ab98509999f
Instruction ID: 2077fc321e06c37ddf142e3ce9aba5396c0f0dc44a54bd40bbc880322337c063
Opcode Fuzzy Hash: 9701009a659e1849e11cfb8e966a2ec6b0ab16ea6705a0a43c056ab98509999f
Instruction Fuzzy Hash: ABB1F675A007059BCB389B25ECD2AB7B3E8EF4430CF14546DEA47E6580EB75E985CB10

Function 00E734A4 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d6742bc921a87cbc0d7ecdfc3dd5ce11be376d8912454172b111acada42123f
Instruction ID: 2d1124151bbc06dc31a4ad7fda3ff189cf180a7607300089cfe1fdd20412b74c
Opcode Fuzzy Hash: 7d6742bc921a87cbc0d7ecdfc3dd5ce11be376d8912454172b111acada42123f
Instruction Fuzzy Hash: 2BC1FDB0500B508BD325CB34C881B67BBF1FF46304F14995DE9AA9BB92E736B905CB61

Function 00E96078 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6242de2c158a3e25abd914ef81a7081ec85dc90910a15599f474a425946f381
Instruction ID: 1eae396685fc9286d05024836a18256d3d33c849e4601592a6f884cafc6616c9
Opcode Fuzzy Hash: c6242de2c158a3e25abd914ef81a7081ec85dc90910a15599f474a425946f381
Instruction Fuzzy Hash: E6812C37B159A147CB18893D4C112FAAA831FD7330B3DD36BE9B5DB3E5D92588024350

Function 00E62302 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb0e1251b43261e23572b6fe04e2d9b66b4d052610f955a5f7654400d35fefe
Instruction ID: 1dd54bd7605e9ef209c42e415ac9127a5d8b5e5175fbf7d14ca11fcc509d16ab
Opcode Fuzzy Hash: 9bb0e1251b43261e23572b6fe04e2d9b66b4d052610f955a5f7654400d35fefe
Instruction Fuzzy Hash: 7D910971A48B428BD7258E54F88032AB7D2AFE138CF1DE56DDA856B351E3B0DC49C342

Function 00E8BADA Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a435c7ff7e61a266175cc740b2df94f4f0bcffa5dc796596f52e14c951997eae
Instruction ID: e501c65d3fd57f4ff91f5a085e4b9edb65a7dbe8b02ec9b9c190a8fffb80cd9c
Opcode Fuzzy Hash: a435c7ff7e61a266175cc740b2df94f4f0bcffa5dc796596f52e14c951997eae
Instruction Fuzzy Hash: 18710873A54B254BC728993C9C5166AB6D29BC4214F4E833CDD9EDB386EB74ED0187C0

Function 00E94A88 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b4e1efa5495fb8a019b3a8f09c75cd24c53d3083fb3dc6746e68a82280d218
Instruction ID: 2a2e66487af21413085310206fe83cf18302dab07d52e0bbf56b17033e089530
Opcode Fuzzy Hash: e8b4e1efa5495fb8a019b3a8f09c75cd24c53d3083fb3dc6746e68a82280d218
Instruction Fuzzy Hash: 91817ABB64A6804BDB189E3C8C117B9AE834BD3334F2D976DE4F29B3E5D56588038311

Function 00E85108 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b631a1ef9c90cdc196109c47057cb6dd3a7c54a8c9dd28249f1b39c8e723b3
Instruction ID: b3b6d7db84401d828083fa2e6c9ed995eebfd10c94ffdab9d2b95abf33a9dab2
Opcode Fuzzy Hash: 17b631a1ef9c90cdc196109c47057cb6dd3a7c54a8c9dd28249f1b39c8e723b3
Instruction Fuzzy Hash: F651D3B26407049BDB20AB64CC86BB733B4EF81768F145558F98D9B3A1EB75E904C722

Function 00E62268 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f99aab2791bd1aba6dfb3b61b9a4968c41f01324f8c9ecb9249fe38aea401d4
Instruction ID: a08fa4ad109304d1866234c54342184a37713055b28a0bbcf8b7058cae155606
Opcode Fuzzy Hash: 5f99aab2791bd1aba6dfb3b61b9a4968c41f01324f8c9ecb9249fe38aea401d4
Instruction Fuzzy Hash: BE715CB2944F4287D7358A18E850336FB93AFE1398F19A55DDA6A6B341E771CC05C342

Function 00EA22A8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260186d478aae003c652c9c0622f6da14b7ca9a12c80829d925b8ad8623de31d
Instruction ID: eb2f2881b2d835973aa20a26d895c9d6ad769a42041600bcbc3d183c9c5a497e
Opcode Fuzzy Hash: 260186d478aae003c652c9c0622f6da14b7ca9a12c80829d925b8ad8623de31d
Instruction Fuzzy Hash: DE71C0716083419BDB119F1DC840B2ABBE6EF9E314F14992CE6E5BB2A1D335EC448B52

Function 00E918D8 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ecac1f06bdf61436ed265659ed9f52c64cc52bcee91badaf8e5f8c506a0b22
Instruction ID: 62cd631fc50f4580bff38a36b1bcf760f4cf5618d9a8f3f12f89bdffedc756b6
Opcode Fuzzy Hash: b2ecac1f06bdf61436ed265659ed9f52c64cc52bcee91badaf8e5f8c506a0b22
Instruction Fuzzy Hash: B37148B44057828FEB258F29C090A26BFB1EF16310B1895CDD8966F74BD375E849CBA1

Function 00E6B2D8 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f57911bcbd89b49419ee3ef9dd8a7705bfb666a251f11caf1017bd8e3f52b3
Instruction ID: a5f7d13d96c786fce4c43e7f1bf47e071a623fa7f4a01b5dbc9e789e526e1f01
Opcode Fuzzy Hash: 78f57911bcbd89b49419ee3ef9dd8a7705bfb666a251f11caf1017bd8e3f52b3
Instruction Fuzzy Hash: 745167337C86804BC3285D7D6C952B97A834BD2374F2D937EE9B2DB3E2EA9948415350

Function 00E5E3F7 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118f1cef26720b4861566893e0de54ebb40160411a9db2ff76e9d22af775da4a
Instruction ID: 325c79345f9c17cd858904b5fb4cef445a7a3a2a29107423b5bf034668bd3c95
Opcode Fuzzy Hash: 118f1cef26720b4861566893e0de54ebb40160411a9db2ff76e9d22af775da4a
Instruction Fuzzy Hash: 3371AF71A083519BC718CE28C09436EBBE2AFC4759F14AD2DEC99A7395D770DD488B82

Function 00E94858 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5a5ab0e6f08e1212459a1051d072897d816136cec1085f020d45d75109a894
Instruction ID: 1c9ea99f9f9d2fac72eecc1ba41705eae791765ffce4b7b15001f377d3c645ca
Opcode Fuzzy Hash: 1b5a5ab0e6f08e1212459a1051d072897d816136cec1085f020d45d75109a894
Instruction Fuzzy Hash: D8514977A49AC147CB249E7C4C416E9AA531BD733873E937AE8B06B3D1D5668C038351

Function 00E9BCB8 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55836fbddb03cbdaf9cff1c314ca2634526aaf9b730aac6315943972a0646e05
Instruction ID: 863c3d8318cedc0c085a60c369bc56c610892ba9a26b9ed6c9c172a7474be30f
Opcode Fuzzy Hash: 55836fbddb03cbdaf9cff1c314ca2634526aaf9b730aac6315943972a0646e05
Instruction Fuzzy Hash: 22515BB19087548FE714DF29D49435BBBE1BB88318F044A2DE5E997390E379DA088F82

Function 00E6BCB9 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98426d52609b44d71ace9bc0825109431283409a88027502b5f6118697708dcb
Instruction ID: 5b9702935078b0b35780a3cc04f26bc85e1558c65864033efd1d14c37e0d2e22
Opcode Fuzzy Hash: 98426d52609b44d71ace9bc0825109431283409a88027502b5f6118697708dcb
Instruction Fuzzy Hash: 0B515AB19016459FDB01CFA4DA94ABEBBF2EF46341F641068E400FB362D7319E10CB66

Function 00E96378 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9b159b4f3877c8d9d6b0debf22a3b75361e34386abef763474a0b287f0c785
Instruction ID: 5e5e5047d5bc4587a28d6d5ab30c51fccc34c5e68fa7385f613b70ff75caa90f
Opcode Fuzzy Hash: 6b9b159b4f3877c8d9d6b0debf22a3b75361e34386abef763474a0b287f0c785
Instruction Fuzzy Hash: 34513B37A0A5C08BCF159E7C1C452F46A135BE3338B3EA37BD8B16B3E5D52688029351

Function 00EA1048 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0570097160aab1b68a550f4511c957a43b2e8abafe0f435217c9cb9528a807
Instruction ID: 6e16e0251a426bc6a88d8b439bf24effd98414a9de30077b13d400aefc0fe5d2
Opcode Fuzzy Hash: 2d0570097160aab1b68a550f4511c957a43b2e8abafe0f435217c9cb9528a807
Instruction Fuzzy Hash: 6851E57460D3409BDB14DF15C880A2BBBE5EF9B348F14986CE5C5AB252D332EC50CB26

Function 00E6A268 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054442773fa85cc7e7f2bc6a691852260fd407d19e094a4ce9a9a5ee557263b7
Instruction ID: 7713d22772c45803cb9e8772c10cbe0d91e6215cbaf326a52afb8e2647280f38
Opcode Fuzzy Hash: 054442773fa85cc7e7f2bc6a691852260fd407d19e094a4ce9a9a5ee557263b7
Instruction Fuzzy Hash: B841357088C3409BC701BF58E588A1EFBE5EF56785F58AD2CE0D4A7262C636C8108F67

Function 00E62B08 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bda98c2f30a516d50807ce0b98e746189b08d9b89d3b03278e09447c629b6b2
Instruction ID: 6c852339fb105a7296e2d143ea35fd8663503f0bc2b7aa7ef3089f94441dc714
Opcode Fuzzy Hash: 8bda98c2f30a516d50807ce0b98e746189b08d9b89d3b03278e09447c629b6b2
Instruction Fuzzy Hash: 2E51E2B0A447009FC714DF18D88092AF7E4FF853A8F15666CED95AB352D631EC41CB92

Function 00E6E3F3 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b2c5dc47880b26d63c4cac224246904b14b76870b104fed36430456e3dcfb5
Instruction ID: 37dd1f4644dd71b3b214c127c4dfa728bdcf8074c9dc097dc1c350c50d9e503a
Opcode Fuzzy Hash: 34b2c5dc47880b26d63c4cac224246904b14b76870b104fed36430456e3dcfb5
Instruction Fuzzy Hash: 1741F6B494026A9BDF018F94DC94BBEBBB1FF06345F145858E821BB391D734A910CBA8

Function 00E6E768 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5e34cb232997b27782127b8cd1ef61722e578a9a41e811742eb7c47ee6c68f4
Instruction ID: 310dbb960dc4ec2cc179872dbad43a97517fee488c4b55f5658b5430d6abde7e
Opcode Fuzzy Hash: f5e34cb232997b27782127b8cd1ef61722e578a9a41e811742eb7c47ee6c68f4
Instruction Fuzzy Hash: B2412276A0C3984FD35CCE7A989412A7BD2ABC5350F18C63EF4A6873C4E6708A09E750

Function 00E8ABBB Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b10cf0e7097aa983af4eec26b10cdff308d4fbafdfb15f8fa67f104f1a184b0
Instruction ID: 28f6b5615b5da82d282b484c6ceb7a6f2bc2a4de286bd76e4e425816ded677c3
Opcode Fuzzy Hash: 6b10cf0e7097aa983af4eec26b10cdff308d4fbafdfb15f8fa67f104f1a184b0
Instruction Fuzzy Hash: 4841D3B16082418FD724DA28C44166FB7E2ABDA304F4C696EE49DA7342D634E905CB53

Function 00EA5EE8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e225b96c8bf2e769cc8697a4cfbe4e2a1212ad77f5d165699b061e557b09fc9
Instruction ID: 7e9e52d2640d450b4b033e96f82c899d134d91375d6e28c463429f860fc6f360
Opcode Fuzzy Hash: 8e225b96c8bf2e769cc8697a4cfbe4e2a1212ad77f5d165699b061e557b09fc9
Instruction Fuzzy Hash: D331C136B4D6005FD304DA29CC4165EBBE79FCA324F0DE52DE898EB291CA39D8414B41

Function 00E91FF9 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d162afb33da07c4bd60f7c483336d076906e7f1409a5580b2f65c4fffe7ae7c
Instruction ID: 00fbdb5541501092d962fc6ef4c2467acf3248c2c067d1100ace0a46f6640943
Opcode Fuzzy Hash: 0d162afb33da07c4bd60f7c483336d076906e7f1409a5580b2f65c4fffe7ae7c
Instruction Fuzzy Hash: C831B3705047819FDF268F298450B62BFE19F53309F28948DD4D6AB753C63AE80ACB61

Function 00E9D598 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41c94bf4b0e2099e2558e9e672031c0a6948b5c6cff94468f528954f99504a0
Instruction ID: 1e930d499099c9fe7ad919ee21b68188a9b3692cdadacf96d34eab2b4b4ccc80
Opcode Fuzzy Hash: e41c94bf4b0e2099e2558e9e672031c0a6948b5c6cff94468f528954f99504a0
Instruction Fuzzy Hash: C3312F32A0D7344BDB159D388C502AEB7929BC6330F19977DEDBA6B3C6DA344C419381

Function 00E69AE8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff721506fae7554bc00bc682493813926a926291962e7d101190d432c5989efe
Instruction ID: 9de991d0516543d3f2b08acf88d024f289335482e880123fb8da86f8c5274cc3
Opcode Fuzzy Hash: ff721506fae7554bc00bc682493813926a926291962e7d101190d432c5989efe
Instruction Fuzzy Hash: 04317A298896F106C732893DA4A04ADBF946D962A839942EDC8F15F3C3C5528D46D3E8

Function 00EA0C08 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba455b42178d8c6815bdc6dc6395f760710097916b5094dc96ff09895023de6e
Instruction ID: e73898eb923131fdf3d33564b2bcd3c7e7ae46835016bd1652e6d56ea4163eee
Opcode Fuzzy Hash: ba455b42178d8c6815bdc6dc6395f760710097916b5094dc96ff09895023de6e
Instruction Fuzzy Hash: 42314AB1508340AFD710DF59C584B1BFBE5EB8A718F14991CE4C8AB251C376E909CB96

Function 00E61A58 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592ae079f84e3206837f27edfef0d756db5bd63b1ae8b67b4edac06f6a01af03
Instruction ID: 5c69ecbc5ad0a8416f9bef9a59f605686079f06962f9a7b15a55e8932a323ce2
Opcode Fuzzy Hash: 592ae079f84e3206837f27edfef0d756db5bd63b1ae8b67b4edac06f6a01af03
Instruction Fuzzy Hash: 4D31EA30B452009BD7119E99E88097AB7E1EFC4398F1CA9ADE899BB241D231DC42CB42

Function 00E72702 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d538187a92fb4ac2440c57b712b554e1d8159c40c43cb23878864ac6b56818ea
Instruction ID: e40e39bb73ae3fe5ab64ab948a47f4de4959fade95acd23dd0431add3a93b4b4
Opcode Fuzzy Hash: d538187a92fb4ac2440c57b712b554e1d8159c40c43cb23878864ac6b56818ea
Instruction Fuzzy Hash: 2631A9B0A00B008FE366CF34C480A6AF7E5AB4A700F24E92DD18AA7641E730F944DB61

Function 00E8B175 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31ba30025e973e205b9eb2b84926fbe6cfd1052fcf67400e8907e88fc818d30
Instruction ID: 6b948a71e6d5653004b4eb2a1b70175648dab57e9a4da38aeaf146397974b2b1
Opcode Fuzzy Hash: d31ba30025e973e205b9eb2b84926fbe6cfd1052fcf67400e8907e88fc818d30
Instruction Fuzzy Hash: 14216BB09083409BD714AF55C8A162BBBF1EF86394F446A0DF4CAAF761E375C884CB56

Function 00EA3F68 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89c87bf8a49416322561c17cacfa981ac5946f4534b3d23e182106c98db3fcd
Instruction ID: d2c0ca4ff0b1e2e274c096827037a7fd0fd29279ad5995b8af01ca55f97d8e8e
Opcode Fuzzy Hash: b89c87bf8a49416322561c17cacfa981ac5946f4534b3d23e182106c98db3fcd
Instruction Fuzzy Hash: 50317E36A046D24FDB36CA3C44A046D7FA05F9622538A43EED8B09F3D3CAA1D980C7D5

Function 00E69BF8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732362d4dea3aa06521cfd35fc4552f794cef7578ca5345e22e1eca341dced0c
Instruction ID: 72bcd41b25dabdec2fce541bb6bf380bfbda27a86357b66f65cadfda33cec7e3
Opcode Fuzzy Hash: 732362d4dea3aa06521cfd35fc4552f794cef7578ca5345e22e1eca341dced0c
Instruction Fuzzy Hash: 42113A736997944ACB1A89289C6007BFBC59AF210878DD5BDD5C6A3346D422EC0DC26A

Function 00E88278 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fd84eb35d493625d844e637e1fb177c40288a20f3196d160322e86c00bf206
Instruction ID: 20d0988819ab3c32d01a4a8e257b53e6ae491e311aff88e3adb0b41f5a23814e
Opcode Fuzzy Hash: 10fd84eb35d493625d844e637e1fb177c40288a20f3196d160322e86c00bf206
Instruction Fuzzy Hash: 6A212876D002698ACB249F5488002ADB7B0FF12751FA4E4D9D88C77240EF359E85DFA5

Function 00E866E6 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4db2e7a7e6a4b6bfbd63caea179ea7f405d1524a8af3c95513a11a8f7ada3b
Instruction ID: 6a5a437dd611d56c39ac8e43972caf0d29712db86f3d18f362a676a89e08c929
Opcode Fuzzy Hash: 5a4db2e7a7e6a4b6bfbd63caea179ea7f405d1524a8af3c95513a11a8f7ada3b
Instruction Fuzzy Hash: 4911B1701083409FDB00EF14DC80A6AB7F9EB86309F54691DF0C9AB261E332E954CB56

Function 00E8C198 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c51315b3c12bd18b55da43b597f25570391444391c721ad26d4c76662b1ac61
Instruction ID: 70aa45955a098b7160fbfbd4101d52f7c9d7d549b4e2f11faf148c4969f376aa
Opcode Fuzzy Hash: 9c51315b3c12bd18b55da43b597f25570391444391c721ad26d4c76662b1ac61
Instruction Fuzzy Hash: D2214871108341ABD740DB15C48461BBBF2BB86395FA4A81CF4CCA7662D335D844CB26

Function 00E71920 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b896b6d8164971cb7ba37414f80df5efc22a3a844d39286caadf7c5c62d1198
Instruction ID: 0a5dbc270ae751cfb5beb85ebcdc8b504112c7cbb3e8ab77d16b54d231cc4a13
Opcode Fuzzy Hash: 5b896b6d8164971cb7ba37414f80df5efc22a3a844d39286caadf7c5c62d1198
Instruction Fuzzy Hash: C9213870510B508FD7268B34C891A67BBF1FF42301F08599DE687ABA92D736F806CB54

Function 00E98B78 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 751adbd02cf0c5f291c48f256d32f72c8bb40d9bf1f5946f67b767e3147d0fa1
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: D9112977A041D00DC7128D3C84005B4BFA34A93234F5D93D9F4B4AB2E2EA23CD8A8354

Function 00E8E2E8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960e2e00e3628e1f5e3ba26c325b6cc30fadb638be8208b4fd5208f2d766984d
Instruction ID: 9631a5a50664d1109e47a9054bf948df2382b3e33b456eec88a217202a55b750
Opcode Fuzzy Hash: 960e2e00e3628e1f5e3ba26c325b6cc30fadb638be8208b4fd5208f2d766984d
Instruction Fuzzy Hash: 67017CF260070157EB24BEA594C1B2BB2ECAF91708F18652CE85C77302DB75EC0587A5

Function 00E86410 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1a30c5f86df9b29ac032a507831b123af95fa9cc9c1ef612b51c76bc2b554d
Instruction ID: 44dfa3b5ba693e6fca3c15665e27c67c10137bde35d638eba16ee23164d18fc6
Opcode Fuzzy Hash: ad1a30c5f86df9b29ac032a507831b123af95fa9cc9c1ef612b51c76bc2b554d
Instruction Fuzzy Hash: 901100714083189FC710FF14C8806AEB7E8FF06344F05682CE899A7261E779E688CB56

Function 00E6C81B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7537f5fd8384a83163d866f176097abd77cb40ec27a0881dcf1d300453dad3e
Instruction ID: 0d2f2a1c55ccc1f3da8e3e91d618413f22263f97d545aaa00f2f7999795a0f8b
Opcode Fuzzy Hash: d7537f5fd8384a83163d866f176097abd77cb40ec27a0881dcf1d300453dad3e
Instruction Fuzzy Hash: 191104B1E452454BCB19CF64E8802BEB7B7AF9B344F386028D045B3341E734B905C7A8

Function 00E8C3AC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9d6f7422685d54ac9c4b229ea6dda6c46a3da1920c7261afbe68902de17981
Instruction ID: f3b803a58ef9d53e82962fe637acdccadbbbcebe75ba7f4affd3b852c91f6535
Opcode Fuzzy Hash: cc9d6f7422685d54ac9c4b229ea6dda6c46a3da1920c7261afbe68902de17981
Instruction Fuzzy Hash: 8401BC70E016068FCB14DF08D8506AAB3F1FF9A320F14A16AE859B77A0E7349941CB60

Function 00E6F058 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bcc21ab59f3068ab92d7e069a64477687dc0058f8902c272e32a697d861a1d
Instruction ID: c63440f853c9597595619fa4ce77ea6bf8d3953273f841e4d94b7e73d783b460
Opcode Fuzzy Hash: e0bcc21ab59f3068ab92d7e069a64477687dc0058f8902c272e32a697d861a1d
Instruction Fuzzy Hash: 67012173A28921078748DD3DDC1156B7AD15BC5630F19873DB9BAC73D0D634C8458655

Function 00E78948 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1feb0ecdb06b802b1560528e9a5af3474081b4572b374f0f40b5c4f3f9bd469
Instruction ID: d2ca71c7e2597a2b323b60e269855ce4b409ba33cccad72860604fa5b97ebdd9
Opcode Fuzzy Hash: c1feb0ecdb06b802b1560528e9a5af3474081b4572b374f0f40b5c4f3f9bd469
Instruction Fuzzy Hash: C3F0ECB2A441119BDF2189969CC4B37FBECCBD7358F1D2455E98D77202D1615840C7E7

Function 00EA3A08 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085a7920e2e5b4e779e34a684b632e4f4ebff8cfa837e5ac39cd2be3ef1db2f6
Instruction ID: 22b7613c47a28370fb3891ed409c501e76853fb8a4191b55d39cb1d3f6738020
Opcode Fuzzy Hash: 085a7920e2e5b4e779e34a684b632e4f4ebff8cfa837e5ac39cd2be3ef1db2f6
Instruction Fuzzy Hash: C7F03A7450C3809FD305EB18C480A2EFBF5EB9A305F559D1CE0C5A7222C235E890CB26

Function 00EA6140 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba64387f099f4ffb45be2b82222d83dc5fb2b584328ce1a123674adc3a9cf20
Instruction ID: 0dd06ddfd1479d3193973afe2725822c7c585bf4f45c4e0fa6d787da4e48b270
Opcode Fuzzy Hash: dba64387f099f4ffb45be2b82222d83dc5fb2b584328ce1a123674adc3a9cf20
Instruction Fuzzy Hash: 9BF01234509240ABC302AF18C48092EFBF1EF1B700F48A81CE1C8A7222D336E820CB66

Function 00E4A64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: 5ab95b4466c307fbcb7e68c6237044e66a8befc5118f4ed083898b61986857e6
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: 85E08C32961238EBCB24DB98D90499AF3ECEB49B14B1A04A6B502E3210C270DE00CBD1

Function 00E9EC08 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: ebe72fcbdadd70cb6f3a350ae88319aa92793c6a32fb38ef020c79fea3e0a15c
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: A0D05B21508261569F64CD199400877F7E0E9C7711B45555EF5C1F3244D230DC41C269

Function 00E32003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33963e677186c8f46f46d9d3ae0e5f8b273394a93ae2ee0ffda54dc740d589a
Instruction ID: cc1dabcbe869b18f11b4352b7fc19e265767e765f3ddeea04510946d5d671a79
Opcode Fuzzy Hash: c33963e677186c8f46f46d9d3ae0e5f8b273394a93ae2ee0ffda54dc740d589a
Instruction Fuzzy Hash: CBD0953A606A509FC310CF0AE440942F7B8FB99630B1682A6E944A3B20C330FC02CAE0

Function 00E40F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: 0586e4d43948dc75219655de71f45ccb7560aaf1e8a0e036aeb8986ad3d75ad4
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: 2FC08C3424090096CE398911A2713A43395A3B27A6F8824FCDE1A1B742C52E9C8ADA01

Function 00E72D4B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a927264b8af54b329c315b56f05fbf2d8de1dbd38e325cfc03de9a518d2d83b6
Instruction ID: 5175f2ea0191b1bca832d2342d85d6c8eee8c059ed43a4f59e55bfdb657d2f91
Opcode Fuzzy Hash: a927264b8af54b329c315b56f05fbf2d8de1dbd38e325cfc03de9a518d2d83b6
Instruction Fuzzy Hash: 7CB092E1C8030186EE512A213C5243AB0680523351F0834B0E81733243A926D518916B

Function 00E8D75B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bde8e0a18542e65954db997d1931066d1f8d4cb0ee69fd957d26d9737444eaa
Instruction ID: 6a78743ae2ef93c47f94a2b4b895782838f9dae893cdf774ae4dc3f9c31a5195
Opcode Fuzzy Hash: 9bde8e0a18542e65954db997d1931066d1f8d4cb0ee69fd957d26d9737444eaa
Instruction Fuzzy Hash: 77B092E1C8251086981A2EA13D034EEB1680D53341F047035E81632203AA26E21A82AF

Function 00EA6343 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005c4ba806c1f729e01d7b345e607bcf037a1a2af418616e2fc01539d0967c76
Instruction ID: 7795c8e62c6c1a2cba6d6766a4d5bb610867df3ac219b3c08ddfb2e365f90ae1
Opcode Fuzzy Hash: 005c4ba806c1f729e01d7b345e607bcf037a1a2af418616e2fc01539d0967c76
Instruction Fuzzy Hash: D2B092B09083409BE644CF04C4A053AF3B5FB87229F00A82CE15AA3152C330E808CF0E

Function 00EA604C Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e353222c480a1e836f2e88ec6b0f54e01aefb973cbd9e2a65436a63ab80d9507
Instruction ID: 90b20a1011eb729eb64d159c706abf0f2e45b7b0e11e27798d7b31732cf018ce
Opcode Fuzzy Hash: e353222c480a1e836f2e88ec6b0f54e01aefb973cbd9e2a65436a63ab80d9507
Instruction Fuzzy Hash: F7A00225E5C10197C60CCF24A950571E2B95BBF205F513428C005BB852D510D440961C

Function 00E7338E Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee70fe1013954b18253420cd7c879e3bafbcdc7016d02e7bb28bbb050ed5ff3e
Instruction ID: eb9c71f61387cf9290d7c446bbbdb1ba1a08eb420cde55b5b5e8e69408f34382
Opcode Fuzzy Hash: ee70fe1013954b18253420cd7c879e3bafbcdc7016d02e7bb28bbb050ed5ff3e
Instruction Fuzzy Hash: C0900224D4830086C2488E409490470E23A564F606E117018850D334924620E500850C

Function 00E7165F Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0348c40113168c569ecdbaf33ce4c7ca3883923b3352dc9550a20db56e356de0
Instruction ID: 125aa2fd33e84a88d69890093f1abe8245766079576a578208108fcfe1822cf2
Opcode Fuzzy Hash: 0348c40113168c569ecdbaf33ce4c7ca3883923b3352dc9550a20db56e356de0
Instruction Fuzzy Hash: D9900228D582008A8100CE4494A0470F278620B206F1034109008F3012D210E804850C

Function 00E353B1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00E353B8
std::_Lockit::_Lockit.LIBCPMT ref: 00E353C2
int.LIBCPMT ref: 00E353D9

Part of subcall function 00E316B4: std::_Lockit::_Lockit.LIBCPMT ref: 00E316C5
Part of subcall function 00E316B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00E316DF

std::_Facet_Register.LIBCPMT ref: 00E35413
std::_Lockit::~_Lockit.LIBCPMT ref: 00E35433
Concurrency::cancel_current_task.LIBCPMT ref: 00E35440

Strings

R[, xrefs: 00E35420

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID: R[
API String ID: 55977855-3972925902
Opcode ID: 4cfea949c51bc0ef1aa00e46889f4ea781b6c409ce859303fbbd895bbbbcd6f6
Instruction ID: 6820eb890bf6cac6474165bdd5a911749f1ad136f1e8430e9b4fd8821cdc8d5d
Opcode Fuzzy Hash: 4cfea949c51bc0ef1aa00e46889f4ea781b6c409ce859303fbbd895bbbbcd6f6
Instruction Fuzzy Hash: 7B11DFB2910A149BCB14EB64D80A7AE7BF5AF84325F54254DF851B7390DFB4AE04CB80

Function 00E3A5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00E3A6E7
___TypeMatch.LIBVCRUNTIME ref: 00E3A7F5
CallUnexpected.LIBVCRUNTIME ref: 00E3A962

Strings

csm, xrefs: 00E3A71E
csm, xrefs: 00E3A605
csm, xrefs: 00E3A672

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: fdbc9e5e6d723da486d2435b84f501731ae495a7521c73be34eea1c8a2ee74f1
Instruction ID: 386187065228c9d08e42f8588ec97b11232751af7964dacb85437e1dfe608dcf
Opcode Fuzzy Hash: fdbc9e5e6d723da486d2435b84f501731ae495a7521c73be34eea1c8a2ee74f1
Instruction Fuzzy Hash: 13B19D71800209DFCF18DFA4D9899AEBFB5BF04314F19617AE8917B212D731DA91CB92

Function 00E45F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,65A836C3,?,00E46057,00E3C446,?,F8250000,00000000), ref: 00E4600B

Strings

ext-ms-, xrefs: 00E45FB5
api-ms-, xrefs: 00E45FA1

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b0da6df523dabb5d4189c5eee04e27a97e0fdcc66696bfeba7e6761079cee229
Instruction ID: 0cc2d40efbb4685ef39d2cca6e6e3c89af6fc7698bb3287c2f6a5f3d8231594e
Opcode Fuzzy Hash: b0da6df523dabb5d4189c5eee04e27a97e0fdcc66696bfeba7e6761079cee229
Instruction Fuzzy Hash: 0021EB33B00710ABC7319F35FC44AAE7768AB417A9B251615F916B72D2DB30EE08C6E1

Function 00E3507A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00E35081
std::_Lockit::_Lockit.LIBCPMT ref: 00E3508C
std::locale::_Setgloballocale.LIBCPMT ref: 00E350A7
_Yarn.LIBCPMT ref: 00E350BD
std::_Lockit::~_Lockit.LIBCPMT ref: 00E350FA

Strings

R[, xrefs: 00E350C9, 00E350ED

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID: R[
API String ID: 156189095-3972925902
Opcode ID: ec5a351edcadc87b65b558c6eada8a0f7112e6144be2351a914b25a2a1fc0fcd
Instruction ID: ff100ae748ba9b08c469d696e8851da2171b54c68f3ccc34c59205b99e9dd10c
Opcode Fuzzy Hash: ec5a351edcadc87b65b558c6eada8a0f7112e6144be2351a914b25a2a1fc0fcd
Instruction Fuzzy Hash: 10019AB6A01A108FC70AAB20984AA7D7BE1BF84380F245009E85137391CB34AE05CB81

Function 00E40F50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,65A836C3,?,?,00000000,00E51FC8,000000FF,?,00E40EE0,00E41010,?,00E40EB4,00000000), ref: 00E40F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E40F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,00E51FC8,000000FF,?,00E40EE0,00E41010,?,00E40EB4,00000000), ref: 00E40FB9

Strings

R[, xrefs: 00E40FA8
CorExitProcess, xrefs: 00E40F8F
mscoree.dll, xrefs: 00E40F7E

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$R[$mscoree.dll
API String ID: 4061214504-706027784
Opcode ID: aeb57fc46158e29e44993b2190fc4c9e0e7a2a9c7dc43cc48fee54e26faa8e0a
Instruction ID: 84337dff4b9124b6cab4a72917c26fba237a096d8b559799ae91e7dfeb586f66
Opcode Fuzzy Hash: aeb57fc46158e29e44993b2190fc4c9e0e7a2a9c7dc43cc48fee54e26faa8e0a
Instruction Fuzzy Hash: 7C014431604715AFDB258B61DC05BAEBBB8FB04B56F040935FD11B26D0DB749908CA50

Function 00E4F356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02887942e30e69682859f69bac0d11ae1214c60c5a00b9d712616a4ae3e6da24
Instruction ID: b233afba90c68acc145b5dd58bc6b624df23099a0a0b508787ffbea58729b034
Opcode Fuzzy Hash: 02887942e30e69682859f69bac0d11ae1214c60c5a00b9d712616a4ae3e6da24
Instruction Fuzzy Hash: B4B1E270A042059FDB11DFA9E880BAE7BF1AF85704F1562A9E410BB2A2C774DD41CBA1

Function 00E47747 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(65A836C3,00000000,00000000,00000000), ref: 00E477AA

Part of subcall function 00E4952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00E48FD3,?,00000000,-00000008), ref: 00E495D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00E47A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00E47A4D
GetLastError.KERNEL32 ref: 00E47AF0

Strings

v , xrefs: 00E479CB, 00E47A13, 00E47A6E, 00E4793A, 00E47A83, 00E478E6

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID: v
API String ID: 2112829910-1689364375
Opcode ID: 63120689d5ff968744be6defa1213912a22dfe7f4d155688ea2f46fa48329862
Instruction ID: 03f157cdb45f864b70cb7e54a6bb467dbe19792c7354ffddfab584d001032e7a
Opcode Fuzzy Hash: 63120689d5ff968744be6defa1213912a22dfe7f4d155688ea2f46fa48329862
Instruction Fuzzy Hash: 86D16975E042589FCB15CFA8E8809EDBBB5FF49304F18462AE895FB351D730A945CB90

Function 00E3A25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E3A251,00E38978,00E37AFF), ref: 00E3A268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E3A276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E3A28F
SetLastError.KERNEL32(00000000,00E3A251,00E38978,00E37AFF), ref: 00E3A2E1

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 90da564f21c5f18c921caea43f0bc14872ac0b8ee859f4cea74b902d745d08a0
Instruction ID: c05e3ade1637b52e620b8d81f87d6f217c139261f84d3cc350b9df3e63194598
Opcode Fuzzy Hash: 90da564f21c5f18c921caea43f0bc14872ac0b8ee859f4cea74b902d745d08a0
Instruction Fuzzy Hash: BF01923210D3116EA6392675BC8EA6B2F86EB02779F241639F520710F1EB524C8AD146

Function 00E3A371 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00E3A438
___AdjustPointer.LIBCMT ref: 00E3A45B
___AdjustPointer.LIBCMT ref: 00E3A4F7

Strings

R[, xrefs: 00E3A3D0

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: AdjustPointer
String ID: R[
API String ID: 1740715915-3972925902
Opcode ID: 797283f281212cc3d1b273aca28351cd15a9c5d5831f7e5a8e3f51ee2b023275
Instruction ID: 99b0994a18be99113c4c0f0b844b85ed14167dd0a8b4ecaa2ba3d966580d20de
Opcode Fuzzy Hash: 797283f281212cc3d1b273aca28351cd15a9c5d5831f7e5a8e3f51ee2b023275
Instruction Fuzzy Hash: A151D272601306AFDB298F54D84DBBABBA4EF00314F18553DE8A5A7191E771ECD0C792

Function 00E34436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E34442
int.LIBCPMT ref: 00E34455

Part of subcall function 00E316B4: std::_Lockit::_Lockit.LIBCPMT ref: 00E316C5
Part of subcall function 00E316B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00E316DF

std::_Facet_Register.LIBCPMT ref: 00E34488
std::_Lockit::~_Lockit.LIBCPMT ref: 00E3449E
Concurrency::cancel_current_task.LIBCPMT ref: 00E344A9

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 563c3681fc947625e4bc2d13b595076f537318d4593ff8600e1a279f632894ab
Instruction ID: 13cd53a0552362e7c44fddde0ecee5d8102561785a5496c65bc97eb20c79ec85
Opcode Fuzzy Hash: 563c3681fc947625e4bc2d13b595076f537318d4593ff8600e1a279f632894ab
Instruction Fuzzy Hash: 6901A7B2500114ABCB19EB54D80D9AE7FB8DF80360F14215DF9157B2D1DB30EE41C790

Function 00E33DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E33DBD
int.LIBCPMT ref: 00E33DD0

Part of subcall function 00E316B4: std::_Lockit::_Lockit.LIBCPMT ref: 00E316C5
Part of subcall function 00E316B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00E316DF

std::_Facet_Register.LIBCPMT ref: 00E33E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00E33E19
Concurrency::cancel_current_task.LIBCPMT ref: 00E33E24

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 047141df81f113f3ceaa17a9efde8ca1714bb6d1810a761a5dec67d2d6291736
Instruction ID: ef1a5b2c2db6eda693f4706fafd953449cc8f9fafac9401b2c9de9146479a9ae
Opcode Fuzzy Hash: 047141df81f113f3ceaa17a9efde8ca1714bb6d1810a761a5dec67d2d6291736
Instruction Fuzzy Hash: 3201A772904114ABCB25AF65DC4DCAE7FA8DF81360F142149F801B7291DB31AF01CB90

Function 00E34308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E34315
int.LIBCPMT ref: 00E34328

Part of subcall function 00E316B4: std::_Lockit::_Lockit.LIBCPMT ref: 00E316C5
Part of subcall function 00E316B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00E316DF

std::_Facet_Register.LIBCPMT ref: 00E3435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00E34371
Concurrency::cancel_current_task.LIBCPMT ref: 00E3437C

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 7a2b70810abb00702f79afc80d7d4a4efb62b22f3015ce05ba56fae37b6d2179
Instruction ID: d102a095e5a8606f4f80349f63ee709b8a0bbb7bc36779c8e22087fe0edce900
Opcode Fuzzy Hash: 7a2b70810abb00702f79afc80d7d4a4efb62b22f3015ce05ba56fae37b6d2179
Instruction Fuzzy Hash: 3601A7B2501518ABCB15AB68D84E8DE7FA89FC0754F152199F801773D1DB34AE05C7D0

Function 00E3A060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00E3A09F
__IsNonwritableInCurrentImage.LIBCMT ref: 00E3A153

Strings

R[, xrefs: 00E3A16C
csm, xrefs: 00E3A13D

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: R[$csm
API String ID: 3480331319-1515388219
Opcode ID: 8ba164e0bca4331cf0d8fd262db7ebe5ee1df3c6a93befd70a66f6515d8c24c4
Instruction ID: e6305f8798fa0ca910ed3c7b0fc1b1dfb7818874c79276415e990aa1c7ddd119
Opcode Fuzzy Hash: 8ba164e0bca4331cf0d8fd262db7ebe5ee1df3c6a93befd70a66f6515d8c24c4
Instruction Fuzzy Hash: 4141B270A012089BCF14DF68C889A9E7FF5AF45318F189165E855BB292C7329E85CB91

Function 00E3B3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00E3B353,00000000,?,00EB68EC,?,?,?,00E3B4F6,00000004,InitializeCriticalSectionEx,00E54BD8,InitializeCriticalSectionEx), ref: 00E3B3AF
GetLastError.KERNEL32(?,00E3B353,00000000,?,00EB68EC,?,?,?,00E3B4F6,00000004,InitializeCriticalSectionEx,00E54BD8,InitializeCriticalSectionEx,00000000,?,00E3B2AD), ref: 00E3B3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00E3B3E1

Strings

api-ms-, xrefs: 00E3B3C6

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: ac753e594ed8b6d05b96974d6d1e98bb04cdecb1328526901befab4a5017fb26
Instruction ID: 06037e95ac28a3992779b19d89c141eefe0939ad449b773a09812b2282a41d9c
Opcode Fuzzy Hash: ac753e594ed8b6d05b96974d6d1e98bb04cdecb1328526901befab4a5017fb26
Instruction Fuzzy Hash: 40E04F32280304BBEF211B72EC4AB5D3E69AB50B96F101421FB0DF80E1E7B1DA64C684

Function 00E506EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00E4F713,00000000,00000001,00000000,00000000,?,00E47B44,00000000,00000000,00000000), ref: 00E50706
GetLastError.KERNEL32(?,00E4F713,00000000,00000001,00000000,00000000,?,00E47B44,00000000,00000000,00000000,00000000,00000000,?,00E480CB,00000000), ref: 00E50712

Part of subcall function 00E506D8: CloseHandle.KERNEL32(FFFFFFFE,00E50722,?,00E4F713,00000000,00000001,00000000,00000000,?,00E47B44,00000000,00000000,00000000,00000000,00000000), ref: 00E506E8

___initconout.LIBCMT ref: 00E50722

Part of subcall function 00E5069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00E506C9,00E4F700,00000000,?,00E47B44,00000000,00000000,00000000,00000000), ref: 00E506AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00E4F713,00000000,00000001,00000000,00000000,?,00E47B44,00000000,00000000,00000000,00000000), ref: 00E50737

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 76e58e072c6a150bc9361d6c214de806687c083b75a72fc6bf2452b1b0567c69
Instruction ID: 8330f9598208325a150f2224f5960a9054c4cfb42d41aa1ab5d4b44d135b8278
Opcode Fuzzy Hash: 76e58e072c6a150bc9361d6c214de806687c083b75a72fc6bf2452b1b0567c69
Instruction Fuzzy Hash: 03F01C36001254BFCF262FA6DC0998A3FA6FB493E2F004810FE19B5520CA328934DF90

Function 00E51093 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00E509EF), ref: 00E510AC

Strings

R[, xrefs: 00E51176, 00E51220, 00E51266
Li, xrefs: 00E51241

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: DecodePointer
String ID: Li$R[
API String ID: 3527080286-2265778396
Opcode ID: 72f9b25acac396650489485ca7c0dce8951824b7188cf0753d810fcfff895024
Instruction ID: c0ee5aa35f80c51e66a06e984bdc54081f4b1197965ad34baa2cc1bdadd8d6d4
Opcode Fuzzy Hash: 72f9b25acac396650489485ca7c0dce8951824b7188cf0753d810fcfff895024
Instruction Fuzzy Hash: D1518D74900A0ADBCF108FA9DA482FD7BB4FB8530AF5169C4DD81B7264C770892C9B54

Function 00E406E9 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe, xrefs: 00E40727, 00E4072E, 00E4074B, 00E40760, 00E40798
j, xrefs: 00E40736

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe$j
API String ID: 0-3471681938
Opcode ID: 8de3fba98e601865aede013cd77ceb72479a3ffcde7515423f032a432e329b6f
Instruction ID: b97cc88ae56cc024646e92c0c94cbeec8db6c9bc5f5f923d2d4f0e0d60d82784
Opcode Fuzzy Hash: 8de3fba98e601865aede013cd77ceb72479a3ffcde7515423f032a432e329b6f
Instruction Fuzzy Hash: 1631A871A04218AFCB11EF9ABC8599F7BE8EF88754F11517BE644B7201D6709E009BD1

Function 00E35F4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 00E36026

Strings

R[, xrefs: 00E36005

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: Fputc
String ID: R[
API String ID: 3078413507-3972925902
Opcode ID: 6faee0b13a7cb53227269fcb29be617afc5c453657297179305210a3ef01266d
Instruction ID: 4f9534b61eeee3bba1b5baf13b81347bc3ed357184f121e6d123c096739ac253
Opcode Fuzzy Hash: 6faee0b13a7cb53227269fcb29be617afc5c453657297179305210a3ef01266d
Instruction Fuzzy Hash: 33414A36A10A1AABCB14DF64C4888EEBBB9FF08354F146126E941B7790E731F945CF90

Function 00E3A96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00E3A992

Strings

MOC, xrefs: 00E3A9A4
RCC, xrefs: 00E3A9AC

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 5ab87c87ff7f173fb5dfe2d34e888ea511d0048d52bfae733a0d7cc183593421
Instruction ID: b6c2e152d7623445a4a16f92abdc307748fcf83cd1aa066e8857381b8557953f
Opcode Fuzzy Hash: 5ab87c87ff7f173fb5dfe2d34e888ea511d0048d52bfae733a0d7cc183593421
Instruction Fuzzy Hash: BB418A32900209AFCF16DF98CD89AAEBFB5FF48304F195069FA58B7211D3359990DB52

Function 00E35107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E35113
std::_Lockit::~_Lockit.LIBCPMT ref: 00E3516F

Strings

R[, xrefs: 00E3513A, 00E35154

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: R[
API String ID: 593203224-3972925902
Opcode ID: 8d92c16148cc29b1da6bb1835869e6315b8bef99cc6b0ac270fdf3d10da43699
Instruction ID: 7c53972dd857acd8f4ed43a1ba0dcdc5ba3ee506b66debfad922c38b4682cfa6
Opcode Fuzzy Hash: 8d92c16148cc29b1da6bb1835869e6315b8bef99cc6b0ac270fdf3d10da43699
Instruction Fuzzy Hash: 48019E71600A14EFCB15DF25C889E9D7BB9EF85754F050099E801AB3A1DF70EE04CB50

Function 00E315DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E315E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00E3161E

Part of subcall function 00E35178: _Yarn.LIBCPMT ref: 00E35197
Part of subcall function 00E35178: _Yarn.LIBCPMT ref: 00E351BB

Strings

bad locale name, xrefs: 00E3162C

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: c6ff7cdb190250353015c6730603ec67d21b0866af91665b8727781327d7a2cc
Instruction ID: ad4d548fda0f2bff0291e0831528c350cc1aee6634d117b6508f511effa17580
Opcode Fuzzy Hash: c6ff7cdb190250353015c6730603ec67d21b0866af91665b8727781327d7a2cc
Instruction Fuzzy Hash: 8EF030B1505B909E83319F7A8485447FFE4BE28310B949E6FE0DED3A11D730E404CB6A

Function 00E462A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 00E462E6

Strings

R[, xrefs: 00E462D6
InitializeCriticalSectionEx, xrefs: 00E462B6

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$R[
API String ID: 2593887523-432795312
Opcode ID: 0d6945a72a0f4aaffd6c302e14034a7443c75e2e3788cc3ec23df706c1b964ec
Instruction ID: 9fa1f37dca293bf242f796ef7c9047d53fef10e1302bf9c290bf539a055dbbce
Opcode Fuzzy Hash: 0d6945a72a0f4aaffd6c302e14034a7443c75e2e3788cc3ec23df706c1b964ec
Instruction Fuzzy Hash: BCE09232640318BBCF122F61FC06ECE7F25DB457A2B005420FD18361B0C6B2D964D6D5

Function 00E4612C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00E46160

Strings

R[, xrefs: 00E46156
FlsAlloc, xrefs: 00E4613C

Memory Dump Source

Source File: 00000000.00000002.1431702013.0000000000E31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1431684649.0000000000E30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431742621.0000000000E53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431766678.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431807133.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431831097.0000000000EB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1431847277.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_SecuriteInfo.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc$R[
API String ID: 2773662609-3428055260
Opcode ID: b970b63fa3c3e4ad080e3742a29896dbe9b45ce69d3060f280802e77715c0bc6
Instruction ID: de0eed226f1ac8a3c99b2e62be7bff12d2bc6192a19d63df796c77f3f462f7a0
Opcode Fuzzy Hash: b970b63fa3c3e4ad080e3742a29896dbe9b45ce69d3060f280802e77715c0bc6
Instruction Fuzzy Hash: E0E0273578571477C23127717C05EDF7E54CB45B737001410FD08352C2C9A59D5491D7

Analysis Process: MSBuild.exePID: 6396, Parent PID: 6432COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	43
Total number of Limit Nodes:	6

Executed Functions

Function 0040D390 Relevance: 6.2, APIs: 4, Instructions: 154
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D3A1
GetCurrentThreadId.KERNEL32 ref: 0040D3B6
GetCurrentProcessId.KERNEL32 ref: 0040D3BC
ExitProcess.KERNEL32 ref: 0040D580

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID:
API String ID: 1029096631-0
Opcode ID: 91b0cbc643e4b4ebeb18023be9ae76da3501924d19314061550aa6d351ab72eb
Instruction ID: 7fe0d86d4b211a0ed1928a564c0dc3b48ff1420feaec6627cd99d8fdc632b15c
Opcode Fuzzy Hash: 91b0cbc643e4b4ebeb18023be9ae76da3501924d19314061550aa6d351ab72eb
Instruction Fuzzy Hash: CE41277480C240ABD301BFA9D544A1EFBF5EF56708F148D2EE5C4A7392D23AD8148B6B

Function 004464F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00449A1D,005C003F,00000006,?,?,00000018,,?,?), ref: 0044651E

Strings

, xrefs: 004464F0, 0044650C, 0044651A

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00446040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 004460C4

Strings

;:9, xrefs: 004460B6, 00446093, 0044609B
aD, xrefs: 004460CA

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID: aD$;:9
API String ID: 1279760036-3784982549
Opcode ID: b2b91b6383baed23bd5779aad5e8932164b52d5e1660306671fc792bfb274a1b
Instruction ID: 81d8e38a202773684cb26477d2aab6f794b7f55265c2f37ac0847f9732ca8712
Opcode Fuzzy Hash: b2b91b6383baed23bd5779aad5e8932164b52d5e1660306671fc792bfb274a1b
Instruction Fuzzy Hash: 70119D75508200EBD301EF28E900A1ABBF5AF86B16F05483DE5C58B212E73AD854CB9B

Function 00446709 Relevance: 3.0, APIs: 2, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00446709
GetForegroundWindow.USER32 ref: 00446720

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 61e954c21ccda2bc507880c9326b32b816de450e3ecc2bacd25776dc5b00f227
Instruction ID: 906c729b96ff40db5e6bb0cb1f2bfce635365c04e2c32f2be8addff1d813b1a5
Opcode Fuzzy Hash: 61e954c21ccda2bc507880c9326b32b816de450e3ecc2bacd25776dc5b00f227
Instruction Fuzzy Hash: 4ED05EACA12240A7EA04FB37FC1E85B3615E79221E7464838E40686312D636E851C65B

Function 00445C4A Relevance: 1.6, APIs: 1, Instructions: 71
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(33A03193,00000000,00000800), ref: 00445CD7

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 72bf814f0518dc5835282787a3600c9ebb27de0fde571f4b41e5eadb2c516951
Instruction ID: 1ed73a75136f75e105c7bb7e785e3dfd24c55cc57a7816ce4e470644bd5d90c0
Opcode Fuzzy Hash: 72bf814f0518dc5835282787a3600c9ebb27de0fde571f4b41e5eadb2c516951
Instruction Fuzzy Hash: 7A218C7520C380AFE745CF29E99061BBBE1ABC9205F58C82DF5C987352C238D905DB6A

Function 00443A20 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00443A83

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bbe3c0725eeb12269a4fd9373789c992c7f1f0aafca5c16579677f982f5a7c14
Instruction ID: 208812190be25b9880a5f29952ef9a922b1c788544e9e186d94aa430ee1b0748
Opcode Fuzzy Hash: bbe3c0725eeb12269a4fd9373789c992c7f1f0aafca5c16579677f982f5a7c14
Instruction Fuzzy Hash: 67F0373410C2409BE301EF19D954A0EBBF4EF9A701F14886CE4C89B2A2C335E814CBAB

Function 00443AA0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00443B03

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5c61f5cf0f16499e49ba7738a8fe8bc67c56cab5a0bd252042df475734ab51e5
Instruction ID: 302f255876a8acf85142c7b8a32416b12f9909014dbe577f3d47d642ddc48781
Opcode Fuzzy Hash: 5c61f5cf0f16499e49ba7738a8fe8bc67c56cab5a0bd252042df475734ab51e5
Instruction Fuzzy Hash: 84F04F3450C2509BD701AF18E945A1EFBF5EF56706F454C68F4C4AB261C339DD60CB9A

Non-executed Functions

Function 0042D9A0 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 396COMMON

Download Yara Rule

Strings

sB, xrefs: 0042E66D
Dtgr, xrefs: 0042E5C6
RB, xrefs: 0042E64C
9u9s, xrefs: 0042E183
sLlS, xrefs: 0042E5D6
WJL{, xrefs: 0042E5FA, 0042E604, 0042E464, 0042E46D, 0042E60D, 0042E62F
US, xrefs: 0042E1C3

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: 9u9s$Dtgr$RB$WJL{$sLlS$sB$US
API String ID: 0-3351958040
Opcode ID: 276c1ab203addd20c735120bb759d55bade8af3356c5969ab96734506833bd0c
Instruction ID: cba3938b4c7428f4d552087925c859a69b1ab55a6ae02eac8884ff4f61b23fd4
Opcode Fuzzy Hash: 276c1ab203addd20c735120bb759d55bade8af3356c5969ab96734506833bd0c
Instruction Fuzzy Hash: B1F167B4508340DFD710AF66E89061BBBF0AF86345F54892EF5848B362D3B9C844CF9A

Function 004396A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004396B0
GetWindowLongW.USER32 ref: 004396D5
GetClipboardData.USER32 ref: 004396E5
GlobalLock.KERNEL32 ref: 004396FE
GlobalUnlock.KERNEL32 ref: 004397EC
CloseClipboard.USER32 ref: 004397F5

Strings

=, xrefs: 00439773

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: =
API String ID: 2832541153-2322244508
Opcode ID: 78c8dc26131ed5dac9393a6ada90e30b4fdfd99cd617a6bba74dde0b2099fdf1
Instruction ID: 322da3c77394848e095178107a49c73a551c132a77b07a9a0bf135f40f579efd
Opcode Fuzzy Hash: 78c8dc26131ed5dac9393a6ada90e30b4fdfd99cd617a6bba74dde0b2099fdf1
Instruction Fuzzy Hash: 4941537551C381CED311AF7C944831EBFE09B96224F044E6DF4E5862D1D3788945C797

Function 00428230 Relevance: 1.7, APIs: 1, Instructions: 242comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044DB80,00000000,00000001,0044DB70), ref: 00428259

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: e7c828e8500b304e47737f2c036b73e87bd74cd8a23869b162ce918d436332e7
Instruction ID: 8b374b447a84a3eb6516e4531b44e52363fa817f3f4265ccba2139a59f939f2f
Opcode Fuzzy Hash: e7c828e8500b304e47737f2c036b73e87bd74cd8a23869b162ce918d436332e7
Instruction Fuzzy Hash: C651EDB07002209BDB20EB64EC92B6B33B4EF81758F54455DF9858B390FB79E801C76A

Function 0043FDBB Relevance: 31.9, APIs: 11, Strings: 7, Instructions: 425memorycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044DCE0,00000000,00000001,0044DCD0,?), ref: 0043FE41
SysAllocString.OLEAUT32(?), ref: 0043FEC5
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0043FF03
SysAllocString.OLEAUT32(?), ref: 0043FF65
SysAllocString.OLEAUT32(?), ref: 00440015
VariantInit.OLEAUT32(6D3F6B39), ref: 0044007E
VariantClear.OLEAUT32(?), ref: 00440123
SysFreeString.OLEAUT32(?), ref: 00440145
SysFreeString.OLEAUT32(?), ref: 0044014E
SysFreeString.OLEAUT32(?), ref: 00440181

Strings

hKpM, xrefs: 0043FF85
"_kQ, xrefs: 0043FFA8
bS3U, xrefs: 0043FFAF
l3u5, xrefs: 0043FF77
9k?m, xrefs: 0043FFBD
1[!], xrefs: 0043FFA1
q7bI, xrefs: 0043FF7E

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInitInstanceProxy
String ID: "_kQ$1[!]$9k?m$bS3U$hKpM$l3u5$q7bI
API String ID: 2485776651-1023481837
Opcode ID: 3b03e2147dce430a0f8925663908d52cba351bca58096ea1b67891df1644cd7a
Instruction ID: abc33ae36a095545e2bb41dcd0e979c6fcd6de482cd85a6a90bd509a0ecf98e9
Opcode Fuzzy Hash: 3b03e2147dce430a0f8925663908d52cba351bca58096ea1b67891df1644cd7a
Instruction Fuzzy Hash: 1FE16974100B01EFE3208F15C985B16BBF1FF4AB02F148969E59A8BAA1C775F855CF98

Function 004365E8 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004365F4
VariantInit.OLEAUT32 ref: 00436606

Strings

W, xrefs: 0043663F
], xrefs: 00436657
Y, xrefs: 00436647
S, xrefs: 0043662F
O, xrefs: 0043661F
_, xrefs: 0043665F
U, xrefs: 00436637
Q, xrefs: 00436627
[, xrefs: 0043664F

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: Variant$ClearInit
String ID: O$Q$S$U$W$Y$[$]$_
API String ID: 2610073882-3709029455
Opcode ID: bf4df09837cc0999f8912889e458b68c9d6c2582af1171711b600cbe8bd283c9
Instruction ID: 617472aee6f7647b6791f64ddb482ed0964e05965680e50c34387cf75e2fd40f
Opcode Fuzzy Hash: bf4df09837cc0999f8912889e458b68c9d6c2582af1171711b600cbe8bd283c9
Instruction Fuzzy Hash: 8041E970008B81CED721DF38C894756BFE0AB56314F08869DD8EA4F3D6C775A549CB66

Function 004360C9 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 73COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004360DA
VariantInit.OLEAUT32 ref: 004360EC

Strings

U, xrefs: 0043611D
S, xrefs: 00436115
Y, xrefs: 0043612D
], xrefs: 0043613D
O, xrefs: 00436105
W, xrefs: 00436125
[, xrefs: 00436135
Q, xrefs: 0043610D
_, xrefs: 00436145

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: Variant$ClearInit
String ID: O$Q$S$U$W$Y$[$]$_
API String ID: 2610073882-3709029455
Opcode ID: f7635afb3bd54eb494f8a0a77bb65c5c2b8a5d4eaa981fde32eb2f6ea89c106d
Instruction ID: 3870ab933f990c28619918e5480d85312f3f30b48fe24ca90a854e860725b9d7
Opcode Fuzzy Hash: f7635afb3bd54eb494f8a0a77bb65c5c2b8a5d4eaa981fde32eb2f6ea89c106d
Instruction Fuzzy Hash: 9C41B474009BC1CEE725DF38C898B46BFA06B56314F088A9DD8E94F296C375A515CB62

Function 00438B2F Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00438B74

Strings

|, xrefs: 00438BB6
i, xrefs: 00438B96
}, xrefs: 00438BDE
d, xrefs: 00438B8E
t, xrefs: 00438BD6
p, xrefs: 00438BC6

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: InitVariant
String ID: d$i$p$t$|$}
API String ID: 1927566239-2434808017
Opcode ID: 554a65b0e6783a8a587c5d9d5a1a59090ef91d405a8573379fac870fe920457a
Instruction ID: 0b84109ddb38ce271a869d6b766c0ab2b1e4120020a45687ac22dc4c2f8272eb
Opcode Fuzzy Hash: 554a65b0e6783a8a587c5d9d5a1a59090ef91d405a8573379fac870fe920457a
Instruction Fuzzy Hash: FE411870508781CED725CF28C494716BFE0AB66324F08869DD8EA4F397C775E515CBA2

Function 00438417 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00438444

Strings

|, xrefs: 00438486
i, xrefs: 00438466
}, xrefs: 004384AE
d, xrefs: 0043845E
p, xrefs: 00438496
t, xrefs: 004384A6

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: InitVariant
String ID: d$i$p$t$|$}
API String ID: 1927566239-2434808017
Opcode ID: 752ed3a4123867835ced7968c358781d81873fa4b79cdbc7d9d63c2e707b67c3
Instruction ID: 90d411813917745457a09f1c6fb0e7b6a5668ded3b473b778bf00fa4b3dd6296
Opcode Fuzzy Hash: 752ed3a4123867835ced7968c358781d81873fa4b79cdbc7d9d63c2e707b67c3
Instruction Fuzzy Hash: 9541D760108781CED721DF2CC484716BFE06B66214F088A8DD8EA4F7D7C375D519CB62

Function 004126B3 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 301COMMON

Download Yara Rule

Strings

wCA, xrefs: 00412B66
fch%, xrefs: 00412788
tBA, xrefs: 00412AE7
GD, xrefs: 004126C0

Memory Dump Source

Source File: 00000003.00000002.1408470421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: GD$fch%$tBA$wCA
API String ID: 0-2815851639
Opcode ID: 18b95ce0547799c8335b9632188030b7790c54437027a763add69c76ec3f01d7
Instruction ID: d035267a3a9853f3dfc0ceb4180196f553011948bb1c76c1f0fbabd1dc92564a
Opcode Fuzzy Hash: 18b95ce0547799c8335b9632188030b7790c54437027a763add69c76ec3f01d7
Instruction Fuzzy Hash: F6B158B04093C1CBE7318F149554BEFBBE0BB8A348F140A6EE4C99B242D7799545CB66

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_1b82bec763645d16ab9c0b439f8b0a42b432fae_974fe18f_a875a024-b057-4196-baf7-1056fcad35d7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER81D3.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8232.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8262.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe

Function 00E32021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Function 00E46368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Function 00E48E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 00E4A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00E49FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON