Edit tour

Windows Analysis Report
j8zJ5Jwja4.exe

Overview

General Information

Sample name:	j8zJ5Jwja4.exe renamed because original name is a hash value
Original sample name:	65a8f223d7e0fb5cca7e8ae22cd51b5e.exe
Analysis ID:	1528610
MD5:	65a8f223d7e0fb5cca7e8ae22cd51b5e
SHA1:	9b619e477948c5b605597ccab51af24738978501
SHA256:	61290d28114db41580ed0da7891920ee4f625ebd2ccdd23f3ef6f7d28777c8b7
Tags:	32exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

j8zJ5Jwja4.exe (PID: 7736 cmdline: "C:\Users\user\Desktop\j8zJ5Jwja4.exe" MD5: 65A8F223D7E0FB5CCA7E8AE22CD51B5E)

MSBuild.exe (PID: 7760 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 7880 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7736 -s 272 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["spirittunek.stor", "clearancek.site", "eaglepawnoy.stor", "dissapoiznw.stor", "studennotediw.stor", "bathdoomgaz.stor", "trustterwowqm.shop", "mobbipenju.stor", "licendfilteo.site"], "Build id": "tLYMe5--deli333"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 104.102.49.254, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7760, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T04:24:12.028982+0200	2054653	1	A Network Trojan was detected	192.168.2.8	49707	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T04:24:12.028982+0200	2049836	1	A Network Trojan was detected	192.168.2.8	49707	172.67.206.204	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T04:24:09.599645+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.8	59113	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T04:24:09.642920+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.8	52964	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T04:24:09.577689+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.8	49356	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T04:24:09.567420+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.8	57350	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T04:24:09.620737+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.8	53560	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T04:24:09.555257+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.8	53441	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T04:24:09.609733+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.8	54082	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T04:24:09.588786+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.8	53572	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T04:24:09.541895+0200	2056174	1	Domain Observed Used for C2 Detected	192.168.2.8	50071	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: j8zJ5Jwja4.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/badges	URL Reputation: Label: malware

Found malware configuration

Source: 2.2.MSBuild.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["spirittunek.stor", "clearancek.site", "eaglepawnoy.stor", "dissapoiznw.stor", "studennotediw.stor", "bathdoomgaz.stor", "trustterwowqm.shop", "mobbipenju.stor", "licendfilteo.site"], "Build id": "tLYMe5--deli333"}

Multi AV Scanner detection for domain / URL

Source: sergei-esenin.com	Virustotal: Detection: 11%	Perma Link
Source: eaglepawnoy.store	Virustotal: Detection: 17%	Perma Link
Source: trustterwowqm.shop	Virustotal: Detection: 13%	Perma Link
Source: bathdoomgaz.store	Virustotal: Detection: 13%	Perma Link
Source: mobbipenju.store	Virustotal: Detection: 13%	Perma Link
Source: dissapoiznw.store	Virustotal: Detection: 13%	Perma Link
Source: spirittunek.store	Virustotal: Detection: 13%	Perma Link
Source: licendfilteo.site	Virustotal: Detection: 15%	Perma Link
Source: clearancek.site	Virustotal: Detection: 17%	Perma Link
Source: studennotediw.store	Virustotal: Detection: 17%	Perma Link
Source: licendfilteo.site	Virustotal: Detection: 15%	Perma Link
Source: trustterwowqm.shop	Virustotal: Detection: 13%	Perma Link
Source: https://sergei-esenin.com/api:	Virustotal: Detection: 11%	Perma Link
Source: https://sergei-esenin.com/apid	Virustotal: Detection: 11%	Perma Link
Source: https://sergei-esenin.com/api	Virustotal: Detection: 13%	Perma Link
Source: https://sergei-esenin.com:443/apifiles/76561199724331900	Virustotal: Detection: 9%	Perma Link
Source: clearancek.site	Virustotal: Detection: 17%	Perma Link
Source: https://sergei-esenin.com/s	Virustotal: Detection: 11%	Perma Link

Multi AV Scanner detection for submitted file

Source: j8zJ5Jwja4.exe

Virustotal: Detection: 44%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: j8zJ5Jwja4.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: clearancek.site
Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: licendfilteo.site
Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: spirittunek.stor
Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bathdoomgaz.stor
Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: studennotediw.stor
Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: dissapoiznw.stor
Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: eaglepawnoy.stor
Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: mobbipenju.stor
Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: trustterwowqm.shop
Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tLYMe5--deli333

Source: j8zJ5Jwja4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.8:49707 version: TLS 1.2

Source: j8zJ5Jwja4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe

Code function: 0_2_00739ABF FindFirstFileExW,

0_2_00739ABF

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then jmp ecx	0_2_0079604C
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00796140
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_0077C198
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00778278
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0075A268
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_0077C224
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0077E2E8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_007922A8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then jmp eax	0_2_00796343
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov edx, dword ptr [esp]	0_2_0074E3F7
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_0075E3F3
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_0077C3AC
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_0077E388
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_0077A438
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_0077A438
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp byte ptr [esi], 00000000h	0_2_00776410
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_0077C568
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then push 00000000h	0_2_007505B8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, edi	0_2_007766E6
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_0078074E
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_00762702
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7789B0CBh	0_2_007947F8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	0_2_0075C81B
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_00768948
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	0_2_0075C938
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_007949F8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00780AD4
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00780AD4
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00780AD4
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00788B78
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00752B08
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	0_2_0077ABBB
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00796B98
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00796B98
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0076CB98
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_0078EC08
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00790C08
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then push ebx	0_2_00762D4B
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00796D28
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00796D28
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	0_2_00796EA8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00796EA8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_0076EF70
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0076AF2D
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00796FD8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00791048
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0077B175
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00775108
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00795288
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00775368
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00781327
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00781327
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00781327
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then jmp ecx	0_2_0076338E
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_0078143A
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_0078143A
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_007974F8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then inc edi	0_2_007634A4
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then jmp eax	0_2_0076165F
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00793642
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_007936EE
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then push esi	0_2_0077D75B
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00791798
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_007938E2
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_007818D8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esi+40h]	0_2_00761920
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00751A58
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	0_2_0075FA44
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00793A08
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0076FAE2
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	0_2_00759AE8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	0_2_0075BB58
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov byte ptr [esi+edx], bl	0_2_00759BF8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001C0h]	0_2_0075FCD4
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0075BCB9
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov dword ptr [esp+2Ch], ebp	0_2_00795EE8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then cmp byte ptr [eax+01h], 00000000h	0_2_00775EC3
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	0_2_00793F68
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_00781FF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0040D390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	2_2_0044676A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	2_2_00446A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	2_2_00447082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	2_2_00444170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0044A100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	2_2_00435121
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	2_2_00428230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_0042F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	2_2_004453D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	2_2_0042B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	2_2_004483B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_0042F46A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00431410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	2_2_0042F4D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00428490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	2_2_004314B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	2_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	2_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	2_2_0043456A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ecx], al	2_2_0043456A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_0041151B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edx, dword ptr [esp]	2_2_0040151F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then inc edi	2_2_004165CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0044A620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_0041463D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+40h]	2_2_0041463D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push 00000000h	2_2_004036E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebx], ax	2_2_0042F690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	2_2_0043387B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	2_2_00446816
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	2_2_0041582B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	2_2_004448C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push esi	2_2_00430883
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	2_2_0040F943
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7789B0CBh	2_2_00447920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0042D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	2_2_0040FA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	2_2_0041BA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00434A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	2_2_0042DB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	2_2_00412B6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebx], ax	2_2_00421B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	2_2_00447B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00446B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ecx], al	2_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_00422BEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	2_2_00404B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	2_2_0040CC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	2_2_00405C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0041FCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_00449CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	2_2_00449CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	2_2_0040EC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_0043BCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi+edx], bl	2_2_0040CD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00443D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	2_2_00441D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	2_2_0040EDE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	2_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001C0h]	2_2_00412DFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_0041DD90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	2_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+2Ch], ebp	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	2_2_00449FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	2_2_00449FD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.8:53441 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.8:49356 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.8:54082 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.8:57350 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.8:52964 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.8:59113 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.8:53560 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.8:53572 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056174 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop) : 192.168.2.8:50071 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49707 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49707 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: spirittunek.stor
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: eaglepawnoy.stor
Source: Malware configuration extractor	URLs: dissapoiznw.stor
Source: Malware configuration extractor	URLs: studennotediw.stor
Source: Malware configuration extractor	URLs: bathdoomgaz.stor
Source: Malware configuration extractor	URLs: trustterwowqm.shop
Source: Malware configuration extractor	URLs: mobbipenju.stor
Source: Malware configuration extractor	URLs: licendfilteo.site

Source: global traffic

TCP traffic: 192.168.2.8:52836 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 172.67.206.204 172.67.206.204

Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.64

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: trustterwowqm.shop
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000002.00000002.1433140197.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: MSBuild.exe, 00000002.00000002.1433140197.000000000132C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: MSBuild.exe, 00000002.00000002.1433140197.0000000001355000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1433140197.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: MSBuild.exe, 00000002.00000002.1433140197.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: MSBuild.exe, 00000002.00000002.1433140197.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api:
Source: MSBuild.exe, 00000002.00000002.1433140197.00000000013AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apid
Source: MSBuild.exe, 00000002.00000002.1433140197.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/ob
Source: MSBuild.exe, 00000002.00000002.1433140197.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/s
Source: MSBuild.exe, 00000002.00000002.1433140197.0000000001355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apifiles/76561199724331900
Source: MSBuild.exe, 00000002.00000002.1433140197.0000000001355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/ay
Source: MSBuild.exe, 00000002.00000002.1433140197.0000000001355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: MSBuild.exe, 00000002.00000002.1433140197.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: MSBuild.exe, 00000002.00000002.1433140197.000000000132C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: MSBuild.exe, 00000002.00000002.1433140197.0000000001355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900Qx

Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.8:49707 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004396A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_004396A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004396A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_004396A0

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00722021	0_2_00722021
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00786078	0_2_00786078
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0077A059	0_2_0077A059
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0074E175	0_2_0074E175
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00754278	0_2_00754278
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00752268	0_2_00752268
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0074E212	0_2_0074E212
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0074E2D5	0_2_0074E2D5
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00786378	0_2_00786378
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00752302	0_2_00752302
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0077A438	0_2_0077A438
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00758428	0_2_00758428
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_007505B8	0_2_007505B8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0075E768	0_2_0075E768
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00784858	0_2_00784858
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0072CAF2	0_2_0072CAF2
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00784A88	0_2_00784A88
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0076CB98	0_2_0076CB98
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00754C78	0_2_00754C78
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00756C29	0_2_00756C29
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00794DA8	0_2_00794DA8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00758F38	0_2_00758F38
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0075F058	0_2_0075F058
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0075B2D8	0_2_0075B2D8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0072729C	0_2_0072729C
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00795288	0_2_00795288
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00757338	0_2_00757338
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0073D39B	0_2_0073D39B
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0078D598	0_2_0078D598
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00755618	0_2_00755618
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0073572C	0_2_0073572C
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00791798	0_2_00791798
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00757908	0_2_00757908
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00771908	0_2_00771908
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0077BADA	0_2_0077BADA
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0073BB36	0_2_0073BB36
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0078BCB8	0_2_0078BCB8
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00733C92	0_2_00733C92
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00721D79	0_2_00721D79
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0072FEF0	0_2_0072FEF0
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0074DED8	0_2_0074DED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040FFE0	2_2_0040FFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040C060	2_2_0040C060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00401000	2_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00447082	2_2_00447082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409110	2_2_00409110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004491F0	2_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00412180	2_2_00412180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042D181	2_2_0042D181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004391A0	2_2_004391A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040129D	2_2_0040129D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00405340	2_2_00405340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042D181	2_2_0042D181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004073A0	2_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004483B0	2_2_004483B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040A460	2_2_0040A460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040E400	2_2_0040E400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004394A0	2_2_004394A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040B550	2_2_0040B550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042D560	2_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004305E0	2_2_004305E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004406C0	2_2_004406C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004036E0	2_2_004036E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042B69D	2_2_0042B69D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00408740	2_2_00408740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004448C0	2_2_004448C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004298E2	2_2_004298E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00411890	2_2_00411890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042E977	2_2_0042E977
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409903	2_2_00409903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004489D7	2_2_004489D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00437980	2_2_00437980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042D9A0	2_2_0042D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042FA20	2_2_0042FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040AA30	2_2_0040AA30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00424A30	2_2_00424A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042CAF0	2_2_0042CAF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406B60	2_2_00406B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042DB64	2_2_0042DB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448B00	2_2_00448B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409B1C	2_2_00409B1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00437BB0	2_2_00437BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042EC02	2_2_0042EC02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041FCC0	2_2_0041FCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043EDE0	2_2_0043EDE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448DE0	2_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00407DA0	2_2_00407DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00432E33	2_2_00432E33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448ED0	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00447ED0	2_2_00447ED0

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: String function: 00727B80 appears 49 times
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: String function: 0076A848 appears 155 times
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: String function: 007599E8 appears 96 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CB10 appears 46 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D970 appears 155 times

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7736 -s 272

Source: j8zJ5Jwja4.exe, 00000000.00000000.1405779076.00000000007A8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs j8zJ5Jwja4.exe
Source: j8zJ5Jwja4.exe	Binary or memory string: OriginalFilenameproquota.exej% vs j8zJ5Jwja4.exe

Source: j8zJ5Jwja4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: j8zJ5Jwja4.exe

Static PE information: Section: .data ZLIB complexity 0.9911343443627451

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/5@11/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00428230 CoCreateInstance,

2_2_00428230

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7736

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\cf8856c0-8615-4b35-98f9-822b0dc6278c

Jump to behavior

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Command line argument: MZx	0_2_00722021
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Command line argument: MZx	0_2_00722021
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Command line argument: MZx	0_2_00722021

Source: j8zJ5Jwja4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: j8zJ5Jwja4.exe

Virustotal: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\j8zJ5Jwja4.exe "C:\Users\user\Desktop\j8zJ5Jwja4.exe"
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7736 -s 272
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior

Source: j8zJ5Jwja4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: j8zJ5Jwja4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: j8zJ5Jwja4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: j8zJ5Jwja4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: j8zJ5Jwja4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: j8zJ5Jwja4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: j8zJ5Jwja4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: j8zJ5Jwja4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: j8zJ5Jwja4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: j8zJ5Jwja4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: j8zJ5Jwja4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: j8zJ5Jwja4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: j8zJ5Jwja4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00762722 push eax; retf	0_2_00762727
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_007271AD push ecx; ret	0_2_007271C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041584A push eax; retf	2_2_0041584F

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe

API coverage: 4.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7836

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe

Code function: 0_2_00739ABF FindFirstFileExW,

0_2_00739ABF

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000002.00000002.1433140197.0000000001379000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: MSBuild.exe, 00000002.00000002.1433140197.000000000132C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004464F0 LdrInitializeThunk,

2_2_004464F0

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe

Code function: 0_2_00727922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00727922

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00722003 mov edi, dword ptr fs:[00000030h]	0_2_00722003
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0073A64C mov eax, dword ptr fs:[00000030h]	0_2_0073A64C
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00730F2E mov ecx, dword ptr fs:[00000030h]	0_2_00730F2E

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe

Code function: 0_2_0073CC4B GetProcessHeap,

0_2_0073CC4B

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00727610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00727610
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00727922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00727922
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_0072DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0072DA73
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: 0_2_00727AAF SetUnhandledExceptionFilter,	0_2_00727AAF

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: j8zJ5Jwja4.exe	String found in binary or memory: spirittunek.stor
Source: j8zJ5Jwja4.exe	String found in binary or memory: bathdoomgaz.stor
Source: j8zJ5Jwja4.exe	String found in binary or memory: studennotediw.stor
Source: j8zJ5Jwja4.exe	String found in binary or memory: dissapoiznw.stor
Source: j8zJ5Jwja4.exe	String found in binary or memory: eaglepawnoy.stor
Source: j8zJ5Jwja4.exe	String found in binary or memory: mobbipenju.stor
Source: j8zJ5Jwja4.exe	String found in binary or memory: trustterwowqm.shop
Source: j8zJ5Jwja4.exe	String found in binary or memory: clearancek.site
Source: j8zJ5Jwja4.exe	String found in binary or memory: licendfilteo.site

Writes to foreign memory regions

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44C000	Jump to behavior
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44F000	Jump to behavior
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45F000	Jump to behavior
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 1107008	Jump to behavior

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0073C085
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: GetLocaleInfoW,	0_2_0073622B
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: EnumSystemLocalesW,	0_2_0073C372
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: EnumSystemLocalesW,	0_2_0073C327
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: EnumSystemLocalesW,	0_2_0073C40D
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0073C498
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: GetLocaleInfoW,	0_2_0073C6EB
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0073C814
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: GetLocaleInfoW,	0_2_0073C91A
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0073C9E9
Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe	Code function: EnumSystemLocalesW,	0_2_00735D7F

Source: C:\Users\user\Desktop\j8zJ5Jwja4.exe

Code function: 0_2_00727815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00727815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
j8zJ5Jwja4.exe	44%	Virustotal		Browse
j8zJ5Jwja4.exe	100%	Avira	HEUR/AGEN.1310458
j8zJ5Jwja4.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
steamcommunity.com	0%	Virustotal	Browse
sergei-esenin.com	11%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
eaglepawnoy.store	18%	Virustotal	Browse
trustterwowqm.shop	14%	Virustotal	Browse
bathdoomgaz.store	14%	Virustotal	Browse
mobbipenju.store	14%	Virustotal	Browse
dissapoiznw.store	14%	Virustotal	Browse
spirittunek.store	14%	Virustotal	Browse
licendfilteo.site	16%	Virustotal	Browse
clearancek.site	18%	Virustotal	Browse
studennotediw.store	18%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/badges	100%	URL Reputation	malware
licendfilteo.site	16%	Virustotal		Browse
trustterwowqm.shop	14%	Virustotal		Browse
https://sergei-esenin.com/	0%	Virustotal		Browse
https://sergei-esenin.com/api:	11%	Virustotal		Browse
https://sergei-esenin.com/apid	11%	Virustotal		Browse
https://sergei-esenin.com/api	14%	Virustotal		Browse
https://sergei-esenin.com:443/apifiles/76561199724331900	9%	Virustotal		Browse
https://steamcommunity.com/ay	0%	Virustotal		Browse
clearancek.site	18%	Virustotal		Browse
https://sergei-esenin.com/s	11%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.49.254	true	true	0%, Virustotal, Browse	unknown
sergei-esenin.com	172.67.206.204	true	true	11%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
trustterwowqm.shop	unknown	unknown	true	14%, Virustotal, Browse	unknown
eaglepawnoy.store	unknown	unknown	false	18%, Virustotal, Browse	unknown
bathdoomgaz.store	unknown	unknown	false	14%, Virustotal, Browse	unknown
spirittunek.store	unknown	unknown	false	14%, Virustotal, Browse	unknown
licendfilteo.site	unknown	unknown	true	16%, Virustotal, Browse	unknown
studennotediw.store	unknown	unknown	false	18%, Virustotal, Browse	unknown
mobbipenju.store	unknown	unknown	false	14%, Virustotal, Browse	unknown
clearancek.site	unknown	unknown	true	18%, Virustotal, Browse	unknown
dissapoiznw.store	unknown	unknown	false	14%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
licendfilteo.site	true	16%, Virustotal, Browse	unknown
studennotediw.stor	true		unknown
bathdoomgaz.stor	true		unknown
trustterwowqm.shop	true	14%, Virustotal, Browse	unknown
eaglepawnoy.stor	true		unknown
dissapoiznw.stor	true		unknown
https://sergei-esenin.com/api	true	14%, Virustotal, Browse	unknown
clearancek.site	true	18%, Virustotal, Browse	unknown
spirittunek.stor	true		unknown
mobbipenju.stor	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://sergei-esenin.com/apid	MSBuild.exe, 00000002.00000002.1433140197.00000000013AC000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	MSBuild.exe, 00000002.00000002.1433140197.000000000132C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/ob	MSBuild.exe, 00000002.00000002.1433140197.0000000001379000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://sergei-esenin.com/	MSBuild.exe, 00000002.00000002.1433140197.0000000001355000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1433140197.0000000001379000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
https://sergei-esenin.com/api:	MSBuild.exe, 00000002.00000002.1433140197.0000000001379000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse	unknown
https://steamcommunity.com/ay	MSBuild.exe, 00000002.00000002.1433140197.0000000001355000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	MSBuild.exe, 00000002.00000002.1433140197.000000000132C000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://sergei-esenin.com:443/apifiles/76561199724331900	MSBuild.exe, 00000002.00000002.1433140197.0000000001355000.00000004.00000020.00020000.00000000.sdmp	true	9%, Virustotal, Browse	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	MSBuild.exe, 00000002.00000002.1433140197.0000000001338000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/s	MSBuild.exe, 00000002.00000002.1433140197.0000000001379000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse	unknown
https://steamcommunity.com/profiles/76561199724331900/badges	MSBuild.exe, 00000002.00000002.1433140197.0000000001338000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://steamcommunity.com/profiles/76561199724331900Qx	MSBuild.exe, 00000002.00000002.1433140197.0000000001355000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true
172.67.206.204	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528610
Start date and time:	2024-10-08 04:23:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	j8zJ5Jwja4.exe renamed because original name is a hash value
Original Sample Name:	65a8f223d7e0fb5cca7e8ae22cd51b5e.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/5@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 73% Number of executed functions: 12 Number of non-executed functions: 157
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.4, 20.190.159.68, 20.190.159.0, 20.190.159.23, 20.190.159.64, 40.126.31.67, 20.190.159.73, 20.190.159.2, 20.42.65.92, 52.149.20.212, 192.229.221.95, 13.85.23.206, 13.95.31.18, 52.165.164.15
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:24:08	API Interceptor	3x Sleep call for process: MSBuild.exe modified
22:24:14	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
172.67.206.204	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
fp2e7a.wpc.phicdn.net	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse	192.229.221.95
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	192.229.221.95
	DocuSign2.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	ylVAEHbMLf.exe	Get hash	malicious	Xmrig	Browse	192.229.221.95
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	M13W1o3scc.exe	Get hash	malicious	Stealc	Browse	172.67.179.207
	rfc[1].html	Get hash	malicious	Unknown	Browse	104.18.86.42
	rPedidoactualizado.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	172.67.140.92
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	172.67.140.92
	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	2ngxhElaud.exe	Get hash	malicious	Xmrig	Browse	172.67.173.168
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	copyright_infringement_evidence_1.exe	Get hash	malicious	Unknown	Browse	23.47.168.24
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Copyright_Infringement_Evidence.exe	Get hash	malicious	Unknown	Browse	96.17.64.189
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	104.102.49.254 172.67.206.204

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_j8zJ5Jwja4.exe_1966512a4c1b30f6d3a54994d6808c78ed874d_fc5164de_5b9e6915-1166-4648-8a92-c0d7202a1d2c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6558110350367419
Encrypted:	false
SSDEEP:	96:DyFsP0qSWsIy6iAPf8QXIDcQvc6QcEVcw3cE/n+HbHg/5hZAX/d5FMT2SlPkpXma:mKP1SWt0BU/gjhzuiF5Z24IO8G
MD5:	2F7A9D6405652FDE4A846EBACAF7D07C
SHA1:	2C8BD2969AF648884B7483D49DEE66481A0D79DA
SHA-256:	F135788D897B18BB95ACBA3826F4B8D9AB8BAEE1FEB528FF6C2720FED68875EA
SHA-512:	55460B35132726B6201178814956E4F6A62168726819ED56734B94F046F699F67DEA178A946016D36DD869A736BB372C09D6B778F1C0793E89885815E2A85F02
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.2.7.8.4.8.8.1.8.1.5.9.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.2.7.8.4.9.1.9.3.1.5.4.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.b.9.e.6.9.1.5.-.1.1.6.6.-.4.6.4.8.-.8.a.9.2.-.c.0.d.7.2.0.2.a.1.d.2.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.3.1.5.e.0.4.5.-.5.e.9.a.-.4.2.9.1.-.a.8.d.8.-.d.3.f.9.9.9.0.1.c.3.d.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.j.8.z.J.5.J.w.j.a.4...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.3.8.-.0.0.0.1.-.0.0.1.4.-.f.a.a.b.-.5.f.2.7.2.9.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.9.b.6.1.9.e.4.7.7.9.4.8.c.5.b.6.0.5.5.9.7.c.c.a.b.5.1.a.f.2.4.7.3.8.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC0B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 02:24:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33156
Entropy (8bit):	1.7500002560673362
Encrypted:	false
SSDEEP:	96:5v8DdXCte5WDi778YdFNigk0/dkaEbEDw2eWIkWITsI4WEN5OpeGvxa:60DO1iMeB4sFWErPGvx
MD5:	A4F227B04996FE9B1A4A120E8F86DC1C
SHA1:	A02962B39DB2BEF8936A5CC529310A4A4865751A
SHA-256:	627D19BC590195AD760B23BD1F8B89902F86DEC99C95490AC5882258B6E8BB55
SHA-512:	AFE7BF3F127C44B20E5C48A1D3D3C1D73CE8A4A75B483B41E42C059FBA4CDCB3F786F63C583636DE4144AE7C954ED1E66ED6BFBA5A4D3F18354725A6ABE95DD9
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........g........................d...........................T.......8...........T................v......................................................................................................eJ..............GenuineIntel............T.......8.....g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC79.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.7028194722407837
Encrypted:	false
SSDEEP:	192:R6l7wVeJJI6y6YSkSUN6dNOgmfgIXPprH89bTYsf4xm:R6lXJW6y6YxSUcdNOgmfgIXaTLfj
MD5:	5ABD0407C17F8AFF8E3B7F129DF847DC
SHA1:	C39B94F7937D9FFC70E1736FD5D87E7DD70B63CD
SHA-256:	F7285DA9FED756B1E794053A89C41EEC195C74DD763673A837C73BEC29C07755
SHA-512:	25D3C5BF7934D596F03734712014351D00B7651E286EAEBBA0DAC2F190C52124A28DEB06DC5BCA3BCCFDA17D22F2C628CEE7E094E82FEDD6D2AABA9085942DAC
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERECA9.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.489993582894266
Encrypted:	false
SSDEEP:	48:cvIwWl8zs6uJg77aI9FqVWpW8VYSYm8M4JWtFcq+q82uaOurd:uIjf6kI7TT7VuJo6aOurd
MD5:	45C8971480B063379C8F7F655F39CFDC
SHA1:	BD38DC3A34CC42CCF4D37A13BDE78660FE1279BA
SHA-256:	7C8A38699226EEE11556690BB63032249E535CB4F3958D98A21028667D008061
SHA-512:	8FE1481DBA857D7643B8BE5AAF0C589C0E7E70B7EF309BC519FAE1E6D1C3F67203ACB939BC9A6FDF4456A0475DFB7E36362CE6BF0F419767F43B496FDB753482
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533846" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372750969919041
Encrypted:	false
SSDEEP:	6144:jFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguNOiL:ZV1QyWWI/glMM6kF7Eq
MD5:	37A6D10A0E57F72E0927BA0FB5E74D2A
SHA1:	CF2BDB66CFAB53D28B7140167BB98D2DAB65E09B
SHA-256:	1D1C8B0E7D988BFBF7D02B6FC0C1B3B25DD787DCD1731935AA8B02CDBE8AFF30
SHA-512:	C0EB34B54550B429E9B416F9EE967D00196285F4CD44568990AED1AEF6E7720F35BFE432597262780554674838425E79EC0625B4A136E4C75EDC25D7CCC07509
Malicious:	false
Reputation:	low
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..')...............................................................................................................................................................................................................................................................................................................................................Q..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.722534100839197
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	j8zJ5Jwja4.exe
File size:	550'912 bytes
MD5:	65a8f223d7e0fb5cca7e8ae22cd51b5e
SHA1:	9b619e477948c5b605597ccab51af24738978501
SHA256:	61290d28114db41580ed0da7891920ee4f625ebd2ccdd23f3ef6f7d28777c8b7
SHA512:	32c367df61d1265b4bd9f8053ac46b3acb8526e621beafdcbaa8aa94e8243fe5829d812d7c309eb310494442db88cee41669a2a326b587b030ca57686fd9350b
SSDEEP:	12288:bdkYNLs5LUXUdOYjf4FbDaTo2TRsxTGi5Zs4S:bXLsYYkFbqo2TRsD5D
TLSH:	C9C4F11175C08072D4B316325AF1DA789E3EBD700E62AE9F67950FAE4F302D1DB2166B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67049640 [Tue Oct 8 02:17:36 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007F29ACB40B70h
jmp 00007F29ACB400DFh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F29ACB4027Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F29ACB4026Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F29ACB4026Eh
add edx, 28h
cmp edx, esi
jne 00007F29ACB4024Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F29ACB4025Bh
push esi
call 00007F29ACB40E84h
test eax, eax
je 00007F29ACB40282h
mov eax, dword ptr fs:[00000018h]
mov esi, 0048654Ch
mov edx, dword ptr [eax+04h]
jmp 00007F29ACB40266h
cmp edx, eax
je 00007F29ACB40272h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F29ACB40252h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F29ACB40269h
mov byte ptr [00486550h], 00000001h
call 00007F29ACB4051Ah
call 00007F29ACB43437h
test al, al
jne 00007F29ACB40266h
xor al, al
pop ebp
ret
call 00007F29ACB4BE99h
test al, al
jne 00007F29ACB4026Ch
push 00000000h
call 00007F29ACB4343Eh
pop ecx
jmp 00007F29ACB4024Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00486551h], 00000000h
je 00007F29ACB40266h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x89000	0x1ad4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	89b13a4afab0d326b8b7ee27e7be54ba	False	0.5865418632075472	data	6.667703746415754	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	3af1a33bd7f6bf7544c99989047ff6bb	False	0.4350771360759494	data	4.956604084551502	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x5a178	0x59400	a97f8d83e0ae9f10298cf837b75f754c	False	0.9911343443627451	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.992390432772047	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x88000	0x3d8	0x400	c67ba8481d4e7c92e5fe9f152983a3f3	False	0.439453125	data	3.287044161603086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x89000	0x1ad4	0x1c00	4637c216ab81215b5ac675caf379382e	False	0.7264229910714286	data	6.390012014256488	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x88058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T04:24:09.541895+0200	2056174	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop)	1	192.168.2.8	50071	1.1.1.1	53	UDP
2024-10-08T04:24:09.555257+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.8	53441	1.1.1.1	53	UDP
2024-10-08T04:24:09.567420+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.8	57350	1.1.1.1	53	UDP
2024-10-08T04:24:09.577689+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.8	49356	1.1.1.1	53	UDP
2024-10-08T04:24:09.588786+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.8	53572	1.1.1.1	53	UDP
2024-10-08T04:24:09.599645+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.8	59113	1.1.1.1	53	UDP
2024-10-08T04:24:09.609733+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.8	54082	1.1.1.1	53	UDP
2024-10-08T04:24:09.620737+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.8	53560	1.1.1.1	53	UDP
2024-10-08T04:24:09.642920+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.8	52964	1.1.1.1	53	UDP
2024-10-08T04:24:12.028982+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49707	172.67.206.204	443	TCP
2024-10-08T04:24:12.028982+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49707	172.67.206.204	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 04:24:03.808634996 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.811273098 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.811285973 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.811391115 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.811966896 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.811992884 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.812006950 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.812064886 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.814960003 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.815098047 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.815762043 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.815820932 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.816772938 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.819849014 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.819876909 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.820554972 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.909873962 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.913851023 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.915476084 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.915501118 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.915590048 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.916157961 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.916172981 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.916258097 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.916311026 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.918690920 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.920134068 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.920384884 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.921654940 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.921792984 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:03.924998045 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.925151110 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.926448107 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:03.926518917 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.012010098 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.015261889 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.020399094 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.021050930 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.021069050 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.021369934 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.021800995 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.021816015 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.021872997 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.026747942 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.027930021 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.028923988 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.029910088 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.032912970 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.034849882 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.129081964 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.132886887 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.136574984 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.136593103 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.136727095 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.139975071 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.140140057 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.144845009 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.183885098 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.183926105 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.184015036 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.187489986 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.187599897 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.192423105 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.235811949 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.239589930 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.240763903 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.240807056 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.240880013 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.240919113 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.243419886 CEST	49673	443	192.168.2.8	23.206.229.226
Oct 8, 2024 04:24:04.243897915 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.244009018 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.248724937 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.286078930 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.286096096 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.286333084 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.290575981 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.291548967 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.296464920 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.339689016 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.342380047 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.342430115 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.342519999 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.343040943 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.346415997 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.347400904 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.351279974 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.391647100 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.391669035 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.391737938 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.395812035 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.396838903 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.401635885 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.442009926 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.445122004 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.446964979 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.446983099 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.447103024 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.450759888 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.451595068 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.455549955 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.496706009 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.496723890 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.496824026 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.500360966 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.500479937 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.505305052 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.540402889 CEST	49672	443	192.168.2.8	23.206.229.226
Oct 8, 2024 04:24:04.546247959 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.549957037 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.554883957 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.554915905 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.555020094 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.555054903 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.558384895 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.558509111 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.563745975 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.600943089 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.600960970 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.601104975 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.605812073 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.605837107 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.619909048 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.634144068 CEST	49676	443	192.168.2.8	52.182.143.211
Oct 8, 2024 04:24:04.656821966 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.659435034 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.659454107 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.659535885 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.713234901 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.713254929 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.713404894 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.730421066 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.738739967 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.743638039 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.756565094 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.806159019 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.829221964 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.851516008 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.852977037 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.853051901 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.856384039 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.857417107 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.862235069 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.871913910 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.876764059 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.929676056 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.934796095 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.943397045 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.952913046 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:04.953001976 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:04.967427015 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.009104013 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.025516987 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.025544882 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.025743008 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.043420076 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.087169886 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.294790030 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.314651966 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.314651966 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.319612980 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.324862957 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.329793930 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.336354971 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.382302999 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.393321991 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.393338919 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.393532038 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.413747072 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.413839102 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.413989067 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.431926012 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.434111118 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.438901901 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.442400932 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.443640947 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.447355986 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.448385000 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.482593060 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.483872890 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.483969927 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.502207994 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.507133961 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.537890911 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.543595076 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.543610096 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.543802977 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.565922022 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.567727089 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.572657108 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.598285913 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.598478079 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.601346016 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.601402998 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.601424932 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.644740105 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.646064043 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.649472952 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.656198978 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.660963058 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.665601015 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.665616989 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.665631056 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.665679932 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.692063093 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.692192078 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.697285891 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.697302103 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.697316885 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.697386980 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.735971928 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.736474037 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.737243891 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.741213083 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.751765013 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.754836082 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.754852057 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.754913092 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.799715996 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.800237894 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.805071115 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.836474895 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.836534023 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.836744070 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.844906092 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.888324022 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.888348103 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.888814926 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.893296003 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.899667025 CEST	49671	443	192.168.2.8	204.79.197.203
Oct 8, 2024 04:24:05.907001019 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.907017946 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.907099009 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.954309940 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.987673044 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.987690926 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:05.987771988 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:05.997404099 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:06.040265083 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:06.078038931 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:24:06.134068966 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:24:06.243474960 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 8, 2024 04:24:09.671915054 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:09.671950102 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:09.672019005 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:09.675156116 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:09.675170898 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:10.330425978 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:10.330507040 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:10.333328009 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:10.333338976 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:10.333617926 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:10.384100914 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:10.385143042 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:10.431411982 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:10.903788090 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:10.903810978 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:10.903856993 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:10.903898001 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:10.903937101 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:10.903979063 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:10.903979063 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:10.903979063 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:10.903979063 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:10.903996944 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:10.904086113 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:11.008044004 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:11.008063078 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:11.008348942 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:11.008364916 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:11.013467073 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:11.013540030 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:11.013649940 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:11.013649940 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:11.017283916 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:11.047166109 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:11.047166109 CEST	49706	443	192.168.2.8	104.102.49.254
Oct 8, 2024 04:24:11.047195911 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:11.047204971 CEST	443	49706	104.102.49.254	192.168.2.8
Oct 8, 2024 04:24:11.070168018 CEST	49707	443	192.168.2.8	172.67.206.204
Oct 8, 2024 04:24:11.070205927 CEST	443	49707	172.67.206.204	192.168.2.8
Oct 8, 2024 04:24:11.070278883 CEST	49707	443	192.168.2.8	172.67.206.204
Oct 8, 2024 04:24:11.076174974 CEST	49707	443	192.168.2.8	172.67.206.204
Oct 8, 2024 04:24:11.076193094 CEST	443	49707	172.67.206.204	192.168.2.8
Oct 8, 2024 04:24:11.556545019 CEST	443	49707	172.67.206.204	192.168.2.8
Oct 8, 2024 04:24:11.556613922 CEST	49707	443	192.168.2.8	172.67.206.204
Oct 8, 2024 04:24:11.559772015 CEST	49707	443	192.168.2.8	172.67.206.204
Oct 8, 2024 04:24:11.559778929 CEST	443	49707	172.67.206.204	192.168.2.8
Oct 8, 2024 04:24:11.559995890 CEST	443	49707	172.67.206.204	192.168.2.8
Oct 8, 2024 04:24:11.561258078 CEST	49707	443	192.168.2.8	172.67.206.204
Oct 8, 2024 04:24:11.561280012 CEST	49707	443	192.168.2.8	172.67.206.204
Oct 8, 2024 04:24:11.561331987 CEST	443	49707	172.67.206.204	192.168.2.8
Oct 8, 2024 04:24:12.028986931 CEST	443	49707	172.67.206.204	192.168.2.8
Oct 8, 2024 04:24:12.029056072 CEST	443	49707	172.67.206.204	192.168.2.8
Oct 8, 2024 04:24:12.029125929 CEST	49707	443	192.168.2.8	172.67.206.204
Oct 8, 2024 04:24:12.029783964 CEST	49707	443	192.168.2.8	172.67.206.204
Oct 8, 2024 04:24:12.029792070 CEST	443	49707	172.67.206.204	192.168.2.8
Oct 8, 2024 04:24:12.029817104 CEST	49707	443	192.168.2.8	172.67.206.204
Oct 8, 2024 04:24:12.029822111 CEST	443	49707	172.67.206.204	192.168.2.8
Oct 8, 2024 04:24:13.862231970 CEST	49673	443	192.168.2.8	23.206.229.226
Oct 8, 2024 04:24:14.149615049 CEST	49672	443	192.168.2.8	23.206.229.226
Oct 8, 2024 04:24:14.243427992 CEST	49676	443	192.168.2.8	52.182.143.211
Oct 8, 2024 04:24:15.892482042 CEST	443	49704	23.206.229.226	192.168.2.8
Oct 8, 2024 04:24:15.892636061 CEST	49704	443	192.168.2.8	23.206.229.226
Oct 8, 2024 04:24:16.868843079 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 8, 2024 04:24:26.657115936 CEST	52836	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:26.662010908 CEST	53	52836	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:26.662838936 CEST	52836	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:26.662838936 CEST	52836	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:26.667788982 CEST	53	52836	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:27.107791901 CEST	53	52836	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:27.109267950 CEST	52836	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:27.114641905 CEST	53	52836	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:27.115065098 CEST	52836	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:55.712378979 CEST	49703	80	192.168.2.8	93.184.221.240
Oct 8, 2024 04:24:55.717616081 CEST	80	49703	93.184.221.240	192.168.2.8
Oct 8, 2024 04:24:55.717688084 CEST	49703	80	192.168.2.8	93.184.221.240
Oct 8, 2024 04:25:36.052880049 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:25:36.052911997 CEST	443	49705	13.107.246.64	192.168.2.8
Oct 8, 2024 04:25:36.052999973 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:25:36.053858042 CEST	49705	443	192.168.2.8	13.107.246.64
Oct 8, 2024 04:25:36.058691025 CEST	443	49705	13.107.246.64	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 04:24:09.541894913 CEST	50071	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:09.550729036 CEST	53	50071	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:09.555257082 CEST	53441	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:09.563744068 CEST	53	53441	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:09.567420006 CEST	57350	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:09.576412916 CEST	53	57350	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:09.577688932 CEST	49356	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:09.585962057 CEST	53	49356	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:09.588785887 CEST	53572	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:09.597158909 CEST	53	53572	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:09.599644899 CEST	59113	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:09.608499050 CEST	53	59113	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:09.609733105 CEST	54082	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:09.618340969 CEST	53	54082	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:09.620737076 CEST	53560	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:09.640907049 CEST	53	53560	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:09.642920017 CEST	52964	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:09.656258106 CEST	53	52964	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:09.657939911 CEST	57412	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:09.664520979 CEST	53	57412	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:11.050134897 CEST	50944	53	192.168.2.8	1.1.1.1
Oct 8, 2024 04:24:11.063030958 CEST	53	50944	1.1.1.1	192.168.2.8
Oct 8, 2024 04:24:26.656656027 CEST	53	49485	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 04:24:09.541894913 CEST	192.168.2.8	1.1.1.1	0x7814	Standard query (0)	trustterwowqm.shop	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.555257082 CEST	192.168.2.8	1.1.1.1	0xb688	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.567420006 CEST	192.168.2.8	1.1.1.1	0x4dfe	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.577688932 CEST	192.168.2.8	1.1.1.1	0xe43d	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.588785887 CEST	192.168.2.8	1.1.1.1	0xd80e	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.599644899 CEST	192.168.2.8	1.1.1.1	0x1abd	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.609733105 CEST	192.168.2.8	1.1.1.1	0xac7d	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.620737076 CEST	192.168.2.8	1.1.1.1	0xb0f3	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.642920017 CEST	192.168.2.8	1.1.1.1	0x6670	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.657939911 CEST	192.168.2.8	1.1.1.1	0xc6f4	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:11.050134897 CEST	192.168.2.8	1.1.1.1	0xb630	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 04:24:09.550729036 CEST	1.1.1.1	192.168.2.8	0x7814	Name error (3)	trustterwowqm.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.563744068 CEST	1.1.1.1	192.168.2.8	0xb688	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.576412916 CEST	1.1.1.1	192.168.2.8	0x4dfe	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.585962057 CEST	1.1.1.1	192.168.2.8	0xe43d	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.597158909 CEST	1.1.1.1	192.168.2.8	0xd80e	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.608499050 CEST	1.1.1.1	192.168.2.8	0x1abd	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.618340969 CEST	1.1.1.1	192.168.2.8	0xac7d	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.640907049 CEST	1.1.1.1	192.168.2.8	0xb0f3	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.656258106 CEST	1.1.1.1	192.168.2.8	0x6670	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:09.664520979 CEST	1.1.1.1	192.168.2.8	0xc6f4	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:11.063030958 CEST	1.1.1.1	192.168.2.8	0xb630	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:11.063030958 CEST	1.1.1.1	192.168.2.8	0xb630	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 8, 2024 04:24:24.935611010 CEST	1.1.1.1	192.168.2.8	0x86ec	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 04:24:24.935611010 CEST	1.1.1.1	192.168.2.8	0x86ec	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	104.102.49.254	443	7760	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 02:24:10 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-08 02:24:10 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 08 Oct 2024 02:24:10 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=54d70f0dd72eb8a5abe80168; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-08 02:24:10 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-08 02:24:11 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-08 02:24:11 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-08 02:24:11 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	172.67.206.204	443	7760	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 02:24:11 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-08 02:24:11 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-08 02:24:12 UTC	799	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 02:24:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s7k2httq2bj1ci8d2hqse97be0; expires=Fri, 31 Jan 2025 20:10:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O6Qcbi0UY9H70C%2FHt1XCcOB%2Bt6ljdKZeBDbLQsVbNrLlvtctSg5it1%2Byytdug65uIZNQ0uhSf3tYO6heGxiZE%2BgpK8pq0muFhXAWiNDsh9Iw9XFKC8iTvbydaRWGpchApUKLVg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf2ac58b93c78d3-EWR
2024-10-08 02:24:12 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-08 02:24:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	22:24:08
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\j8zJ5Jwja4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\j8zJ5Jwja4.exe"
Imagebase:	0x720000
File size:	550'912 bytes
MD5 hash:	65A8F223D7E0FB5CCA7E8AE22CD51B5E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:24:08
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xdd0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:24:08
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7736 -s 272
Imagebase:	0xfb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	3

Executed Functions

Function 00722021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(007A58D8,?,00000040,?), ref: 00722738

Strings

a, xrefs: 00722296
S, xrefs: 0072206A
', xrefs: 00722718
MZx, xrefs: 0072274B, 00722757, 0072275C

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: ProtectVirtual
String ID: '$MZx$S$a
API String ID: 544645111-3057195942
Opcode ID: 94711c224fb8a4bf94bda013b91dc1706e6b8bd675ab7d8932d541b93daf9b88
Instruction ID: f5b2e25acdb6a97d1bd04a0040dbcca518f859e5d7d75681353091e853696f40
Opcode Fuzzy Hash: 94711c224fb8a4bf94bda013b91dc1706e6b8bd675ab7d8932d541b93daf9b88
Instruction Fuzzy Hash: 73F1E217934E3B16E71860396C522F5954AE7EA330FD24333BE229B3F6E36D89439245

Function 00736368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00738F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0073639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00738F1C,?,?,00000000,?,00000000), ref: 007363BA

Strings

R[r, xrefs: 00736396

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: String
String ID: R[r
API String ID: 2568140703-2000533315
Opcode ID: ded852176c62ae8d375d4d00f610daae78d5ee0dfc739fc92f33fc1148131efc
Instruction ID: 226a02d0e7352a0ae279eb8787dfcdd362d9dd9e086f98bf17529a48e33f03b3
Opcode Fuzzy Hash: ded852176c62ae8d375d4d00f610daae78d5ee0dfc739fc92f33fc1148131efc
Instruction Fuzzy Hash: 24F0763600055AFBCF126F90DC09EDE3F26EF483A0F058111FA1865031CB3AD971AB94

Function 00738E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00738FDD

Part of subcall function 00733A83: HeapAlloc.KERNEL32(00000000,0073A1AA,?,?,0073A1AA,00000220,?,?,?), ref: 00733AB5

__freea.LIBCMT ref: 00738FF2
__freea.LIBCMT ref: 00739002

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 1157aeeb958210e8ed0c02684c9e1b47e7ca1aaa9fec26b81ed61a6ff84ca3c1
Instruction ID: 07d0cb2f706e2172b275afbf4609b179c6ca1f1df0729afe016841ce2708c1a9
Opcode Fuzzy Hash: 1157aeeb958210e8ed0c02684c9e1b47e7ca1aaa9fec26b81ed61a6ff84ca3c1
Instruction Fuzzy Hash: 3C51CD72600317AFFF61AF64CC85EBB3AAAEB44750F190129FD08D6152EB79DC508662

Function 0073A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00739ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00739F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0073A1ED,?,00000000,?,?,?), ref: 0073A407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0073A1ED,?,00000000,?,?,?), ref: 0073A449

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: ab554b64479ab503fbda5d26878d92cc3e096efa0aba6613827f13aa1abed63a
Instruction ID: 39cefd547cc8786c183151f819e7e43d3199b575d6546d932cbb4249fa1fe80d
Opcode Fuzzy Hash: ab554b64479ab503fbda5d26878d92cc3e096efa0aba6613827f13aa1abed63a
Instruction Fuzzy Hash: D1511A71A00385AFEB21CF39C846AAABBF5EF85300F14416ED0C687153E7BD9945CB52

Function 00739FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,0073A1F9,0073A1ED,00000000), ref: 00739FDC

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 7f2aaca9632ef0cd1b2b0cb12ced8c0c3e2d77a89a8f4652800bc44e130937e9
Instruction ID: 0b27c24b089a2386e8be93d90c7f111cae9e050eb55fdd7ce843d82fd0d30211
Opcode Fuzzy Hash: 7f2aaca9632ef0cd1b2b0cb12ced8c0c3e2d77a89a8f4652800bc44e130937e9
Instruction Fuzzy Hash: CD517D7190415CAAEB218F28CC85AE67BB8EB55304F2405EDD1DAC7043E3799D46DF21

Non-executed Functions

Function 0076CB98 Relevance: 20.7, Strings: 15, Instructions: 1988COMMON

Download Yara Rule

Strings

,/.!, xrefs: 0076D6AC
,, xrefs: 0076DC6F
4, xrefs: 0076D80C
@GFE, xrefs: 0076D92F
`onm, xrefs: 0076D8F8
(+*-, xrefs: 0076D6A1
8;:=, xrefs: 0076D6CD
lkji, xrefs: 0076D903
yz{|, xrefs: 0076D6B7
$'&9, xrefs: 0076D6C2
lcba, xrefs: 0076D8CC
0325, xrefs: 0076D6E3
efgh, xrefs: 0076D6D8
p, xrefs: 0076E019
pwvu, xrefs: 0076D8AB

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: $'&9$(+*-$,$,/.!$0325$4$8;:=$@GFE$`onm$efgh$lcba$lkji$p$pwvu$yz{|
API String ID: 0-4284672935
Opcode ID: 17a9da9fb198ce4cff53889ca9a74bbfb73063c59ecad7ce56909eb832305105
Instruction ID: 01a5467c595aed2728e5eb7147de50800a091e1ff0bb5cc7d08e1fd5a1c8150a
Opcode Fuzzy Hash: 17a9da9fb198ce4cff53889ca9a74bbfb73063c59ecad7ce56909eb832305105
Instruction Fuzzy Hash: E8F258B16083819FD730CF54D884BAFBBE1AF96305F54491DE8CA9B292D7399844CB63

Function 0077C568 Relevance: 11.5, Strings: 9, Instructions: 256COMMON

Download Yara Rule

Strings

2C!E, xrefs: 0077C5F0
;_(Q, xrefs: 0077C605
W7JI, xrefs: 0077C5DB
8O?A, xrefs: 0077C5E9
4[&], xrefs: 0077C5FE
A3W5, xrefs: 0077C5D4
0W4i, xrefs: 0077C613
=G!Y, xrefs: 0077C5F7
7S.U, xrefs: 0077C60C

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: 0W4i$2C!E$4[&]$7S.U$8O?A$;_(Q$=G!Y$A3W5$W7JI
API String ID: 0-83756894
Opcode ID: c1abe5d969104e4faaeeb94a57dcd0a77674fd740321b7385ce3fa244a949eb5
Instruction ID: 26b1ee7928ce021b8e715eb2af6bf93e52479102f07a31d6f876893d07b3305d
Opcode Fuzzy Hash: c1abe5d969104e4faaeeb94a57dcd0a77674fd740321b7385ce3fa244a949eb5
Instruction Fuzzy Hash: B8818CB4900206DBCF11CF54C991BAEB7B1FF4A341F648148E849AB351E738AE51CBA5

Function 0073C9E9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00734EB1: GetLastError.KERNEL32(?,00000008,00739482), ref: 00734EB5
Part of subcall function 00734EB1: SetLastError.KERNEL32(00000000,0074C480,00000024,00730419), ref: 00734F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0073CAF5
IsValidCodePage.KERNEL32(00000000), ref: 0073CB3E
IsValidLocale.KERNEL32(?,00000001), ref: 0073CB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0073CB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0073CBB4

Strings

||t, xrefs: 0073CA4E

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ||t
API String ID: 415426439-1984482297
Opcode ID: 5feaa3b92ddac090d53cc62b9f14e3ad59099bf73634ec728601aff46753e6a7
Instruction ID: c927243ec3684799f536d82bfcc643110eb8f0709f5ab1e803478158d119361b
Opcode Fuzzy Hash: 5feaa3b92ddac090d53cc62b9f14e3ad59099bf73634ec728601aff46753e6a7
Instruction Fuzzy Hash: A45171B2A00219EBFB11DFA5CC46EBAB7B8FF05700F148469E915F7192E7789904CB61

Function 0073D39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0073D57F

Strings

1#SNAN, xrefs: 0073D4A7
1#IND, xrefs: 0073D4A0
1#INF, xrefs: 0073D4D1
1#QNAN, xrefs: 0073D4AE

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e889e0a4731deecf10c4d63ead6877cf427c66d0a2f123f0c9583656212825ad
Instruction ID: bc74d403b2649733f6aabe85f7f259973c7094aa495acb6cf72641ca1c662f67
Opcode Fuzzy Hash: e889e0a4731deecf10c4d63ead6877cf427c66d0a2f123f0c9583656212825ad
Instruction Fuzzy Hash: 6FD21871E082298FEB75CE28DD447EAB7B5EB45304F1441EAD84DE7242E778AE818F41

Function 0073C085 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00734EB1: GetLastError.KERNEL32(?,00000008,00739482), ref: 00734EB5
Part of subcall function 00734EB1: SetLastError.KERNEL32(00000000,0074C480,00000024,00730419), ref: 00734F57

GetACP.KERNEL32(?,?,?,?,?,?,00731848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0073C146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00731848,?,?,?,00000055,?,-00000050,?,?), ref: 0073C171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0073C2D4

Strings

||t, xrefs: 0073C0C7
utf8, xrefs: 0073C243

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8$||t
API String ID: 607553120-1880129831
Opcode ID: ec7fa2170598c0b0beffaa9c262b4b9842452054a830485d2e3fbce8a5b572f7
Instruction ID: d83619480dac3d89d43a91adbeaa7f9392298d120db66bba04db83e60bc8ac67
Opcode Fuzzy Hash: ec7fa2170598c0b0beffaa9c262b4b9842452054a830485d2e3fbce8a5b572f7
Instruction Fuzzy Hash: 1371D771600206EAFB26BB75DC46BA773A8FF45700F144429F505E7183EBBCE94097A1

Function 0073C814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0073CB32,00000002,00000000,?,?,?,0073CB32,?,00000000), ref: 0073C8AD
GetLocaleInfoW.KERNEL32(?,20001004,0073CB32,00000002,00000000,?,?,?,0073CB32,?,00000000), ref: 0073C8D6
GetACP.KERNEL32(?,?,0073CB32,?,00000000), ref: 0073C8EB

Strings

ACP, xrefs: 0073C832
OCP, xrefs: 0073C868

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: a566d6c84c5d69e4003649ab20f15bfb4e3dea805ee4b31dd18ec4af9f74ab72
Instruction ID: 6d0f8fa109f92097af55143b53a230ffb7787dfb4bc4000629a48804d79b492b
Opcode Fuzzy Hash: a566d6c84c5d69e4003649ab20f15bfb4e3dea805ee4b31dd18ec4af9f74ab72
Instruction Fuzzy Hash: 7321B332A01201EAFB369F65C901AD773AABF54B50F568475E90AF7112EB3ADF40D350

Function 0072FEF0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Strings

Gs, xrefs: 00730233, 00730211
Gs, xrefs: 0072FF0B, 0073008E, 007302B7, 00730250, 007300DD

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: Gs$Gs
API String ID: 0-4213454521
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: 49dae6ff051fcd753d809039be77f3843be5b3ca7800ad66b5f8379960f57b6d
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: F8F14F71E002199FDF14CFA8D894AAEB7B1FF88324F15826DE919A7381D735AD41CB90

Function 0074E175 Relevance: 7.2, Strings: 5, Instructions: 909COMMON

Download Yara Rule

Strings

0, xrefs: 0074ECA9
0, xrefs: 0074ED58
@, xrefs: 0074F90C
i, xrefs: 0074F7FE
0, xrefs: 0074F3A0

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 71f3d092406bf2b1da397f9251c19992cfeb9473183140990b6d77d2ed173c24
Instruction ID: 37aeca62838c1c4894842f8bd2f5d46a004c4a1eccc2ab972e815cce9002fe35
Opcode Fuzzy Hash: 71f3d092406bf2b1da397f9251c19992cfeb9473183140990b6d77d2ed173c24
Instruction Fuzzy Hash: DB72CF71A083518FD318DF28C49076ABBE1EBC9714F188A2DE8D997391E778DD45CB82

Function 0074E2D5 Relevance: 6.7, Strings: 5, Instructions: 453COMMON

Download Yara Rule

Strings

0, xrefs: 0074E5FB
gfff, xrefs: 0074F033
gfff, xrefs: 0074F0EC
-, xrefs: 0074EFFD
gfff, xrefs: 0074F0A1

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: -$0$gfff$gfff$gfff
API String ID: 0-1217629319
Opcode ID: e70ea6af7df4099828697e47c503092b59018ffd614456e3a52484d2297035ff
Instruction ID: c3b2de948786162d0109b9f277eea5f0a3268f01f20041c332592723545a7006
Opcode Fuzzy Hash: e70ea6af7df4099828697e47c503092b59018ffd614456e3a52484d2297035ff
Instruction Fuzzy Hash: C5F1A071A087918FD318CE2CC49075AFBE2ABD9314F498A2DE9D9CB391D378D945CB42

Function 0075C938 Relevance: 6.7, Strings: 5, Instructions: 409COMMON

Download Yara Rule

Strings

vLyB, xrefs: 0075CCDB, 0075CCE3
q-s, xrefs: 0075CA32
JpzN, xrefs: 0075CCA5
d`df, xrefs: 0075C94A
\W, xrefs: 0075CAEC

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: JpzN$\W$d`df$vLyB$q-s
API String ID: 0-2943124228
Opcode ID: c0123f9ddd81bde4ead67e13c59693835463b28b846828819b093025ea9eb232
Instruction ID: 01351de1b4b64476b334dd66b6b264681b8e1a48462b3e1253be9b1b3fd31410
Opcode Fuzzy Hash: c0123f9ddd81bde4ead67e13c59693835463b28b846828819b093025ea9eb232
Instruction Fuzzy Hash: 5CD18BB050C3808FD312DF1884917AEBBF1AF96746F18095CE8D59B352D3B9C949CBA6

Function 0076EF70 Relevance: 6.5, Strings: 5, Instructions: 258COMMON

Download Yara Rule

Strings

KC, xrefs: 0076EFCD
k$i, xrefs: 0076F259, 0076F25D
zC, xrefs: 0076EFC5
-{4y, xrefs: 0076F17B, 0076F183
H~, xrefs: 0076EFD5

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: k$i$-{4y$H~$KC$zC
API String ID: 0-1198185020
Opcode ID: cb060303c5a1a0c4baba74594868201dd970643a30ef342180b2144766bb590c
Instruction ID: 20a4bd8923ee9116ce79f1802d9db89445951631ed78e6c4d5ded002ba9b9a2f
Opcode Fuzzy Hash: cb060303c5a1a0c4baba74594868201dd970643a30ef342180b2144766bb590c
Instruction Fuzzy Hash: 2E8179B0508340DBD710EF18D891B2AB7F0FF96764F54891CE8D69B292E339D905CBA6

Function 00733C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00733D1F

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 5b892f58773a97f5ec6aafdc713a40fbf2a4bd4d1a454ae05ca178f90a7c91d0
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: EEB12772E042569FEB258F68C881BEEBBB5EF55310F15416AE815AB243D23C9E05C7A0

Function 00727922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0072792E
IsDebuggerPresent.KERNEL32 ref: 007279FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00727A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00727A1D

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: f0a29dfa049adf9ad09c02187593019cba645e82c4835f89bfaa7f3fef1b5e47
Instruction ID: 5e5460048f6873c1127fa3465cb927eb4a039c92b29d6c6d63b7fa8b53994776
Opcode Fuzzy Hash: f0a29dfa049adf9ad09c02187593019cba645e82c4835f89bfaa7f3fef1b5e47
Instruction Fuzzy Hash: 6831D7B5D05228DBDB61DFA4D9497CDBBB8AF08300F1041EAE40DAB250EB799B85CF45

Function 00795288 Relevance: 5.3, Strings: 4, Instructions: 348COMMON

Download Yara Rule

Strings

kD, xrefs: 00795509
, xrefs: 007955BE, 00795717, 007956EB, 0079559B, 007955A3, 007956F3
oD, xrefs: 0079551C
P, xrefs: 0079542E

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: P$kD$oD$
API String ID: 0-1115615460
Opcode ID: ed1cfad7e5831a2e1b48057f332d66576bd6f5d84c9fae2d0d95bb32115eec55
Instruction ID: e7739ef2a77a5c1f3b6d0c71782b9f7bfb59c57038aed06b8c13dda66941008b
Opcode Fuzzy Hash: ed1cfad7e5831a2e1b48057f332d66576bd6f5d84c9fae2d0d95bb32115eec55
Instruction Fuzzy Hash: A1C114725087618FCB16CE28E84072EB7E1EBC1714F158A2CE8A59B391D779DD45CBC2

Function 0076FAE2 Relevance: 5.2, Strings: 4, Instructions: 209COMMON

Download Yara Rule

Strings

~, xrefs: 0076FB45
I}, xrefs: 0076FD29
v}, xrefs: 0076FB37
I}, xrefs: 0076FB3E

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: I}$I}$v}$~
API String ID: 0-1535326304
Opcode ID: 18d941ddf0c7df2a2020a84959c7baed37afdcccf923d2de2c574be5e132557b
Instruction ID: b03ec33b79a7bf3cead38aa2825c5017d235a57b8f59550b0d5459211890863c
Opcode Fuzzy Hash: 18d941ddf0c7df2a2020a84959c7baed37afdcccf923d2de2c574be5e132557b
Instruction Fuzzy Hash: FE618BB09012568BDB10CF94DC91BBEBBB1FF46340F584958E895AF392D3389841CBA4

Function 00793642 Relevance: 5.1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

Strings

US, xrefs: 0079364A
, xrefs: 0079385E, 0079383B, 00793843
Q_, xrefs: 00793652
@, xrefs: 007937F5

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: @$Q_$US$
API String ID: 0-1387636662
Opcode ID: b84bd2cad6fc919d03a3147de07ecc8b5f863db2d204b0a85fdfcd1955775bcd
Instruction ID: 0abd56d04277eac65cfd0435a09f078dc1121ed5350944fbe42f7505868c7f21
Opcode Fuzzy Hash: b84bd2cad6fc919d03a3147de07ecc8b5f863db2d204b0a85fdfcd1955775bcd
Instruction Fuzzy Hash: 864187B0408341ABDB14DF14D894A2BBBF0FF86344F54491DF4C9AB261E339DA46CB6A

Function 0073C498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00734EB1: GetLastError.KERNEL32(?,00000008,00739482), ref: 00734EB5
Part of subcall function 00734EB1: SetLastError.KERNEL32(00000000,0074C480,00000024,00730419), ref: 00734F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0073C4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0073C536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0073C5FC

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: d0b82acbcf997e7f71c5e233215b2507e50c3818b41784f3732428f0faac9aa5
Instruction ID: 886e5e71bc02b8920ba338603fa0e4ab52ea7e17201c1afb6cfe00d0418ee9d9
Opcode Fuzzy Hash: d0b82acbcf997e7f71c5e233215b2507e50c3818b41784f3732428f0faac9aa5
Instruction Fuzzy Hash: CE618272500207DFFB2A9F24CC86BBA77A8EF04310F10817AE905E6596E77CE951CB50

Function 0072DA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0072DB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0072DB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0072DB82

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 08a0f00d214bc4e1729f1d2d574f0d51ced8420e392aed6296a934294af7b1d5
Instruction ID: 8e181a7db34a750a38688d035a30631df8f0dea138ceea235b31475f522f417b
Opcode Fuzzy Hash: 08a0f00d214bc4e1729f1d2d574f0d51ced8420e392aed6296a934294af7b1d5
Instruction Fuzzy Hash: 1031B5749012289BCB61DF64DD89BCCB7B8BF08310F5045DAE41CA7260E7789F858F44

Function 00755618 Relevance: 4.1, Strings: 3, Instructions: 379COMMON

Download Yara Rule

Strings

IEND, xrefs: 00755A65
), xrefs: 00755695
), xrefs: 0075569F

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: e3af02e7cd14337d65bc99edb6bb6da9af78cbb27c27db32bd75912408caa374
Instruction ID: 82cb1fcf49c40309a0cf8d85a8b46fe5186788acc110676e8243bb8489370e8d
Opcode Fuzzy Hash: e3af02e7cd14337d65bc99edb6bb6da9af78cbb27c27db32bd75912408caa374
Instruction Fuzzy Hash: ACE1D0B1A08741EFD310CF24C89579ABBE0FB84314F14862DE99997381D7B9E919CBD2

Function 007936EE Relevance: 3.9, Strings: 3, Instructions: 122COMMON

Download Yara Rule

Strings

, xrefs: 0079385E, 0079383B, 00793843
]oXm, xrefs: 00793716
@, xrefs: 007937F5

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: @$]oXm$
API String ID: 0-4013158905
Opcode ID: 08b563d773aac84b36ad4809571cbbdf506584426bf330bc6785f7f8a4602933
Instruction ID: bc8dfff91fa9a62ec596f219927bb36146c41d156435158dbe977a96c9f5265f
Opcode Fuzzy Hash: 08b563d773aac84b36ad4809571cbbdf506584426bf330bc6785f7f8a4602933
Instruction Fuzzy Hash: F44164B44183419BDB14DF15D494A2EBBF0FF86344F54891CF4C9AB261D339CA86CB5A

Function 0077C224 Relevance: 3.8, Strings: 3, Instructions: 38COMMON

Download Yara Rule

Strings

KFCI, xrefs: 0077C252
Q^\X, xrefs: 0077C23A
UNOc, xrefs: 0077C232

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: KFCI$Q^\X$UNOc
API String ID: 0-1593643587
Opcode ID: c1021c8647da17318554d3aa5cff67c87dd53425995099f84c7b189f47ca34d0
Instruction ID: 33fd7cb2a7c73962b2a7dabbcea6091660c71aa556073adaeb435e053765eba0
Opcode Fuzzy Hash: c1021c8647da17318554d3aa5cff67c87dd53425995099f84c7b189f47ca34d0
Instruction Fuzzy Hash: 6F110DB0508380ABD3118F94C584A1EFFF0AB8A781F10881CF9D857222C3B9C8818F13

Function 0073622B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,007323AE,?,20001004,00000000,00000002,?,?,007319B0), ref: 0073625F

Strings

R[r, xrefs: 0073624A

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: InfoLocale
String ID: R[r
API String ID: 2299586839-2000533315
Opcode ID: 95cb508a3370cec441238b9f1b8eab1efb03aaa47988d72d68c7ae3c324222c6
Instruction ID: c3904b408d01cef0ca1bb63a917d82e0e85e685f0fd3e53856ac2a0b18074bb0
Opcode Fuzzy Hash: 95cb508a3370cec441238b9f1b8eab1efb03aaa47988d72d68c7ae3c324222c6
Instruction Fuzzy Hash: 74E04F36500628FBDF122F61DC08EAE7F2AEF45760F01C011FD0965122CB798E20AAA5

Function 007949F8 Relevance: 2.8, Strings: 2, Instructions: 288COMMON

Download Yara Rule

Strings

, xrefs: 00794A69, 00794B39, 00794C4D, 00794B70, 00794B0C, 00794A3C, 00794A48, 00794B18, 00794B7B, 00794C56
, xrefs: 00794C0C, 00794BDC, 00794BE5

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: a72b061ef2fa19078f6f09b4256c813a26286e548eea71359ce8abeef3a1e115
Instruction ID: 6a47cb6c76e7a4a1cf1bd98cc82a27f14d3a1ad5936355f60579f4e93a7e702a
Opcode Fuzzy Hash: a72b061ef2fa19078f6f09b4256c813a26286e548eea71359ce8abeef3a1e115
Instruction Fuzzy Hash: D5A1CEB1608340ABDF24CB54EC41FABB7E5EB86310F54892CF58597391E738E941CB96

Function 00796FD8 Relevance: 2.7, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

, xrefs: 007970CE
, xrefs: 0079702E, 00797142, 0079711B, 0079700B, 00797013, 00797123

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: e90198aaeed22a300b19465d833889039e3ddf500042478477c72a525097edc6
Instruction ID: 83bd667ee7e4d96581b48cb6f43920146268974d663d55867de214e2c3af0be4
Opcode Fuzzy Hash: e90198aaeed22a300b19465d833889039e3ddf500042478477c72a525097edc6
Instruction Fuzzy Hash: A771CE7052C341ABCB18AF58E881A2EB7F5FF95710F54891CF5C58B2A2E33AD814CB56

Function 00775EC3 Relevance: 2.6, Strings: 2, Instructions: 140COMMON

Download Yara Rule

Strings

^TPX, xrefs: 00775FE9
6, xrefs: 00776061

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: 6$^TPX
API String ID: 0-3674074485
Opcode ID: e2faa7a7b5874149e8eed49c136e69c5cac99755a3b347c5e8b82d654e240883
Instruction ID: 717d00bc0708f6542bcfb658751f5867a868672d120ba4af8bc9552f41cfb40c
Opcode Fuzzy Hash: e2faa7a7b5874149e8eed49c136e69c5cac99755a3b347c5e8b82d654e240883
Instruction Fuzzy Hash: 255111B050C7808FE7629F2A8480A2AFBF2AF92785F64995CE1E54B362D375C445CF17

Function 00796EA8 Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

@, xrefs: 00796F10
, xrefs: 00796F7E, 00796F5B, 00796F63

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: @$
API String ID: 0-736778079
Opcode ID: 0ac285f3c4d7bf6ff568a0e3d31a6644a2a8a6f4a62bd3ece0da7e21683cf0fc
Instruction ID: e8b043d8f21d282e64aba254d6a138de0c90d58bb861b576d215acd78575cfa3
Opcode Fuzzy Hash: 0ac285f3c4d7bf6ff568a0e3d31a6644a2a8a6f4a62bd3ece0da7e21683cf0fc
Instruction Fuzzy Hash: F2316B715083049BDB14DF14E881A2FFBF6EF96304F148A2CE5D897291D379D908CB96

Function 0075BB58 Relevance: 2.6, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

p, xrefs: 0075BBC1, 0075BB9B
p, xrefs: 0075BBE9

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: p$p
API String ID: 0-2001073228
Opcode ID: 9ccebd6029074dcc193b65c5d4f3edf18eb513497d73d4234c938a2efa72fd27
Instruction ID: b4f5bbfc7957a95e2658f5e8bd71ff4e057a3ac23c5c47541ae53f5b2bf24679
Opcode Fuzzy Hash: 9ccebd6029074dcc193b65c5d4f3edf18eb513497d73d4234c938a2efa72fd27
Instruction Fuzzy Hash: 7C3120B0D0024A9BDB00CF98C5866AEFFB1FB0A311F144519E950F7741D378A998CBE5

Function 00756C29 Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

8, xrefs: 00756C7F
0, xrefs: 00756C87

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 101362e4397cd3868e0d82b2d27283c317da1e6fc92abe76afbb474ffa19d7ef
Instruction ID: df4bf0cf8e2bc2874814a92538c13c7f0b38091a9dac148b69c7611c68ce05af
Opcode Fuzzy Hash: 101362e4397cd3868e0d82b2d27283c317da1e6fc92abe76afbb474ffa19d7ef
Instruction Fuzzy Hash: 7E31D53660D3C58FD315CA68948069FFBE1ABE6354F484D5DE8C4A7342CAB4D809CBA3

Function 0074DED8 Relevance: 2.5, Strings: 1, Instructions: 1296COMMON

Download Yara Rule

Strings

@, xrefs: 0074FE4D

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0f2fb15fb640a0ac74f7ebf11ae0a00e79eb1ebbcee514835237cce2622ebf17
Instruction ID: 32f9c78e59cba2f56a12efed039cbbda3b571f31c8b6333a3c4613f8fbdd68e2
Opcode Fuzzy Hash: 0f2fb15fb640a0ac74f7ebf11ae0a00e79eb1ebbcee514835237cce2622ebf17
Instruction Fuzzy Hash: 0392F4716083518FD714CF28C49466EBBE2AFC9314F188A2DE899DB391E378DD49CB91

Function 00791798 Relevance: 1.9, Strings: 1, Instructions: 618COMMON

Download Yara Rule

Strings

f, xrefs: 00791976

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: b38e6f6da0f4ee892dc7bd84d3849ea3ee91e3c5acb601456a1049e317f3aa66
Instruction ID: 6530c2582cee6f8bdc7465ea157cd692ec8fe8723cc43eee9259b5be9e4c6f2a
Opcode Fuzzy Hash: b38e6f6da0f4ee892dc7bd84d3849ea3ee91e3c5acb601456a1049e317f3aa66
Instruction Fuzzy Hash: 2A22B0716083429FCB14CF18D890A2EBBE6BF89314F988A2CF4D597391D739E954CB52

Function 0073572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00735727,?,?,00000008,?,?,007415F5,00000000), ref: 00735959

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: da15bc1158da06fa5c8b3e8ff4c070bbbad9cde3d4c2fc9c8abdd708e2289883
Instruction ID: aac965581773e0e111f5404e95d1aea95dd9c5d2258f6e518cbc20861e9f8b48
Opcode Fuzzy Hash: da15bc1158da06fa5c8b3e8ff4c070bbbad9cde3d4c2fc9c8abdd708e2289883
Instruction Fuzzy Hash: 90B12E35610A05DFE715CF28C486BA57BE0FF45365F258658E8D9CF2A2C339E991CB40

Function 0072729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 007272B2

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 1eac3882b42db334cc487ba75eb893b3ab18686369caf6f6983f3ad7e3bcb78a
Instruction ID: c56a69fc3dfae467fbe2192bb9e121e12c890314f16cfd0b3015fe9031f46bad
Opcode Fuzzy Hash: 1eac3882b42db334cc487ba75eb893b3ab18686369caf6f6983f3ad7e3bcb78a
Instruction Fuzzy Hash: 0EA1AEB5E052158FDB28CF64E9827AABBF1FB4A310F18C16AD459E73A0D3389941CF54

Function 007505B8 Relevance: 1.7, Strings: 1, Instructions: 448COMMON

Download Yara Rule

Strings

CD, xrefs: 00750616

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: CD
API String ID: 0-3115673787
Opcode ID: 4c0b4b88843fe66386dd9f80ba3723d5ab93d35f761372caa74b535c6bc6894e
Instruction ID: 485333734d23425c35827c4b862e8082d6b7e9447482d153a593288b74c4192c
Opcode Fuzzy Hash: 4c0b4b88843fe66386dd9f80ba3723d5ab93d35f761372caa74b535c6bc6894e
Instruction Fuzzy Hash: BDE1A772A083019BD704CF29C88169AB7E6FBC4750F25CA2DF89997394E774ED458BC1

Function 00775368 Relevance: 1.7, Strings: 1, Instructions: 415COMMON

Download Yara Rule

Strings

TW, xrefs: 0077538A

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: TW
API String ID: 0-1778470648
Opcode ID: 37e65682408c37040f626a0ca88badc03505eecafd751e2c16e196c146a53e28
Instruction ID: f01595d5fdc090d6743c26b18ac426a91196037ff155b03bcd3068bee476f23f
Opcode Fuzzy Hash: 37e65682408c37040f626a0ca88badc03505eecafd751e2c16e196c146a53e28
Instruction Fuzzy Hash: F8C1AFB1508700DBDB11AB14C845A2BB7F5EF91790F58891CF8C89B252E3B9ED54CBA3

Function 00739ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43569faa8d38e0b6bb53b02043f3477ad126197071f634e87203c4593b8e66ec
Instruction ID: 7665dc78e973a0589433cf8fcd13969a5a8660a510d2633c720745669b86fa99
Opcode Fuzzy Hash: 43569faa8d38e0b6bb53b02043f3477ad126197071f634e87203c4593b8e66ec
Instruction Fuzzy Hash: 57310B76900219AFDB20DFB8DC89DBBB77DEB84310F144159F905D7245E674AE40CB54

Function 0072CAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0072CC80

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 423f4d2117816ca8fd932c1a1c0bf7fa7b721754299346e5d0de2a84799532a3
Instruction ID: 50f5d61311086a2802db625a50b5c43f0e9a157fbab4b411dc055aecdd15cabc
Opcode Fuzzy Hash: 423f4d2117816ca8fd932c1a1c0bf7fa7b721754299346e5d0de2a84799532a3
Instruction Fuzzy Hash: B2C102B0A00669CFCB3ACF28E49567EBBB1BF25310F24461DD4569B391C339AD85CB91

Function 0078074E Relevance: 1.6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

Strings

-'.$, xrefs: 00780989

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: -'.$
API String ID: 0-2031752551
Opcode ID: 34e3f814482b72035446470293d0cf0e4fa038b8cce2f5f390abddc47372c923
Instruction ID: 280a5f98c195c439927d284d5fa18fffefa5d6adbbfb36139e01345d5b96a85e
Opcode Fuzzy Hash: 34e3f814482b72035446470293d0cf0e4fa038b8cce2f5f390abddc47372c923
Instruction Fuzzy Hash: DAB16D70504B818FE7668F29C090B22FBF1EF56314F14859DD8EA9B752C739E806CB91

Function 0073C6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00734EB1: GetLastError.KERNEL32(?,00000008,00739482), ref: 00734EB5
Part of subcall function 00734EB1: SetLastError.KERNEL32(00000000,0074C480,00000024,00730419), ref: 00734F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0073C73F

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: f5ae0f7bce125139a0c64e4c8bcab936a1102fd42b6e3800b91623ecaf6d7245
Instruction ID: da43b9fa7564703d6e621e88843e0ae07c3bc7adb3e902845f56a4c7920eeac4
Opcode Fuzzy Hash: f5ae0f7bce125139a0c64e4c8bcab936a1102fd42b6e3800b91623ecaf6d7245
Instruction Fuzzy Hash: 7021B076605206ABFB29AF25DC46A7A73A8EF05350F14407AFD06E6243EB3CED418B50

Function 0073C372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00734EB1: GetLastError.KERNEL32(?,00000008,00739482), ref: 00734EB5
Part of subcall function 00734EB1: SetLastError.KERNEL32(00000000,0074C480,00000024,00730419), ref: 00734F57

EnumSystemLocalesW.KERNEL32(0073C498,00000001,00000000,?,-00000050,?,0073CAC9,00000000,?,?,?,00000055,?), ref: 0073C3E4

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 073627b99c708bd87a57a8267e6ea9bf0943fb42c7fda854d85609083122cb8f
Instruction ID: 4dfaac41cf6c35b39cfc49c44b37a3b4e922a746b555d66f46d5ff2d2cefda0a
Opcode Fuzzy Hash: 073627b99c708bd87a57a8267e6ea9bf0943fb42c7fda854d85609083122cb8f
Instruction Fuzzy Hash: 49114C3B2003019FEB189F38C8A157ABB91FF80368F14842CE94757B41D3757942C740

Function 0073C91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00734EB1: GetLastError.KERNEL32(?,00000008,00739482), ref: 00734EB5
Part of subcall function 00734EB1: SetLastError.KERNEL32(00000000,0074C480,00000024,00730419), ref: 00734F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0073C6B4,00000000,00000000,?), ref: 0073C946

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: ed139cd551ca9fbfd9f319f405bddb2663865cf7e94348f17aaa8db4630cbaa9
Instruction ID: 11d1388c6e978ea2960828f8acd6ac8604d64446a40377a39e5eb38160a1638d
Opcode Fuzzy Hash: ed139cd551ca9fbfd9f319f405bddb2663865cf7e94348f17aaa8db4630cbaa9
Instruction Fuzzy Hash: 0CF0F937500211BBEB295660C806BBA7758EB40754F064428EC46B3181DA38FE01C790

Function 0073C40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00734EB1: GetLastError.KERNEL32(?,00000008,00739482), ref: 00734EB5
Part of subcall function 00734EB1: SetLastError.KERNEL32(00000000,0074C480,00000024,00730419), ref: 00734F57

EnumSystemLocalesW.KERNEL32(0073C6EB,00000001,?,?,-00000050,?,0073CA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0073C457

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 43f7faff739f3ffd7d5f8aa12700e9ead0275890b18bbd774a482213135c760b
Instruction ID: e7e57bfa76b6fa4948c75c882be7be269bc15f064b1d74786b18af678e83fb8b
Opcode Fuzzy Hash: 43f7faff739f3ffd7d5f8aa12700e9ead0275890b18bbd774a482213135c760b
Instruction Fuzzy Hash: 2AF046763003449FEB255F38DC91A7A7F91FF80768F05802DF9069B691C679AC02C700

Function 00735D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0072DDC1: EnterCriticalSection.KERNEL32(?,?,00734B89,?,0074C2E0,00000008,00734D4D,?,0072C446,?), ref: 0072DDD0

EnumSystemLocalesW.KERNEL32(00735D72,00000001,0074C3A0,0000000C,00736127,00000000), ref: 00735DB7

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: b140403b443174b0a9ebf2699c286d500a3f86f5c54b08a74ed0e7b73ee34654
Instruction ID: 4bd26d98c006f72ff188b2e198fb3b99a0bbcb73a0ff6c0103469c78e653be07
Opcode Fuzzy Hash: b140403b443174b0a9ebf2699c286d500a3f86f5c54b08a74ed0e7b73ee34654
Instruction Fuzzy Hash: 82F049B6B44210EFE714EF98E88AB9E7BB0EB45721F10811AF4059B2E1D77D5A44CB84

Function 0073C327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00734EB1: GetLastError.KERNEL32(?,00000008,00739482), ref: 00734EB5
Part of subcall function 00734EB1: SetLastError.KERNEL32(00000000,0074C480,00000024,00730419), ref: 00734F57

EnumSystemLocalesW.KERNEL32(0073C280,00000001,?,?,?,0073CAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0073C35E

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b7ac82fdd9e3e88c6b0ce2afef7ecf3d53fe2793b3f220cfbf1485de5b1a2890
Instruction ID: 66ab8ed9aa160acb42b878488adb47dd36e8ce01613654db8d5f829b5fa3bcd0
Opcode Fuzzy Hash: b7ac82fdd9e3e88c6b0ce2afef7ecf3d53fe2793b3f220cfbf1485de5b1a2890
Instruction Fuzzy Hash: 90F0E53A30030557EB199F75D84566ABF94FFC1B60F068059EA098B692C67A9942C790

Function 0077A059 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

P, xrefs: 0077A397

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 4bfaa7626ea9b600e4b84af23bd05a8ca6e36999e86aa202f38862eca0be855c
Instruction ID: 47d1a96b417d2b9381fca46dc4322ad23cd01c4fe58c41129756457f476cc190
Opcode Fuzzy Hash: 4bfaa7626ea9b600e4b84af23bd05a8ca6e36999e86aa202f38862eca0be855c
Instruction Fuzzy Hash: 1EA1BE71909345ABFB109A14C8803AFBBE1EBD53D0F58892DE99D87292E379D944CB43

Function 00757908 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00757A3E

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 4ab73c068909bf4a579edcd3551088511d35e91c35163eb6544c071a430a9b34
Instruction ID: 7074d1891568e95bbf3671e1b5f68393b585c0b010275ae2b5a8e4384916b238
Opcode Fuzzy Hash: 4ab73c068909bf4a579edcd3551088511d35e91c35163eb6544c071a430a9b34
Instruction Fuzzy Hash: F7B1477010D3819FD325CF28D88065BFBE1AFA9304F444A2DE5D997382D675EA08CBA7

Function 0074E212 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

@, xrefs: 0074E7F8

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 306e642b51b2512054d38a46158e9f08723d7b25d1953b1fc47caece9ac7f322
Instruction ID: c9ae8ee7ab5c26f6d0f8469d35a8e3453e895caf5838e44cfd3d36bc6269ffff
Opcode Fuzzy Hash: 306e642b51b2512054d38a46158e9f08723d7b25d1953b1fc47caece9ac7f322
Instruction Fuzzy Hash: 57A1BA71A087519FD314CF18C49476AFBE2AFC5324F198A2DE8D997391C7789C49CB82

Function 00727AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,00726DC9), ref: 00727AB4

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4ce3f84a5ee3fb4665c37db46a9621d2e51f3ce2cbe590e45e98ee4c1a5e1777
Instruction ID: cd9cbe3b770c75b38f90311e763a76f04afc38841a76d147b12c087e140ffa7e
Opcode Fuzzy Hash: 4ce3f84a5ee3fb4665c37db46a9621d2e51f3ce2cbe590e45e98ee4c1a5e1777
Instruction Fuzzy Hash:

Function 007974F8 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

, xrefs: 00797552, 0079760E, 007975EB, 0079752B, 00797533, 007975F3

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 08d3931baa2a9c42408cb6ec1c64e50b571bbd3c3c2ceb0987ed0c3721af9082
Instruction ID: 5f7e9dc3000ea5946e4f3ede964d42b1e47bb1340e9c20b302939b4c732ba11a
Opcode Fuzzy Hash: 08d3931baa2a9c42408cb6ec1c64e50b571bbd3c3c2ceb0987ed0c3721af9082
Instruction Fuzzy Hash: BD81EE756183019BCB289F18E880A2BB3F5FF85710F19892CF8859B351D739EC60CB96

Function 0077E388 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

", xrefs: 0077E64C

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction ID: 2599fe6f1fcd9d57e62a65049eb4658c578cf2424cf416a6afb83712ee7b1b82
Opcode Fuzzy Hash: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction Fuzzy Hash: 0C71E6327083504FDB20892CC88421EB6D2ABDA374F28DBA9F4B8CB3E1D679DC458741

Function 007947F8 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

, xrefs: 007948BE, 007949A8, 0079497B, 0079489B, 007948A3, 00794983

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: caa00a0baa876a8884e4083aa7b8b58c4b77efdead5d9ec54620c567e662e154
Instruction ID: f20a320102e0d88e0ab7dfd11b2495d27d9f580535ecd9f4a451ea43c0032785
Opcode Fuzzy Hash: caa00a0baa876a8884e4083aa7b8b58c4b77efdead5d9ec54620c567e662e154
Instruction Fuzzy Hash: 3D51E131608310ABCB149E19EC91F2FB7E5EB85724F248A2CE9D957391D639EC01C756

Function 00780AD4 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

2FD>, xrefs: 00781F68

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: 2FD>
API String ID: 0-1510312430
Opcode ID: 242552adc178d8c3491bf93f30874780fcc0fbb89b54cad1dcff1d541b57b90a
Instruction ID: 4544fc63fd6087dbf64b37e4171dc945e67e6cf031ab09971a976ce0cc6076df
Opcode Fuzzy Hash: 242552adc178d8c3491bf93f30874780fcc0fbb89b54cad1dcff1d541b57b90a
Instruction Fuzzy Hash: 7F5190704057818FDB269F25C050A36FBB1EF17355B68888ED8D69BA83C339E807CB65

Function 0075FA44 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

2, xrefs: 0075FADA

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: e6034f399045d4b6abb2554f6b82214a593dffe65b117c12c080d18cf511f5b9
Instruction ID: 6aa67b4df5f985c4e11f01ce8f98e40d8987121c8cfe340b4acb69012b2ba66f
Opcode Fuzzy Hash: e6034f399045d4b6abb2554f6b82214a593dffe65b117c12c080d18cf511f5b9
Instruction Fuzzy Hash: 2B5165B1A49380D7F631A7108859FEFBAB5BFD5301F48092CE88D57282D77A9509C763

Function 0075FCD4 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

2, xrefs: 0075FD63

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 15cde75e9d06dabda2588e85d20db4463443109759951a92bfa7a8f5d5147061
Instruction ID: 4c9d5de1cfff67667fcf4d8ffa4a8675fd066109250286129452b024ce2d4b76
Opcode Fuzzy Hash: 15cde75e9d06dabda2588e85d20db4463443109759951a92bfa7a8f5d5147061
Instruction Fuzzy Hash: 1B5156B164A380D7F631A710885AFEF76B5BFD5301F48092CE84D57282D7BA9509C7A3

Function 00721D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00721E9B

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 6ce3d17d3d5373096f42b402cb8a093d1965ab292594c5d791698c4546fa42c7
Instruction ID: a2f6c438221ab9914096e2f7bdf0d8b425a4cbad418c3795e38b6183a10fd9c2
Opcode Fuzzy Hash: 6ce3d17d3d5373096f42b402cb8a093d1965ab292594c5d791698c4546fa42c7
Instruction Fuzzy Hash: E5412C76E2053B9BCB0CEEB8D9560AFBB69E755310B45427ADD11DB3D1E2388A01C6D0

Function 00781327 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

2FD>, xrefs: 00781F68

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: 2FD>
API String ID: 0-1510312430
Opcode ID: 482e1bb03dcd7035389772e6bba219ce3904a568faca1742d2efed7deef8c6d7
Instruction ID: fe3030edf3790e6bec054eee4aa885ff002cbdca788fe716262a68bc12072d5d
Opcode Fuzzy Hash: 482e1bb03dcd7035389772e6bba219ce3904a568faca1742d2efed7deef8c6d7
Instruction Fuzzy Hash: 4B4180701057818EDB269F25C050A36FBF4AF17355FA4888DD4D69BA83C339E847CB65

Function 00796B98 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

, xrefs: 00796BF7, 00796CAE, 00796C8B, 00796BCC, 00796BD5, 00796C93

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 3f681d420308340ce622b70d3801fe125027f74667fc1b293c25dd6169613fb3
Instruction ID: a912230d612452a811b8f823b5d18a045d9219a4ac1ff08127a59125367647d9
Opcode Fuzzy Hash: 3f681d420308340ce622b70d3801fe125027f74667fc1b293c25dd6169613fb3
Instruction Fuzzy Hash: 2F418074608340AFDF149F14E991B2FBBE5EB86710F64892CF9C997291D339E810CB66

Function 00796D28 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

, xrefs: 00796D87, 00796E3E, 00796E1B, 00796D5C, 00796D65, 00796E23

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 35ff341fea01c2b82f004fdc622a9334d9847dfee3824cdca80f10c1f8328be7
Instruction ID: a95379c4ffb25e64a943ffa63c31decdbb058d2a95ffcd51c6b86b6edc8196a0
Opcode Fuzzy Hash: 35ff341fea01c2b82f004fdc622a9334d9847dfee3824cdca80f10c1f8328be7
Instruction Fuzzy Hash: AE416D78608340ABDF149F14E980B2FB7E5EF86714F648A2CF4995B252D339E810CB56

Function 0076AF2D Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

qs, xrefs: 0076AF96

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID: qs
API String ID: 0-1399850505
Opcode ID: 8aaebf1e4c3640f5f3ce392bc9914373ba4fadcd76e73042caaaaaebe0853f7e
Instruction ID: 5712363f200dd5a2b863a48789d2e3a0784dcb0331e7605e4602873e8050cb58
Opcode Fuzzy Hash: 8aaebf1e4c3640f5f3ce392bc9914373ba4fadcd76e73042caaaaaebe0853f7e
Instruction Fuzzy Hash: 1A3139B0100B009BC7308F14D591A63B7F1FF1A750B549A0CE8AB9BAA5E339F844CB56

Function 007938E2 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

, xrefs: 0079394E, 0079392B, 00793933

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 6755f9bab069ea5934903f8183f253ded6f2aca177a558b48b1de12272a79bcd
Instruction ID: 9dbac1ac51619cbe6e2c80687a6efb0462370745f43d1d72879c17c08f09a04d
Opcode Fuzzy Hash: 6755f9bab069ea5934903f8183f253ded6f2aca177a558b48b1de12272a79bcd
Instruction Fuzzy Hash: C221AE70208301ABDB04DF08DC95F2AB7E5AB85729F54891CF1C59B2E2C3B9E950CB56

Function 0073CC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0073CC4B

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 550b6a55b791a99aedf58c293f8b191760dcc498fc2f70294bd453e30d145eb2
Instruction ID: b1b966fd03f35790f1e6af2525cc54fc2be0ae866cc091d1b1e47fd4660386b9
Opcode Fuzzy Hash: 550b6a55b791a99aedf58c293f8b191760dcc498fc2f70294bd453e30d145eb2
Instruction Fuzzy Hash: F4A01230201104CB47008F349E0520836D4558A180304C0655404C0020D72844409648

Function 00758F38 Relevance: .8, Instructions: 789COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55bdd7183e786f206f49eb0e89a9435e12bd88c65a2001897e8b962e1375b007
Instruction ID: 736c001d7285df79336a2d85e23d963d3c1f7d170338f0c772002ecb55824261
Opcode Fuzzy Hash: 55bdd7183e786f206f49eb0e89a9435e12bd88c65a2001897e8b962e1375b007
Instruction Fuzzy Hash: A542C531604711CBC725DF28D8806EEB3E1FFD4316F25892DDE9687281E779E8598B42

Function 00771908 Relevance: .7, Instructions: 700COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16869c809fe6b9c013eb52f11e203e487ef228a061d05dc0c8baca727ee9c214
Instruction ID: 794edbf4aa28226c835d06bbb6a0d4cc47da783e63ca17a06e92c7a55d9d68a2
Opcode Fuzzy Hash: 16869c809fe6b9c013eb52f11e203e487ef228a061d05dc0c8baca727ee9c214
Instruction Fuzzy Hash: 8D72F6B0508B81DED371CF3C8849796BFE5AB1A324F044A5EE4EA8B3D2C3756505CB66

Function 00758428 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169fd697c981202875bdf4f7b877c3bbabddd2f5e73f7c32bbe4a1385d044f0b
Instruction ID: 9c5a4f22d133e074c15bf0b4c1a7c7219a4651cbc913c2013923540ef48c4eca
Opcode Fuzzy Hash: 169fd697c981202875bdf4f7b877c3bbabddd2f5e73f7c32bbe4a1385d044f0b
Instruction Fuzzy Hash: AB52D6B0A08B848FE775CB24C4853E7BBE1EB95311F54481DC9E6176C2DBBDA889C702

Function 00754278 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction ID: 5a73655b5a464e8c19676571b18ba0c8f0d71f49730b3edbfbf859b3b53dffd4
Opcode Fuzzy Hash: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction Fuzzy Hash: 7852D2715083858FCB14CF14C0906EABBE1FF89319F198A6DEC9957352D7B8E889CB81

Function 00754C78 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4942d6c5a04db89343f61d2bd896b7a754b8bfa492006bc517a5ac4323522e
Instruction ID: 4cab1901cd2f81c5d832d24b68ed1365f439230704537a3480778c36512e161c
Opcode Fuzzy Hash: 8b4942d6c5a04db89343f61d2bd896b7a754b8bfa492006bc517a5ac4323522e
Instruction Fuzzy Hash: 68323570515B108FC328CF29C5905AABBF1BF45715B604A2EDA9787F90D7BAF889CB10

Function 00757338 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ed25ed2ecece428dec3d662da4c49c86df14d0f0cac3c7bd7da9d139c37883
Instruction ID: df20d9d1f030e28e2395e39f1d42c1809265c5f8260ab3c58c3c1138696fe0e4
Opcode Fuzzy Hash: c2ed25ed2ecece428dec3d662da4c49c86df14d0f0cac3c7bd7da9d139c37883
Instruction Fuzzy Hash: D302B37160C7418FC728CF29D88166BFBE6EFD8300F04892DE8D647791E679A908CB56

Function 0077A438 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d948c1b98276872fbedeb4ae571c7f1df7ffbfed0eb7000220ee8de56deee4
Instruction ID: f6e958cf63eb1a6f8ae950619d4ea5054b816f3a266966ec9f8a63d9bb851499
Opcode Fuzzy Hash: 83d948c1b98276872fbedeb4ae571c7f1df7ffbfed0eb7000220ee8de56deee4
Instruction Fuzzy Hash: CDB1F371608340ABEF14DB28C89066FB7E2EFD5385F18892CE4C997251E339E914CB97

Function 0078143A Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e5a161c1ab45c4b1e480cfbddb13b76eded34dc1ce46f9e0b718e5efcd9d52
Instruction ID: 6950eb4a0ed79b60d3547a7a8fd1312dd777cff39f87fa0ed6c08bedc4ad4d04
Opcode Fuzzy Hash: c5e5a161c1ab45c4b1e480cfbddb13b76eded34dc1ce46f9e0b718e5efcd9d52
Instruction Fuzzy Hash: 9FD14CB4800B419FD320AF39C546756BFB0FB02300F548A9DE8EA5B686D335A45ACFD6

Function 00794DA8 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5adaadb379de4d0ac6695891303286d85bf5796d7f1c210cbcdbab9b523f8b94
Instruction ID: 284100a30ea51d43c807542c803f9df5a9215b7ce936c44696d1ffa2a1b91e45
Opcode Fuzzy Hash: 5adaadb379de4d0ac6695891303286d85bf5796d7f1c210cbcdbab9b523f8b94
Instruction Fuzzy Hash: ABA105B2A083509BEB10DF68DC85B6BB7E5EBC5314F08092CF99887342E739DD058792

Function 0073BB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 0ee71f4e954e9f5c2c483c251f57de9fdf34c43403c29595576d667128b0a6ab
Instruction ID: 28dda1157ab5f88f0fb0aad482018144a5b63db3548b5c80c981f65ce88894a9
Opcode Fuzzy Hash: 0ee71f4e954e9f5c2c483c251f57de9fdf34c43403c29595576d667128b0a6ab
Instruction Fuzzy Hash: A8B107756007059BEB389F25CC96BB7B3A8FF44308F14452DEB83C6586EB79A985CB10

Function 007634A4 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d6742bc921a87cbc0d7ecdfc3dd5ce11be376d8912454172b111acada42123f
Instruction ID: b0ab0006cd47d771b9d051bba847d23c71f36f7a12b896722e09f83c835f551d
Opcode Fuzzy Hash: 7d6742bc921a87cbc0d7ecdfc3dd5ce11be376d8912454172b111acada42123f
Instruction Fuzzy Hash: A6C102B0500B508FD7258F24C895BA6BBF1FF46301F14895DE99B8BB92E73AB905CB50

Function 00786078 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6242de2c158a3e25abd914ef81a7081ec85dc90910a15599f474a425946f381
Instruction ID: 5e5bdd23d2469ef7ad8bd029946bc2c8b69e867481a0c81edb68939294c8353f
Opcode Fuzzy Hash: c6242de2c158a3e25abd914ef81a7081ec85dc90910a15599f474a425946f381
Instruction Fuzzy Hash: 35812C37F5599157C318A93D4C112BAAA831FD7330B3EC36AE9B5CB3E5DA2988024390

Function 00752302 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb0e1251b43261e23572b6fe04e2d9b66b4d052610f955a5f7654400d35fefe
Instruction ID: 35a4dae1429526ebd521b620a7af6e969dc21962937e46b9e4680db94dd2ee5f
Opcode Fuzzy Hash: 9bb0e1251b43261e23572b6fe04e2d9b66b4d052610f955a5f7654400d35fefe
Instruction Fuzzy Hash: D99107B1A083418BD7258E9494803A6B6D2EFA6306F1D856DDD855B353E7F9DC0FC382

Function 0077BADA Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a435c7ff7e61a266175cc740b2df94f4f0bcffa5dc796596f52e14c951997eae
Instruction ID: 33a8571e1927e4035f3d236cca07ec5ea4a97906490b28bd3ace52b28136522e
Opcode Fuzzy Hash: a435c7ff7e61a266175cc740b2df94f4f0bcffa5dc796596f52e14c951997eae
Instruction Fuzzy Hash: 3D710973A14B154BC728993C8C557AAB6D29BC4214F4E873CDD9EDB386EB78AD0187C0

Function 00784A88 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b4e1efa5495fb8a019b3a8f09c75cd24c53d3083fb3dc6746e68a82280d218
Instruction ID: 0b45be89fb0bea70478cd0525367508ba028b7892182664cfcaa7635f2cc8e72
Opcode Fuzzy Hash: e8b4e1efa5495fb8a019b3a8f09c75cd24c53d3083fb3dc6746e68a82280d218
Instruction Fuzzy Hash: 7C81FB376896924BD318AE3C9C51379AE934BD2330F2DC76DE5F28B3E5D5AD88018361

Function 00775108 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b631a1ef9c90cdc196109c47057cb6dd3a7c54a8c9dd28249f1b39c8e723b3
Instruction ID: f4ae72be32bc91b40c5697abecb3b110305cb2deeb735501f5ceaeaab343b8a2
Opcode Fuzzy Hash: 17b631a1ef9c90cdc196109c47057cb6dd3a7c54a8c9dd28249f1b39c8e723b3
Instruction Fuzzy Hash: 9051A1B1600704ABEF209B64CC86BB733B4FF857A5F148558F9898B391E7B9E904C761

Function 00752268 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f99aab2791bd1aba6dfb3b61b9a4968c41f01324f8c9ecb9249fe38aea401d4
Instruction ID: d4938fd49bf96b373a89a7b3199717bafad0f94a1a7de73835c7d0e46a9fa533
Opcode Fuzzy Hash: 5f99aab2791bd1aba6dfb3b61b9a4968c41f01324f8c9ecb9249fe38aea401d4
Instruction Fuzzy Hash: FE7128B290878287E7258A18C4503A6BB92AFE3316F29859DDC594B353E7F9DC1FC341

Function 007922A8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260186d478aae003c652c9c0622f6da14b7ca9a12c80829d925b8ad8623de31d
Instruction ID: 078a177f99473fff711f5493f75796438489ce22214843af56102acc9930ca3d
Opcode Fuzzy Hash: 260186d478aae003c652c9c0622f6da14b7ca9a12c80829d925b8ad8623de31d
Instruction Fuzzy Hash: 0671D171608381ABDF11EF19E840B2AB7E6EF95310F15892CE9D5872A2D339DC42CB52

Function 007818D8 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ecac1f06bdf61436ed265659ed9f52c64cc52bcee91badaf8e5f8c506a0b22
Instruction ID: c6083ac270c34a268bbc772380023506253bf63daa5fff834f011e7485c728a6
Opcode Fuzzy Hash: b2ecac1f06bdf61436ed265659ed9f52c64cc52bcee91badaf8e5f8c506a0b22
Instruction Fuzzy Hash: 837148B4404781CFDB259F29C094A26BFB0EF12310B58859DD8D65F74BD339E84ACBA1

Function 0075B2D8 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f57911bcbd89b49419ee3ef9dd8a7705bfb666a251f11caf1017bd8e3f52b3
Instruction ID: 1b672f1d500bcb0f987681b2caa7b8bcff0c67708046b488476f6227f2045bcd
Opcode Fuzzy Hash: 78f57911bcbd89b49419ee3ef9dd8a7705bfb666a251f11caf1017bd8e3f52b3
Instruction Fuzzy Hash: 0A5105377486804BC3285D7D5C912B97A834BD6334F2D837EEDF58B3E2EA9D48095290

Function 0074E3F7 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118f1cef26720b4861566893e0de54ebb40160411a9db2ff76e9d22af775da4a
Instruction ID: a65e6f82151e78177d5e19f4e9c57537f906ff2b0fa80d23e7441e5d0a019117
Opcode Fuzzy Hash: 118f1cef26720b4861566893e0de54ebb40160411a9db2ff76e9d22af775da4a
Instruction Fuzzy Hash: A871AE71A083519BD718CE28C09472EBBE2BFC4764F18892DF89997395D778DC45CB82

Function 00784858 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5a5ab0e6f08e1212459a1051d072897d816136cec1085f020d45d75109a894
Instruction ID: 89f0db3576bf24255d30f723f51a5b5a5a3e7cad6f17d7e3e29d7893c5182f74
Opcode Fuzzy Hash: 1b5a5ab0e6f08e1212459a1051d072897d816136cec1085f020d45d75109a894
Instruction Fuzzy Hash: FC512D37A8A6C247C724AE7C4C412A9AB531BD733473E8376D8F04B3D1D5AE98018351

Function 0078BCB8 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55836fbddb03cbdaf9cff1c314ca2634526aaf9b730aac6315943972a0646e05
Instruction ID: 9f3ceb9b9ab5f50ed700369d6eefdeb09ba697d218c4de3ba4339ac512807e60
Opcode Fuzzy Hash: 55836fbddb03cbdaf9cff1c314ca2634526aaf9b730aac6315943972a0646e05
Instruction Fuzzy Hash: 96515CB1A087548FE714EF29D49435BBBE1BBC8314F044A2DE5D987390E379DA088F92

Function 0075BCB9 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98426d52609b44d71ace9bc0825109431283409a88027502b5f6118697708dcb
Instruction ID: 5f02a10ca0ebd2442d1503b0cf14668b52496a63f59d50296e9a289e2f29d9b9
Opcode Fuzzy Hash: 98426d52609b44d71ace9bc0825109431283409a88027502b5f6118697708dcb
Instruction Fuzzy Hash: A4515EB1D016458FDF05CFA4D995ABEBBB2EF46302F680064E800B7352D7359E14CB66

Function 00786378 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9b159b4f3877c8d9d6b0debf22a3b75361e34386abef763474a0b287f0c785
Instruction ID: 2adb50fb563e6305bb9a83f932a496e9d547f802f54c4459f49db378cd3c0cf0
Opcode Fuzzy Hash: 6b9b159b4f3877c8d9d6b0debf22a3b75361e34386abef763474a0b287f0c785
Instruction Fuzzy Hash: F0514E37A8A5C05BC715BE3C1C452A86B135BE3334B3D8376D4B58B3D5D52E89129351

Function 00791048 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0570097160aab1b68a550f4511c957a43b2e8abafe0f435217c9cb9528a807
Instruction ID: 4d93326a19d89ecd23d5e867fea867d9434e614f6bfb4e176aabc9ee532c990e
Opcode Fuzzy Hash: 2d0570097160aab1b68a550f4511c957a43b2e8abafe0f435217c9cb9528a807
Instruction Fuzzy Hash: 8451D574608341ABDF14EF19E984A2BF7E6EF85705F54882CE5C587252D33ADC60CB22

Function 0075A268 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054442773fa85cc7e7f2bc6a691852260fd407d19e094a4ce9a9a5ee557263b7
Instruction ID: b9e3f1be4c35144036d6aa4c3b77860cdda11de24ccdb5124409e0bf73092193
Opcode Fuzzy Hash: 054442773fa85cc7e7f2bc6a691852260fd407d19e094a4ce9a9a5ee557263b7
Instruction Fuzzy Hash: 5441277040C380ABD701BF58D588A5EFFE5AF56706F548E2CE9C497252D3BAC8188B67

Function 00752B08 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bda98c2f30a516d50807ce0b98e746189b08d9b89d3b03278e09447c629b6b2
Instruction ID: 460a4f0087a9465090535bd3d3f9f3e062e722571a9e80efc33bf432478c0c43
Opcode Fuzzy Hash: 8bda98c2f30a516d50807ce0b98e746189b08d9b89d3b03278e09447c629b6b2
Instruction Fuzzy Hash: C351C4B1A043109FC714DF18C48095AB7E1FF86325F15466CEC959B353E675EC46CBA2

Function 0075E3F3 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b2c5dc47880b26d63c4cac224246904b14b76870b104fed36430456e3dcfb5
Instruction ID: 2d2ccee482986c4a7ba596550d2126751f13fc3f2c97dd80110fa28221d68607
Opcode Fuzzy Hash: 34b2c5dc47880b26d63c4cac224246904b14b76870b104fed36430456e3dcfb5
Instruction Fuzzy Hash: 534109B490026A9BDF058F94CC94BBEBB71FF06301F144858E811AB291D374A914CBA4

Function 0075E768 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5e34cb232997b27782127b8cd1ef61722e578a9a41e811742eb7c47ee6c68f4
Instruction ID: d16eaa0d8f9b21947c45fc127eda5deec52838381d3e27050ed9a5de22b5c239
Opcode Fuzzy Hash: f5e34cb232997b27782127b8cd1ef61722e578a9a41e811742eb7c47ee6c68f4
Instruction Fuzzy Hash: CB413772B0C3944FD35CCE7A889417A7BD2ABC5311F18CA7DF8A5862C4E6B48A09E750

Function 0077ABBB Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b10cf0e7097aa983af4eec26b10cdff308d4fbafdfb15f8fa67f104f1a184b0
Instruction ID: 53528e0c8cc2615bcba5dafe2ffd9ec5dd8d4f20eab1b7a72be30b2a12cc292d
Opcode Fuzzy Hash: 6b10cf0e7097aa983af4eec26b10cdff308d4fbafdfb15f8fa67f104f1a184b0
Instruction Fuzzy Hash: BF4138B1608341AFDB14CB28C45156FB7E2AFCA341F48892DF49AD7342D638E805CB53

Function 00795EE8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e225b96c8bf2e769cc8697a4cfbe4e2a1212ad77f5d165699b061e557b09fc9
Instruction ID: 5c5a40f67d2d9da022c73b553fae738e279213f5f8fdb73f7ecaf8bb04f61cb9
Opcode Fuzzy Hash: 8e225b96c8bf2e769cc8697a4cfbe4e2a1212ad77f5d165699b061e557b09fc9
Instruction Fuzzy Hash: EF31DE32B4D6104FD708DA29DC8165EBBE79BCA320F0DD62DE898D7291CA3DC8018B41

Function 00781FF9 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d162afb33da07c4bd60f7c483336d076906e7f1409a5580b2f65c4fffe7ae7c
Instruction ID: 4a776b5480b56b45b6642be4e0b59cecc0f9ab1aa4b4d7ae78bf14e343e4cd08
Opcode Fuzzy Hash: 0d162afb33da07c4bd60f7c483336d076906e7f1409a5580b2f65c4fffe7ae7c
Instruction Fuzzy Hash: 2631BE705447818FD7269F298050B22BBE19F53306F28848DD4D69B653C63EE80BCB61

Function 0078D598 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41c94bf4b0e2099e2558e9e672031c0a6948b5c6cff94468f528954f99504a0
Instruction ID: f3cfdba1544eb29203af8d9696b9e2981b1300fc2eac4304454f412786271836
Opcode Fuzzy Hash: e41c94bf4b0e2099e2558e9e672031c0a6948b5c6cff94468f528954f99504a0
Instruction Fuzzy Hash: D6310A32B8D7184BD735BD398C4026AB7929BC5370F19872DEDBA4B3C5EA784C419391

Function 00759AE8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff721506fae7554bc00bc682493813926a926291962e7d101190d432c5989efe
Instruction ID: 411cd320e72d82ccaf749a6445f2a5f74e980d015632f661c5bb675c6e284e76
Opcode Fuzzy Hash: ff721506fae7554bc00bc682493813926a926291962e7d101190d432c5989efe
Instruction Fuzzy Hash: F4317A298496F186E7328A3D94A04ADBF906D9612639942EDCCF10F3C3D586894AD3E1

Function 00790C08 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba455b42178d8c6815bdc6dc6395f760710097916b5094dc96ff09895023de6e
Instruction ID: 5d38eb8be4c5de79bb7ca7362b4efde3ea9dd8a06224523512f587c2a6c6d63a
Opcode Fuzzy Hash: ba455b42178d8c6815bdc6dc6395f760710097916b5094dc96ff09895023de6e
Instruction Fuzzy Hash: 45315A70618340AFDB10DF59D584B1FBBE6AB86704F14891CE4C89B252C33ADD45CBA6

Function 00751A58 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592ae079f84e3206837f27edfef0d756db5bd63b1ae8b67b4edac06f6a01af03
Instruction ID: 31e25b2cfd66b69868506d1ba679eb54258a6025d03faa03a1321187ea1595e1
Opcode Fuzzy Hash: 592ae079f84e3206837f27edfef0d756db5bd63b1ae8b67b4edac06f6a01af03
Instruction Fuzzy Hash: ED31D6306052009BD7119E59C884BAAB7E1EFC431BF98C92DFC999B341E779DC4ACB42

Function 00762702 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d538187a92fb4ac2440c57b712b554e1d8159c40c43cb23878864ac6b56818ea
Instruction ID: 9ab72eede1685df81ff6432a79c779cdcb47b3ac1e062c4b86c9cf9b30928225
Opcode Fuzzy Hash: d538187a92fb4ac2440c57b712b554e1d8159c40c43cb23878864ac6b56818ea
Instruction Fuzzy Hash: 31318EB0A007109FD725CF24C484ABBB7F5AF5A700F14892DE99B97682E778FA44CB51

Function 0077B175 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31ba30025e973e205b9eb2b84926fbe6cfd1052fcf67400e8907e88fc818d30
Instruction ID: 2719912b1bca967f570f29d8b0eb15d5f6c399d205a80ffe2e896c4faf6230de
Opcode Fuzzy Hash: d31ba30025e973e205b9eb2b84926fbe6cfd1052fcf67400e8907e88fc818d30
Instruction Fuzzy Hash: 392189B09083409ADB149F55C8A432BBBF1FF86390F449A0CF4CA8B761E378C880CB52

Function 00793F68 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89c87bf8a49416322561c17cacfa981ac5946f4534b3d23e182106c98db3fcd
Instruction ID: c330809942003f939eaeac80faff193ad0e24f67aee27e9a0919b8543b55c31b
Opcode Fuzzy Hash: b89c87bf8a49416322561c17cacfa981ac5946f4534b3d23e182106c98db3fcd
Instruction Fuzzy Hash: 7F312B36A042924BDB26CA3C44A046D7EA16E5622139A43EED8B19B3D3DAA5C980C7D5

Function 00759BF8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732362d4dea3aa06521cfd35fc4552f794cef7578ca5345e22e1eca341dced0c
Instruction ID: 249a421384f3fc8daf1602ecb6d7a11dae4603c19312bc4e0a15e9230a49873d
Opcode Fuzzy Hash: 732362d4dea3aa06521cfd35fc4552f794cef7578ca5345e22e1eca341dced0c
Instruction Fuzzy Hash: 43113A736497948A8B1AC9288C600BBFBC59AF310578DC5BDDAC793346D426EC0DC27A

Function 00778278 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fd84eb35d493625d844e637e1fb177c40288a20f3196d160322e86c00bf206
Instruction ID: f9f2175c6b66eeec891960342d20035fed1b984dba0be9e68b86ddf096c9af90
Opcode Fuzzy Hash: 10fd84eb35d493625d844e637e1fb177c40288a20f3196d160322e86c00bf206
Instruction Fuzzy Hash: 7B214A76D4026986CF248F58C8042ADB7B0FF12791FA4D4D9D88877240EF399A85DFA6

Function 007766E6 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4db2e7a7e6a4b6bfbd63caea179ea7f405d1524a8af3c95513a11a8f7ada3b
Instruction ID: 19ccee1f2b4977a6f9a30b83429257467c532a9d14214566d105a05d8c692977
Opcode Fuzzy Hash: 5a4db2e7a7e6a4b6bfbd63caea179ea7f405d1524a8af3c95513a11a8f7ada3b
Instruction Fuzzy Hash: FF11BE702083409FDF04EF18CC80A2AB7F9EB86385F949A1CE0C5C7266E339E914CB56

Function 0077C198 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c51315b3c12bd18b55da43b597f25570391444391c721ad26d4c76662b1ac61
Instruction ID: fde9b4e5eb79576f34c0bb1fd7320ae09718d8b4ea6c99af17927e7b9a846baf
Opcode Fuzzy Hash: 9c51315b3c12bd18b55da43b597f25570391444391c721ad26d4c76662b1ac61
Instruction Fuzzy Hash: 432148B1108381ABDB518B15C88061BBBF2BF8A391F94D82CF4C897262D339D844CB46

Function 00761920 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b896b6d8164971cb7ba37414f80df5efc22a3a844d39286caadf7c5c62d1198
Instruction ID: 8525861ba6424d3ae274c83f6edcd91d8abbae9ebec673955a915ffdd2c14d1b
Opcode Fuzzy Hash: 5b896b6d8164971cb7ba37414f80df5efc22a3a844d39286caadf7c5c62d1198
Instruction Fuzzy Hash: 45213A70400B908FD7268B34C855A67BBF1FF42301F48495DEA8797A92D73AF805CB94

Function 00788B78 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 20e55caae7ac3c2ee7ed41cb5376e30215feab03bcbd2c97c8930cb03e9f722e
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 7311E9B3A451D40DC3269D3C8440575BFA30AD3235F9983D9F4B49B2D6DA26CD8A8356

Function 0077E2E8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960e2e00e3628e1f5e3ba26c325b6cc30fadb638be8208b4fd5208f2d766984d
Instruction ID: 25c78e52d1cef1199cc89d8392d1405f855afab4fd98e81bdd5a5897227fccee
Opcode Fuzzy Hash: 960e2e00e3628e1f5e3ba26c325b6cc30fadb638be8208b4fd5208f2d766984d
Instruction Fuzzy Hash: F60171F160070187EF209EA584C577BB2A86F99741F18856CE94C5B202DF7DEC0987A5

Function 00776410 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1a30c5f86df9b29ac032a507831b123af95fa9cc9c1ef612b51c76bc2b554d
Instruction ID: 19837b33848ad4909504c039460d445331402616df08170c9e694550e06693b7
Opcode Fuzzy Hash: ad1a30c5f86df9b29ac032a507831b123af95fa9cc9c1ef612b51c76bc2b554d
Instruction Fuzzy Hash: FE1104714083599FCB10EF14C8806AAB7E4AF06380F05982CE88993251E779E648CB56

Function 0075C81B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7537f5fd8384a83163d866f176097abd77cb40ec27a0881dcf1d300453dad3e
Instruction ID: f5237a705ac7a6cb246633c71cbca5e41e6e45f79ca0eaa284423a4520543663
Opcode Fuzzy Hash: d7537f5fd8384a83163d866f176097abd77cb40ec27a0881dcf1d300453dad3e
Instruction Fuzzy Hash: F311A1A1E042559FDB0ACF64D9803FEB7B6AF9A305F284428D405A7241E7B9B909C768

Function 0077C3AC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9d6f7422685d54ac9c4b229ea6dda6c46a3da1920c7261afbe68902de17981
Instruction ID: efe231c88df21d6eb06cad95a16afc46a579fa95a924b8cfd262cb9a0aeba473
Opcode Fuzzy Hash: cc9d6f7422685d54ac9c4b229ea6dda6c46a3da1920c7261afbe68902de17981
Instruction Fuzzy Hash: FA01BC70E01606CBCB14CF08C8506AAB3B1FF9A360F14D169E815AB3A0E7389940CB51

Function 0075F058 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bcc21ab59f3068ab92d7e069a64477687dc0058f8902c272e32a697d861a1d
Instruction ID: c63440f853c9597595619fa4ce77ea6bf8d3953273f841e4d94b7e73d783b460
Opcode Fuzzy Hash: e0bcc21ab59f3068ab92d7e069a64477687dc0058f8902c272e32a697d861a1d
Instruction Fuzzy Hash: 67012173A28921078748DD3DDC1156B7AD15BC5630F19873DB9BAC73D0D634C8458655

Function 00768948 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1feb0ecdb06b802b1560528e9a5af3474081b4572b374f0f40b5c4f3f9bd469
Instruction ID: f0fccde58fce04c0c02ea1e3046b5919b6be8f89876e44959fc17dc94ac6cf52
Opcode Fuzzy Hash: c1feb0ecdb06b802b1560528e9a5af3474081b4572b374f0f40b5c4f3f9bd469
Instruction Fuzzy Hash: 45F027F2A042119BEB2189859C80B37FBDCCB8B314F190855EC8677142E1656840C7E3

Function 00793A08 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085a7920e2e5b4e779e34a684b632e4f4ebff8cfa837e5ac39cd2be3ef1db2f6
Instruction ID: e4d40539ec334e718e0f58066fc0835e5ac546897147d43ee1d3d369ed20afa1
Opcode Fuzzy Hash: 085a7920e2e5b4e779e34a684b632e4f4ebff8cfa837e5ac39cd2be3ef1db2f6
Instruction Fuzzy Hash: 49F0343450C380AFD705EB18E884A2EFBF5EB96205F558D1CE0C597222C239D890CB26

Function 00796140 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba64387f099f4ffb45be2b82222d83dc5fb2b584328ce1a123674adc3a9cf20
Instruction ID: 195e9748ca098b4295830c2528fe697c93394fb4735b80b576b3b5a630bfb1e0
Opcode Fuzzy Hash: dba64387f099f4ffb45be2b82222d83dc5fb2b584328ce1a123674adc3a9cf20
Instruction Fuzzy Hash: 1AF01234508240ABC702AF18E48492EFBF1EF0A700F44991CE1C483222D33AD820CB6A

Function 0073A64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: bb5a4ad765c1bc7b632d42ff86b930e533e636903f0b999f5e9e7ef568a4a630
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: F8E08C32921238FBCB14DB98C94AD8AF3ECEB44B00F154496B501D3212C275DE00C7D0

Function 0078EC08 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 4a78cc776bf23552aef8044be63aefb55f20caa1e39b2d2176404da5fc42a07b
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: BCD0A53194C321569B749D199400877F7F0E9C7711F45555EF581E3144D334DC41C379

Function 00722003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d254bf9c634d2148fdd4a7e7e163f1cdfc9d4bce5dbb1e947a4408883c93db6a
Instruction ID: 31ca91421654b27b87d9ac23dfd35651875fc3e4e25da2767beba2b08404aacb
Opcode Fuzzy Hash: d254bf9c634d2148fdd4a7e7e163f1cdfc9d4bce5dbb1e947a4408883c93db6a
Instruction Fuzzy Hash: 89D0957A605A149FC220CF0AE840941F7B8FB9A630B1681A6E904A3B20C334FC02CAE0

Function 00730F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: 2170f2d2c8c6a00bb9fbe8a56cf4fdbb99b1f98cdd5e6d6f9858c6099c8c6523
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: C3C08C34000920C6EE3989108276BA43355ABA2782F8404CCDC1A0B743C51E9C82DA41

Function 00762D4B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a927264b8af54b329c315b56f05fbf2d8de1dbd38e325cfc03de9a518d2d83b6
Instruction ID: 6b2aa5c2db56dbc1e120b210c2cc67bb1d0f20fec10491fa185d3e666d28309a
Opcode Fuzzy Hash: a927264b8af54b329c315b56f05fbf2d8de1dbd38e325cfc03de9a518d2d83b6
Instruction Fuzzy Hash: 05B092E1C00341C6EED02A212C565BAB0280523313F443430EC0723243A56AD51C816B

Function 0077D75B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bde8e0a18542e65954db997d1931066d1f8d4cb0ee69fd957d26d9737444eaa
Instruction ID: a27295a257318b5241a2ab1c04adcd4667995ade686df342534a66667e8f0f6c
Opcode Fuzzy Hash: 9bde8e0a18542e65954db997d1931066d1f8d4cb0ee69fd957d26d9737444eaa
Instruction Fuzzy Hash: F2B092E1C0A510C698122E912D074EEB1240A53202F042039ED0622203AB9EF21E80AF

Function 00796343 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005c4ba806c1f729e01d7b345e607bcf037a1a2af418616e2fc01539d0967c76
Instruction ID: 7795c8e62c6c1a2cba6d6766a4d5bb610867df3ac219b3c08ddfb2e365f90ae1
Opcode Fuzzy Hash: 005c4ba806c1f729e01d7b345e607bcf037a1a2af418616e2fc01539d0967c76
Instruction Fuzzy Hash: D2B092B09083409BE644CF04C4A053AF3B5FB87229F00A82CE15AA3152C330E808CF0E

Function 0079604C Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e353222c480a1e836f2e88ec6b0f54e01aefb973cbd9e2a65436a63ab80d9507
Instruction ID: 90b20a1011eb729eb64d159c706abf0f2e45b7b0e11e27798d7b31732cf018ce
Opcode Fuzzy Hash: e353222c480a1e836f2e88ec6b0f54e01aefb973cbd9e2a65436a63ab80d9507
Instruction Fuzzy Hash: F7A00225E5C10197C60CCF24A950571E2B95BBF205F513428C005BB852D510D440961C

Function 0076338E Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee70fe1013954b18253420cd7c879e3bafbcdc7016d02e7bb28bbb050ed5ff3e
Instruction ID: eb9c71f61387cf9290d7c446bbbdb1ba1a08eb420cde55b5b5e8e69408f34382
Opcode Fuzzy Hash: ee70fe1013954b18253420cd7c879e3bafbcdc7016d02e7bb28bbb050ed5ff3e
Instruction Fuzzy Hash: C0900224D4830086C2488E409490470E23A564F606E117018850D334924620E500850C

Function 0076165F Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0348c40113168c569ecdbaf33ce4c7ca3883923b3352dc9550a20db56e356de0
Instruction ID: 125aa2fd33e84a88d69890093f1abe8245766079576a578208108fcfe1822cf2
Opcode Fuzzy Hash: 0348c40113168c569ecdbaf33ce4c7ca3883923b3352dc9550a20db56e356de0
Instruction Fuzzy Hash: D9900228D582008A8100CE4494A0470F278620B206F1034109008F3012D210E804850C

Function 007253B1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 007253B8
std::_Lockit::_Lockit.LIBCPMT ref: 007253C2
int.LIBCPMT ref: 007253D9

Part of subcall function 007216B4: std::_Lockit::_Lockit.LIBCPMT ref: 007216C5
Part of subcall function 007216B4: std::_Lockit::~_Lockit.LIBCPMT ref: 007216DF

std::_Facet_Register.LIBCPMT ref: 00725413
std::_Lockit::~_Lockit.LIBCPMT ref: 00725433
Concurrency::cancel_current_task.LIBCPMT ref: 00725440

Strings

R[r, xrefs: 00725420

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID: R[r
API String ID: 55977855-2000533315
Opcode ID: 9ddc4545ea53d64597e7fdf58e5ca95406bb3b7a0765bedb17cfeca0de9d7116
Instruction ID: 614fd40e984cac4db98a4184d0cebe2a1c78acad41dc7e946faf225449ad77fd
Opcode Fuzzy Hash: 9ddc4545ea53d64597e7fdf58e5ca95406bb3b7a0765bedb17cfeca0de9d7116
Instruction Fuzzy Hash: 64112131900A38DBCB10EB64E8096AEB7B4BF84324F64050DF801A7281CF7CAE00CB80

Function 0072A5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0072A6E7
___TypeMatch.LIBVCRUNTIME ref: 0072A7F5
CallUnexpected.LIBVCRUNTIME ref: 0072A962

Strings

csm, xrefs: 0072A672
csm, xrefs: 0072A71E
csm, xrefs: 0072A605

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 8ec6703964cbb26e698402649e64d8dd997a5a0747a3f5bea52ab0e0dff1333d
Instruction ID: b90f544dcf07ef0cecb8584ed291ec30a1b0df30e062372421642be0d761225b
Opcode Fuzzy Hash: 8ec6703964cbb26e698402649e64d8dd997a5a0747a3f5bea52ab0e0dff1333d
Instruction Fuzzy Hash: D4B1AB31800229FFCF15DFA4E9849AEB7B5FF14310F14416AE8016B212D339EA52CFA2

Function 00735F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,470E316F,?,00736057,0072C446,?,F8250000,00000000), ref: 0073600B

Strings

api-ms-, xrefs: 00735FA1
ext-ms-, xrefs: 00735FB5

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 32548b7bfc77f5092af99358e6666491213a3a57bbdfb07d3eec54b008ba91e8
Instruction ID: aac31be3fc5ce7fc5d63d691bbddce3f035693b7f386a16e5fb13ba537e8ebc9
Opcode Fuzzy Hash: 32548b7bfc77f5092af99358e6666491213a3a57bbdfb07d3eec54b008ba91e8
Instruction Fuzzy Hash: 61210D76A01511ABE7319B24DC45E6E7768EF42760F244211F915A72D2E73CEE01C6E0

Function 0072507A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00725081
std::_Lockit::_Lockit.LIBCPMT ref: 0072508C
std::locale::_Setgloballocale.LIBCPMT ref: 007250A7
_Yarn.LIBCPMT ref: 007250BD
std::_Lockit::~_Lockit.LIBCPMT ref: 007250FA

Strings

R[r, xrefs: 007250C9, 007250ED

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID: R[r
API String ID: 156189095-2000533315
Opcode ID: c779f94b42495eef70d37303c1a577a53b0157247f4c96028c954675e26826bf
Instruction ID: 5d85727d839dacdd16b9e93f92f0aa25b8db467d96dfdc32a3f303b1156564bc
Opcode Fuzzy Hash: c779f94b42495eef70d37303c1a577a53b0157247f4c96028c954675e26826bf
Instruction Fuzzy Hash: 08017C79A00978DBCB09EB20E859A7C7BA1BFC6340B588009E91157381CF3CAE12CBC5

Function 00730F50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,470E316F,?,?,00000000,00741FC8,000000FF,?,00730EE0,00731010,?,00730EB4,00000000), ref: 00730F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00730F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,00741FC8,000000FF,?,00730EE0,00731010,?,00730EB4,00000000), ref: 00730FB9

Strings

R[r, xrefs: 00730FA8
CorExitProcess, xrefs: 00730F8F
mscoree.dll, xrefs: 00730F7E

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$R[r$mscoree.dll
API String ID: 4061214504-3487169893
Opcode ID: 41e35444b78c3445fe7f05bcae66918343a6334919e6bb4202851cce198e1ce7
Instruction ID: d9556f14f2e57932e4491e66563371c134577ac256df06f6dea5b4adc5e7c9b0
Opcode Fuzzy Hash: 41e35444b78c3445fe7f05bcae66918343a6334919e6bb4202851cce198e1ce7
Instruction Fuzzy Hash: BF01D675944619EFDB219F50DC09FAEBBB8FB05B10F00462AF811A22E0DB7C9904CA94

Function 0073F356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b4ce3a97fb3f3a4ad229c3571cffa65c92c02ce9c51d45f1c628ef467c7440
Instruction ID: 52e15d0a2f5b449c6085a878a6f94df334dfab12ef23294754331377b36afb18
Opcode Fuzzy Hash: a5b4ce3a97fb3f3a4ad229c3571cffa65c92c02ce9c51d45f1c628ef467c7440
Instruction Fuzzy Hash: 34B11574E04249DFEB11DF98D885BAD7BB1AF85380F148169E4019B2A3C779DD41CF60

Function 0072A25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0072A251,00728978,00727AFF), ref: 0072A268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0072A276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0072A28F
SetLastError.KERNEL32(00000000,0072A251,00728978,00727AFF), ref: 0072A2E1

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 9ddfc7be3205904382b5df12d0165ef844f25069c6de31281a35601ed262509b
Instruction ID: 4719fa7d0503065f101db331c24ef997e62d48ac0cc70c1c006e7c0585bd00fc
Opcode Fuzzy Hash: 9ddfc7be3205904382b5df12d0165ef844f25069c6de31281a35601ed262509b
Instruction Fuzzy Hash: 0D01923620D771FF962426B47D8AB262785FB43B75B20432AF510460F1EB5E4D02514A

Function 0072A371 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0072A438
___AdjustPointer.LIBCMT ref: 0072A45B
___AdjustPointer.LIBCMT ref: 0072A4F7

Strings

R[r, xrefs: 0072A3D0

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: AdjustPointer
String ID: R[r
API String ID: 1740715915-2000533315
Opcode ID: 6e4f2f35cdc6c40a3dfd86c82e2c356c1abe5fc4c017a87a32ff07c7799d81bc
Instruction ID: e08c31fac47581165eedf42db788a5bc242a5bc2a17ceef5f4fcdcbcd4c38e5a
Opcode Fuzzy Hash: 6e4f2f35cdc6c40a3dfd86c82e2c356c1abe5fc4c017a87a32ff07c7799d81bc
Instruction Fuzzy Hash: 13510472601366FFDB29AF18F849B7A77A4EF00310F24442DE80587192E779ED40CB92

Function 00724436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00724442
int.LIBCPMT ref: 00724455

Part of subcall function 007216B4: std::_Lockit::_Lockit.LIBCPMT ref: 007216C5
Part of subcall function 007216B4: std::_Lockit::~_Lockit.LIBCPMT ref: 007216DF

std::_Facet_Register.LIBCPMT ref: 00724488
std::_Lockit::~_Lockit.LIBCPMT ref: 0072449E
Concurrency::cancel_current_task.LIBCPMT ref: 007244A9

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: d1e02095cd71e5d2be36eba8744acc010167834fa4f0a7149a81e693f928d13b
Instruction ID: b19e59c1763f2719fdbb034482e2c62a571a30fd1cb1922c00181eb037d38d02
Opcode Fuzzy Hash: d1e02095cd71e5d2be36eba8744acc010167834fa4f0a7149a81e693f928d13b
Instruction Fuzzy Hash: 6A01F272A00178EBCB25FB64FC0ADAD77A8EFD0360B200158F905A7291EF389E41C780

Function 00723DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00723DBD
int.LIBCPMT ref: 00723DD0

Part of subcall function 007216B4: std::_Lockit::_Lockit.LIBCPMT ref: 007216C5
Part of subcall function 007216B4: std::_Lockit::~_Lockit.LIBCPMT ref: 007216DF

std::_Facet_Register.LIBCPMT ref: 00723E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00723E19
Concurrency::cancel_current_task.LIBCPMT ref: 00723E24

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: cd9ec3b2d67b7f076913796481743431273449fea647d753062607861fcb3c2b
Instruction ID: d859ca40e80260d4d64a40b001574a3bdc2bfb8b7cd01d91c31210d847fe0aee
Opcode Fuzzy Hash: cd9ec3b2d67b7f076913796481743431273449fea647d753062607861fcb3c2b
Instruction Fuzzy Hash: 7D018472A04538EBCB29AB54FC0989E77A8EF91760B214159F90157291EB3C9E01C780

Function 00724308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00724315
int.LIBCPMT ref: 00724328

Part of subcall function 007216B4: std::_Lockit::_Lockit.LIBCPMT ref: 007216C5
Part of subcall function 007216B4: std::_Lockit::~_Lockit.LIBCPMT ref: 007216DF

std::_Facet_Register.LIBCPMT ref: 0072435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00724371
Concurrency::cancel_current_task.LIBCPMT ref: 0072437C

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: b801983898a6d3522e6ff799f5b007e655fc907c85bbc963d61ebd759a035c97
Instruction ID: 5a3607485c18faeb8266be2236a1e58c45d3bd894c7ccd7425eeb3e3c1beb096
Opcode Fuzzy Hash: b801983898a6d3522e6ff799f5b007e655fc907c85bbc963d61ebd759a035c97
Instruction Fuzzy Hash: 6701A772600538E7CB15EB64FC0A89D77A4AFD1760F110158F90567291EF389E05C7C4

Function 0072A060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0072A09F
__IsNonwritableInCurrentImage.LIBCMT ref: 0072A153

Strings

R[r, xrefs: 0072A16C
csm, xrefs: 0072A13D

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: R[r$csm
API String ID: 3480331319-4135995428
Opcode ID: 918fd3dbb1b316441a7d757aed559fb0e03ac3004fbe5cff141797a74cd466ae
Instruction ID: 67d71665142eafa98a996d788977f0db24ad71db998d6bca5c463e408215cf70
Opcode Fuzzy Hash: 918fd3dbb1b316441a7d757aed559fb0e03ac3004fbe5cff141797a74cd466ae
Instruction Fuzzy Hash: 68419334E0022CEBCF10DF68E885A9E7BB5BF45324F148155E814AB392D739EE55CB91

Function 0072B3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0072B353,00000000,?,007A68DC,?,?,?,0072B4F6,00000004,InitializeCriticalSectionEx,00744BD8,InitializeCriticalSectionEx), ref: 0072B3AF
GetLastError.KERNEL32(?,0072B353,00000000,?,007A68DC,?,?,?,0072B4F6,00000004,InitializeCriticalSectionEx,00744BD8,InitializeCriticalSectionEx,00000000,?,0072B2AD), ref: 0072B3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0072B3E1

Strings

api-ms-, xrefs: 0072B3C6

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: bbcf1dd4597c6ade583b4d17f0c74a502dbc84fcd576c03d0da71433d9499020
Instruction ID: 2748de82f6e9d11c34cf8b57b466640f6b416e2bbf03a0394ee5e6b6f6c88ebc
Opcode Fuzzy Hash: bbcf1dd4597c6ade583b4d17f0c74a502dbc84fcd576c03d0da71433d9499020
Instruction Fuzzy Hash: 37E01A74680248B7EB215BB1EC4AB693B59EF01B41F204122FA0CE80E2E7699A509688

Function 00737747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(470E316F,00000000,00000000,00000000), ref: 007377AA

Part of subcall function 0073952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00738FD3,?,00000000,-00000008), ref: 007395D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00737A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00737A4D
GetLastError.KERNEL32 ref: 00737AF0

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 6314009f2ec00976f92f7c011bd9af160b5f5705cf66096eb4fb93c41c641344
Instruction ID: 56605e2a11b3f151a5848389c0774aa14b727f3716ef6ba9f3b2e115abdbba8e
Opcode Fuzzy Hash: 6314009f2ec00976f92f7c011bd9af160b5f5705cf66096eb4fb93c41c641344
Instruction Fuzzy Hash: 8BD179B5E04258DFDF29CFA8C8849ADBBB5FF49300F18852AE855E7352D734A941CB50

Function 007406EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0073F713,00000000,00000001,00000000,00000000,?,00737B44,00000000,00000000,00000000), ref: 00740706
GetLastError.KERNEL32(?,0073F713,00000000,00000001,00000000,00000000,?,00737B44,00000000,00000000,00000000,00000000,00000000,?,007380CB,00000000), ref: 00740712

Part of subcall function 007406D8: CloseHandle.KERNEL32(FFFFFFFE,00740722,?,0073F713,00000000,00000001,00000000,00000000,?,00737B44,00000000,00000000,00000000,00000000,00000000), ref: 007406E8

___initconout.LIBCMT ref: 00740722

Part of subcall function 0074069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,007406C9,0073F700,00000000,?,00737B44,00000000,00000000,00000000,00000000), ref: 007406AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0073F713,00000000,00000001,00000000,00000000,?,00737B44,00000000,00000000,00000000,00000000), ref: 00740737

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: fcabb9b7517968dd9faff3ebed0742147f9274ef40c33c57e9a2adbad4d81fd9
Instruction ID: 6f840ec9ef6538fe677d7f727287910ba292bd950b143a88c4acda3a52248342
Opcode Fuzzy Hash: fcabb9b7517968dd9faff3ebed0742147f9274ef40c33c57e9a2adbad4d81fd9
Instruction Fuzzy Hash: 96F01C3A100158BBCF221F95DC089993FA6FB4A3A1B018011FB5E95130CB3A8D20EFD9

Function 00741093 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,007409EF), ref: 007410AC

Strings

Lit, xrefs: 00741241
R[r, xrefs: 00741176, 00741220, 00741266

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: DecodePointer
String ID: Lit$R[r
API String ID: 3527080286-2588053206
Opcode ID: 170fd6da9ed05b3c50335742b8a308c39fa8a8d9fd4a5d149ccd0b809ab43b67
Instruction ID: 6d0675473067e284448fc20b2ed908939c6731d7c868b1a359a453b946789a07
Opcode Fuzzy Hash: 170fd6da9ed05b3c50335742b8a308c39fa8a8d9fd4a5d149ccd0b809ab43b67
Instruction Fuzzy Hash: 5251B171A0060EDBCF10AFA8E84C5BDBFB4FB46300F914155D591E7264C7BC9AA5CB49

Function 00725F4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 00726026

Strings

R[r, xrefs: 00726005

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: Fputc
String ID: R[r
API String ID: 3078413507-2000533315
Opcode ID: baca899c90fccd8b606dc020d5fbcd38218c012214fbd023e311918c0293069b
Instruction ID: b1dc32372b1d6a06f4deed808b261e6824577eb05b34c8e469e22c52dd1a48bd
Opcode Fuzzy Hash: baca899c90fccd8b606dc020d5fbcd38218c012214fbd023e311918c0293069b
Instruction Fuzzy Hash: 2541A236910A2AEFCF14DF64E5848EDB7B8FF08311B144426E941A7680E739FD51CB90

Function 0072A96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0072A992

Strings

RCC, xrefs: 0072A9AC
MOC, xrefs: 0072A9A4

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 42e8854a07f0992706ee84df6f20f425be54a9c5e24d7f3c695404515d6688dd
Instruction ID: a1293dab5b603c93566ea69b8654b3fd523738fd7188cbdf59678676f098d423
Opcode Fuzzy Hash: 42e8854a07f0992706ee84df6f20f425be54a9c5e24d7f3c695404515d6688dd
Instruction Fuzzy Hash: D3414A71900219FFCF16DF98DD85AAEBBB5FF48300F158099F904A7211D339AA90DB52

Function 00726CA2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00727643
___raise_securityfailure.LIBCMT ref: 0072772B

Strings

xez, xrefs: 00727726

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: xez
API String ID: 3761405300-234481466
Opcode ID: f8501979d57890e70071051a736c9790db3945e8b093f839473ce77e662a2caf
Instruction ID: 7b24a6ed82ee3cf52a83b12b618e24e2e1581e1bf7dc4a5fadd40e03881dc2bd
Opcode Fuzzy Hash: f8501979d57890e70071051a736c9790db3945e8b093f839473ce77e662a2caf
Instruction Fuzzy Hash: A621CFB9941204DAE718CF29F946B403BB4FB9A700F18D52AE5088B3B0E3BD5981DF09

Function 00725107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00725113
std::_Lockit::~_Lockit.LIBCPMT ref: 0072516F

Strings

R[r, xrefs: 0072513A, 00725154

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: R[r
API String ID: 593203224-2000533315
Opcode ID: 0e6cdd6f54bb948c47b1424493226201a0cf5d46b2063a67e9bbc22615a176e0
Instruction ID: d4b3e413f57afce5e601a96f4e8c948077de2b2381d028571dd928e543302744
Opcode Fuzzy Hash: 0e6cdd6f54bb948c47b1424493226201a0cf5d46b2063a67e9bbc22615a176e0
Instruction Fuzzy Hash: E501D435700928EFCB10EF18E885E9D77B9EF85710B04409AE9069B3A1DFB4EE00CB50

Function 00727740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0072774B
___raise_securityfailure.LIBCMT ref: 00727808

Strings

xez, xrefs: 00727803

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: xez
API String ID: 3761405300-234481466
Opcode ID: 6289e866d03a8c0e8fa74965374c78eb1bd80a6ba5d9b6eb9afbdbf287db3be3
Instruction ID: 7b25c0f76f9f8864efa516bcdc9396c6159eefe3b80cb7a5c96fedc55f53db2a
Opcode Fuzzy Hash: 6289e866d03a8c0e8fa74965374c78eb1bd80a6ba5d9b6eb9afbdbf287db3be3
Instruction Fuzzy Hash: 1D11ACB8911204DFD704CF29F986A403BB4BB9A741F09D52AE818873B4E3789981DF49

Function 007215DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 007215E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0072161E

Part of subcall function 00725178: _Yarn.LIBCPMT ref: 00725197
Part of subcall function 00725178: _Yarn.LIBCPMT ref: 007251BB

Strings

bad locale name, xrefs: 0072162C

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: e8445f3f70392376f73790acb52c2ba5db5f5d5c9f1d26751a57857b06d0e994
Instruction ID: 47e0c3d99ac17f49262e9f8a4e7d053a909b1d348a7e9df206b1525e5db24ac9
Opcode Fuzzy Hash: e8445f3f70392376f73790acb52c2ba5db5f5d5c9f1d26751a57857b06d0e994
Instruction Fuzzy Hash: 61F01D71545B949E83319F7A9481447FBE4BE283203948A2EE1DEC3A11D734A404CB6A

Function 007362A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 007362E6

Strings

InitializeCriticalSectionEx, xrefs: 007362B6
R[r, xrefs: 007362D6

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$R[r
API String ID: 2593887523-1421526989
Opcode ID: af2cb5f619a3909b214ecc2b5f75f13fc8440cbfafcc81d0eb68ab4d02a07089
Instruction ID: bbd1b619189d81820f6140a8f6de7760c9f80f64d5e3ac3b1615490ab0924221
Opcode Fuzzy Hash: af2cb5f619a3909b214ecc2b5f75f13fc8440cbfafcc81d0eb68ab4d02a07089
Instruction Fuzzy Hash: 9EE0927A140218B7DF112F90EC06E9E7F15EB45BA1F00C021FD1C25161C7BAD920E6C8

Function 0073612C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00736160

Strings

FlsAlloc, xrefs: 0073613C
R[r, xrefs: 00736156

Memory Dump Source

Source File: 00000000.00000002.1464395449.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1464377974.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464419407.0000000000743000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464436031.000000000074D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464472373.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464485800.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464498889.00000000007A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_j8zJ5Jwja4.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc$R[r
API String ID: 2773662609-1637649424
Opcode ID: f499ea0348976735658f3ac3e77869a8f2c40c0e078d385dde53497bc4e7cb11
Instruction ID: d7083b09ad792aa57f2963ee41c84839462ef670d5c3fc53d89ef3a387b859b8
Opcode Fuzzy Hash: f499ea0348976735658f3ac3e77869a8f2c40c0e078d385dde53497bc4e7cb11
Instruction Fuzzy Hash: 88E0CD7968561CB3922527605C07E5E7A14CB45B61F008011FD0825192DBAD5910D1D5

Analysis Process: MSBuild.exePID: 7760, Parent PID: 7736COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	43
Total number of Limit Nodes:	6

Executed Functions

Function 0040D390 Relevance: 6.2, APIs: 4, Instructions: 154
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D3A1
GetCurrentThreadId.KERNEL32 ref: 0040D3B6
GetCurrentProcessId.KERNEL32 ref: 0040D3BC
ExitProcess.KERNEL32 ref: 0040D580

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID:
API String ID: 1029096631-0
Opcode ID: 91b0cbc643e4b4ebeb18023be9ae76da3501924d19314061550aa6d351ab72eb
Instruction ID: 7fe0d86d4b211a0ed1928a564c0dc3b48ff1420feaec6627cd99d8fdc632b15c
Opcode Fuzzy Hash: 91b0cbc643e4b4ebeb18023be9ae76da3501924d19314061550aa6d351ab72eb
Instruction Fuzzy Hash: CE41277480C240ABD301BFA9D544A1EFBF5EF56708F148D2EE5C4A7392D23AD8148B6B

Function 004464F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00449A1D,005C003F,00000006,?,?,00000018,,?,?), ref: 0044651E

Strings

, xrefs: 004464F0, 0044650C, 0044651A

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00446040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 004460C4

Strings

aD, xrefs: 004460CA
;:9, xrefs: 004460B6, 00446093, 0044609B

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID: aD$;:9
API String ID: 1279760036-3784982549
Opcode ID: b2b91b6383baed23bd5779aad5e8932164b52d5e1660306671fc792bfb274a1b
Instruction ID: 81d8e38a202773684cb26477d2aab6f794b7f55265c2f37ac0847f9732ca8712
Opcode Fuzzy Hash: b2b91b6383baed23bd5779aad5e8932164b52d5e1660306671fc792bfb274a1b
Instruction Fuzzy Hash: 70119D75508200EBD301EF28E900A1ABBF5AF86B16F05483DE5C58B212E73AD854CB9B

Function 00446709 Relevance: 3.0, APIs: 2, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00446709
GetForegroundWindow.USER32 ref: 00446720

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 61e954c21ccda2bc507880c9326b32b816de450e3ecc2bacd25776dc5b00f227
Instruction ID: 906c729b96ff40db5e6bb0cb1f2bfce635365c04e2c32f2be8addff1d813b1a5
Opcode Fuzzy Hash: 61e954c21ccda2bc507880c9326b32b816de450e3ecc2bacd25776dc5b00f227
Instruction Fuzzy Hash: 4ED05EACA12240A7EA04FB37FC1E85B3615E79221E7464838E40686312D636E851C65B

Function 00445C4A Relevance: 1.6, APIs: 1, Instructions: 71
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(33A03193,00000000,00000800), ref: 00445CD7

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 72bf814f0518dc5835282787a3600c9ebb27de0fde571f4b41e5eadb2c516951
Instruction ID: 1ed73a75136f75e105c7bb7e785e3dfd24c55cc57a7816ce4e470644bd5d90c0
Opcode Fuzzy Hash: 72bf814f0518dc5835282787a3600c9ebb27de0fde571f4b41e5eadb2c516951
Instruction Fuzzy Hash: 7A218C7520C380AFE745CF29E99061BBBE1ABC9205F58C82DF5C987352C238D905DB6A

Function 00443A20 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00443A83

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bbe3c0725eeb12269a4fd9373789c992c7f1f0aafca5c16579677f982f5a7c14
Instruction ID: 208812190be25b9880a5f29952ef9a922b1c788544e9e186d94aa430ee1b0748
Opcode Fuzzy Hash: bbe3c0725eeb12269a4fd9373789c992c7f1f0aafca5c16579677f982f5a7c14
Instruction Fuzzy Hash: 67F0373410C2409BE301EF19D954A0EBBF4EF9A701F14886CE4C89B2A2C335E814CBAB

Function 00443AA0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00443B03

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5c61f5cf0f16499e49ba7738a8fe8bc67c56cab5a0bd252042df475734ab51e5
Instruction ID: 302f255876a8acf85142c7b8a32416b12f9909014dbe577f3d47d642ddc48781
Opcode Fuzzy Hash: 5c61f5cf0f16499e49ba7738a8fe8bc67c56cab5a0bd252042df475734ab51e5
Instruction Fuzzy Hash: 84F04F3450C2509BD701AF18E945A1EFBF5EF56706F454C68F4C4AB261C339DD60CB9A

Non-executed Functions

Function 0042D9A0 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 396COMMON

Download Yara Rule

Strings

US, xrefs: 0042E1C3
7Wu, xrefs: 0042E48F
sB, xrefs: 0042E66D
sLlS, xrefs: 0042E5D6
9u9s, xrefs: 0042E183
WJL{, xrefs: 0042E5FA, 0042E604, 0042E464, 0042E46D, 0042E60D, 0042E62F
RB, xrefs: 0042E64C
Dtgr, xrefs: 0042E5C6

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: 9u9s$Dtgr$RB$WJL{$sLlS$sB$7Wu$US
API String ID: 0-348788003
Opcode ID: 276c1ab203addd20c735120bb759d55bade8af3356c5969ab96734506833bd0c
Instruction ID: cba3938b4c7428f4d552087925c859a69b1ab55a6ae02eac8884ff4f61b23fd4
Opcode Fuzzy Hash: 276c1ab203addd20c735120bb759d55bade8af3356c5969ab96734506833bd0c
Instruction Fuzzy Hash: B1F167B4508340DFD710AF66E89061BBBF0AF86345F54892EF5848B362D3B9C844CF9A

Function 004396A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004396B0
GetWindowLongW.USER32 ref: 004396D5
GetClipboardData.USER32 ref: 004396E5
GlobalLock.KERNEL32 ref: 004396FE
GlobalUnlock.KERNEL32 ref: 004397EC
CloseClipboard.USER32 ref: 004397F5

Strings

=, xrefs: 00439773

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: =
API String ID: 2832541153-2322244508
Opcode ID: 78c8dc26131ed5dac9393a6ada90e30b4fdfd99cd617a6bba74dde0b2099fdf1
Instruction ID: 322da3c77394848e095178107a49c73a551c132a77b07a9a0bf135f40f579efd
Opcode Fuzzy Hash: 78c8dc26131ed5dac9393a6ada90e30b4fdfd99cd617a6bba74dde0b2099fdf1
Instruction Fuzzy Hash: 4941537551C381CED311AF7C944831EBFE09B96224F044E6DF4E5862D1D3788945C797

Function 00428230 Relevance: 1.7, APIs: 1, Instructions: 242comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044DB80,00000000,00000001,0044DB70), ref: 00428259

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: e7c828e8500b304e47737f2c036b73e87bd74cd8a23869b162ce918d436332e7
Instruction ID: 8b374b447a84a3eb6516e4531b44e52363fa817f3f4265ccba2139a59f939f2f
Opcode Fuzzy Hash: e7c828e8500b304e47737f2c036b73e87bd74cd8a23869b162ce918d436332e7
Instruction Fuzzy Hash: C651EDB07002209BDB20EB64EC92B6B33B4EF81758F54455DF9858B390FB79E801C76A

Function 0043FDBB Relevance: 31.9, APIs: 11, Strings: 7, Instructions: 425memorycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044DCE0,00000000,00000001,0044DCD0,?), ref: 0043FE41
SysAllocString.OLEAUT32(?), ref: 0043FEC5
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0043FF03
SysAllocString.OLEAUT32(?), ref: 0043FF65
SysAllocString.OLEAUT32(?), ref: 00440015
VariantInit.OLEAUT32(6D3F6B39), ref: 0044007E
VariantClear.OLEAUT32(?), ref: 00440123
SysFreeString.OLEAUT32(?), ref: 00440145
SysFreeString.OLEAUT32(?), ref: 0044014E
SysFreeString.OLEAUT32(?), ref: 00440181

Strings

l3u5, xrefs: 0043FF77
bS3U, xrefs: 0043FFAF
1[!], xrefs: 0043FFA1
"_kQ, xrefs: 0043FFA8
q7bI, xrefs: 0043FF7E
9k?m, xrefs: 0043FFBD
hKpM, xrefs: 0043FF85

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInitInstanceProxy
String ID: "_kQ$1[!]$9k?m$bS3U$hKpM$l3u5$q7bI
API String ID: 2485776651-1023481837
Opcode ID: 3b03e2147dce430a0f8925663908d52cba351bca58096ea1b67891df1644cd7a
Instruction ID: abc33ae36a095545e2bb41dcd0e979c6fcd6de482cd85a6a90bd509a0ecf98e9
Opcode Fuzzy Hash: 3b03e2147dce430a0f8925663908d52cba351bca58096ea1b67891df1644cd7a
Instruction Fuzzy Hash: 1FE16974100B01EFE3208F15C985B16BBF1FF4AB02F148969E59A8BAA1C775F855CF98

Function 004365E8 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004365F4
VariantInit.OLEAUT32 ref: 00436606

Strings

Y, xrefs: 00436647
[, xrefs: 0043664F
O, xrefs: 0043661F
U, xrefs: 00436637
S, xrefs: 0043662F
Q, xrefs: 00436627
W, xrefs: 0043663F
], xrefs: 00436657
_, xrefs: 0043665F

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Variant$ClearInit
String ID: O$Q$S$U$W$Y$[$]$_
API String ID: 2610073882-3709029455
Opcode ID: bf4df09837cc0999f8912889e458b68c9d6c2582af1171711b600cbe8bd283c9
Instruction ID: 617472aee6f7647b6791f64ddb482ed0964e05965680e50c34387cf75e2fd40f
Opcode Fuzzy Hash: bf4df09837cc0999f8912889e458b68c9d6c2582af1171711b600cbe8bd283c9
Instruction Fuzzy Hash: 8041E970008B81CED721DF38C894756BFE0AB56314F08869DD8EA4F3D6C775A549CB66

Function 004360C9 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 73COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004360DA
VariantInit.OLEAUT32 ref: 004360EC

Strings

S, xrefs: 00436115
W, xrefs: 00436125
_, xrefs: 00436145
U, xrefs: 0043611D
Y, xrefs: 0043612D
[, xrefs: 00436135
O, xrefs: 00436105
], xrefs: 0043613D
Q, xrefs: 0043610D

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Variant$ClearInit
String ID: O$Q$S$U$W$Y$[$]$_
API String ID: 2610073882-3709029455
Opcode ID: f7635afb3bd54eb494f8a0a77bb65c5c2b8a5d4eaa981fde32eb2f6ea89c106d
Instruction ID: 3870ab933f990c28619918e5480d85312f3f30b48fe24ca90a854e860725b9d7
Opcode Fuzzy Hash: f7635afb3bd54eb494f8a0a77bb65c5c2b8a5d4eaa981fde32eb2f6ea89c106d
Instruction Fuzzy Hash: 9C41B474009BC1CEE725DF38C898B46BFA06B56314F088A9DD8E94F296C375A515CB62

Function 00438B2F Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00438B74

Strings

p, xrefs: 00438BC6
i, xrefs: 00438B96
t, xrefs: 00438BD6
|, xrefs: 00438BB6
d, xrefs: 00438B8E
}, xrefs: 00438BDE

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: InitVariant
String ID: d$i$p$t$|$}
API String ID: 1927566239-2434808017
Opcode ID: 554a65b0e6783a8a587c5d9d5a1a59090ef91d405a8573379fac870fe920457a
Instruction ID: 0b84109ddb38ce271a869d6b766c0ab2b1e4120020a45687ac22dc4c2f8272eb
Opcode Fuzzy Hash: 554a65b0e6783a8a587c5d9d5a1a59090ef91d405a8573379fac870fe920457a
Instruction Fuzzy Hash: FE411870508781CED725CF28C494716BFE0AB66324F08869DD8EA4F397C775E515CBA2

Function 00438417 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00438444

Strings

i, xrefs: 00438466
p, xrefs: 00438496
t, xrefs: 004384A6
d, xrefs: 0043845E
}, xrefs: 004384AE
|, xrefs: 00438486

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: InitVariant
String ID: d$i$p$t$|$}
API String ID: 1927566239-2434808017
Opcode ID: 752ed3a4123867835ced7968c358781d81873fa4b79cdbc7d9d63c2e707b67c3
Instruction ID: 90d411813917745457a09f1c6fb0e7b6a5668ded3b473b778bf00fa4b3dd6296
Opcode Fuzzy Hash: 752ed3a4123867835ced7968c358781d81873fa4b79cdbc7d9d63c2e707b67c3
Instruction Fuzzy Hash: 9541D760108781CED721DF2CC484716BFE06B66214F088A8DD8EA4F7D7C375D519CB62

Function 004126B3 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 301COMMON

Download Yara Rule

Strings

wCA, xrefs: 00412B66
GD, xrefs: 004126C0
fch%, xrefs: 00412788
tBA, xrefs: 00412AE7

Memory Dump Source

Source File: 00000002.00000002.1432724875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: GD$fch%$tBA$wCA
API String ID: 0-2815851639
Opcode ID: 18b95ce0547799c8335b9632188030b7790c54437027a763add69c76ec3f01d7
Instruction ID: d035267a3a9853f3dfc0ceb4180196f553011948bb1c76c1f0fbabd1dc92564a
Opcode Fuzzy Hash: 18b95ce0547799c8335b9632188030b7790c54437027a763add69c76ec3f01d7
Instruction Fuzzy Hash: F6B158B04093C1CBE7318F149554BEFBBE0BB8A348F140A6EE4C99B242D7799545CB66

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report j8zJ5Jwja4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_j8zJ5Jwja4.exe_1966512a4c1b30f6d3a54994d6808c78ed874d_fc5164de_5b9e6915-1166-4648-8a92-c0d7202a1d2c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC0B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC79.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERECA9.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
j8zJ5Jwja4.exe

Function 00722021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Function 00736368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Function 00738E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 0073A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00739FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON